Most small service shops run on trust, and most of the time that works. The owner knows everyone, the crew is four people, and the idea of "internal controls" sounds like something for a company with a compliance department. Then a month closes two thousand dollars light and nobody can say whether it was a miscount, a part that walked, a refund nobody mentioned or plain bad arithmetic. The problem is rarely that someone stole. It is that there is no way to tell.
As of October 2026, role permissions, audit logs and a second sign-in check are ordinary features of point-of-sale and field service software. Having them switched on is not the same as having controls. This guide covers the handful of actions that deserve restriction in a 1 to 10 person shop, how to separate duties when there are only four of you, how to read an audit log in fifteen minutes a week, and what to do when the numbers do not tie.
Controls protect honest people too
Owners resist this subject because it feels like an accusation. It helps to turn it around. When anyone can void a sale and nothing records who did, every unexplained shortage hangs over the whole crew. When each action is tied to a login and a reason, an honest tech can show exactly what they did, and a mistake gets traced to a cause instead of a person's character.
Controls also catch errors, which are far more common than theft. A refund keyed twice, a discount applied to the wrong line, a stock count typed as 40 instead of 4. All of these look identical to theft in a monthly total and nothing like it in a log.
The aim is modest: every action that changes money or inventory should be attributable, explainable and reviewed by someone other than the person who did it.
The actions worth restricting
Do not lock down everything. A system where techs cannot do their jobs without calling the owner gets bypassed within a week. Restrict the short list of actions that remove money or stock from the record.
Voids. A void erases a sale as if it never happened. That is correct for a genuine mistake and a classic way to hide a cash sale. Our guide to refunds, returns and voids explains the difference between the three in detail.
Refunds. Money leaving the business. Each one needs a reason and a link to the original sale.
Discounts. The most frequent leak, because each one is small. Who may discount, and how much, is a policy of its own, set out in who gets to discount.
Stock adjustments. Changing a count by hand removes inventory without a sale. Adjustments are necessary after a count and should be rare otherwise.
Register and cash handling. Opening a shift, counting the drawer, closing it.
Changing permissions and users. Whoever can edit roles can grant themselves everything. This belongs to the owner.
Seeing other people's numbers. A tech at one shop rarely needs another shop's sales, pay rates or margins.
Separation of duties when there are four of you
The textbook rule is that the person who handles an asset should not also keep the record of it or approve changes to it. A large company gives those to three departments. A four-person shop has to be practical.
The workable version is simpler: split each sensitive task into doing and checking, and make sure two different people hold the halves. Where that is impossible, the owner checks, from the system's record, on a fixed day.
| Sensitive action | Who does it | Who checks it | What the checker looks at |
|---|---|---|---|
| Void a sale | Manager or owner, on a tech's request | Owner, weekly | Each void, who did it, the reason, the time |
| Refund | Manager or owner | Bookkeeper or owner | Refund matched to the original sale and the returned part |
| Discount over the limit | Tech asks; manager approves | Owner, monthly | Discount dollars by tech |
| Stock adjustment | The person who counted | Someone who did not count | Adjustment against the count sheet |
| Register close | Whoever worked the shift | A different person counts or recounts | Counted cash against the shift's recorded total |
| Bank deposit | One person takes it | Another matches the deposit to the close | Deposit slip against the close |
| Add or change a user | Owner | Owner, when someone leaves or changes role | The current list of logins and roles |
Two rules make this hold. Nobody approves their own exception: a manager who needs a refund on their own sale asks the owner. And the check has a calendar slot. An unscheduled review does not happen.
The daily cash side of this has its own routine, laid out in the end-of-day close. Controls and the close reinforce each other: the close produces the number, permissions limit who can change it afterward.
Build roles from jobs, not from people
The usual mistake is setting permissions person by person: Maria can refund because she has been here six years, Dave cannot because he is new. Within a year nobody remembers why anyone has what they have.
Define a few roles by what the job requires, then assign people to roles.
- Technician. Rings up sales and quotes, sends payment requests, sees their own sales and their own truck's stock. Cannot void, refund or adjust counts.
- Lead or counter. Everything a tech can do, plus discounts up to the stated limit and receiving stock.
- Manager. Voids, refunds, stock counts and adjustments, register close, shop-level reports.
- Bookkeeper. Reads reports and exports. Does not ring up sales or touch stock.
- Owner. Everything, including users and roles.
Start every new hire in the most limited role that lets them work, and widen it deliberately. If you are adding staff for the first time, set the roles up before day one, as covered in hiring your first technician. When someone leaves, remove the login that day. When someone changes job, change the role, not a scatter of individual switches.
One login per person is the precondition for all of it. Shared logins are common where software charges per user, and they make every control in this guide meaningless.
A second check for the actions that matter
A password proves someone knew the password. For the few actions that remove money or stock, a second confirmation at the moment of the action is worth the ten seconds: typically a second sign-in factor, asked for again when they void, refund or change stock.
This guards against two ordinary situations. One is the unlocked tablet on the counter, where whoever picks it up acts as whoever was signed in. The other is the shared password that everyone "just knows." A second check at the moment of the void ties the action to the person who can pass it.
It adds friction, deliberately, and only to rare actions. A tech ringing up thirty sales a day never sees it. A manager issuing two refunds a week sees it twice.
The fifteen-minute weekly audit log review
An audit log nobody reads is storage. The review is the control. Pick a day, set a timer and look at the same five things in the same order.
- Voids. Count them and read the reasons. A void minutes after a cash sale deserves a question.
- Refunds. Match each to an original sale and, where a part came back, to stock going back in.
- Discounts. Total discount dollars by person. Compare to last week.
- Stock adjustments. Every manual change to a count, and whether it followed a count or came out of nowhere.
- User and permission changes. Any new login, any role change, any login for someone who has left.
Look for patterns, not incidents. One void is a mistake. One person with most of the week's voids is a conversation, and it may be a training conversation. Actions clustered after closing time, a refund issued and approved by the same login, or adjustments that always reduce the same expensive part are the signals worth following.
Write down what you found, even if it is one line saying nothing unusual. Over a few months that notebook becomes your baseline for what normal looks like.
When the numbers do not tie
Sooner or later sales, cash and stock will disagree. Work through it in a fixed order and resist the urge to guess.
First, define the gap. Which number is off, by how much, over what period? "We seem short" is not a starting point. "Cash counted was $180 under the shift total on Thursday" is.
Second, check timing. Deposits in transit, payments made late in the day, a sale rung up Friday for work done Thursday. A good share of gaps are timing.
Third, read the log for that period. Voids, refunds and adjustments in the window. Does one of them equal the gap?
Fourth, recount the physical thing. Cash, or the specific parts. If stock is the issue, the method is in inventory shrinkage and stock counts. Tools that never pass through a sale need their own register, described in tracking tools and equipment.
Fifth, ask, without accusing. "Help me understand this void on Thursday" gets a better answer than a meeting about theft.
Sixth, fix the gap in the process. If the cause was an error, change the step that allowed it. If you cannot find the cause, tighten the permission involved and shorten the review interval until the gaps stop.
If the amount is large or the pattern points at one person, stop investigating on your own and talk to your accountant and an attorney before you say anything to anyone. General guidance on small-business financial management is available from the SBA.
Where IntelliDrive OS fits
IntelliDrive OS has 32 role permissions and custom roles, an audit log, and optional two-factor sign-in with a second check, a step-up, for voids, refunds and stock changes. Staff see only their own shop's sales. Each shop has registers and shifts with a register close, and stock counts show shrinkage in dollars with an audit of past counts. The details are on the security and roles page. The plan is $79/month flat for the whole business with unlimited users, so every person can have their own login at no extra cost.
What it does not do matters as much. It does not enforce a technician discount ceiling or an approval step for discounts; the discount amount is recorded on each line and the limit stays a matter of policy. Two-factor sign-in is optional, so the second check only applies once you switch it on. This guide does not list the 32 permissions individually, so go through them in the trial and map each of your roles before you invite staff. And IntelliDrive OS makes no certification claims: there is no SOC 2 report, no PCI attestation and no uptime guarantee, and nothing here should be read as a promise that losses will be prevented. The tools make actions attributable and reviewable. The review is yours.
Rolling it out without a mutiny
Announce it as a system change, not a response to an incident. "Everyone gets their own login and we are setting roles by job" lands differently from "someone has been voiding sales."
Move in three steps over about a month. First, individual logins for everyone, with no restrictions changed, so the log starts recording names. Second, roles applied, with a clear path for requesting a void or refund so nobody is stuck in front of a customer. Third, the weekly review on the calendar and the second check switched on for the sensitive actions.
Tell the crew what you review and why. People behave differently when they know a void will be read by Friday, and the honest majority are usually relieved.
The bottom line
Good controls in a small shop are four things: one login per person, a short list of restricted actions, two people involved in anything that removes money or stock, and a scheduled review of the log. None of it requires distrust. It requires deciding who can do what, writing it down and looking at the record every week.
Related reading: Who gets to discount, The end-of-day close, and Refunds, returns and voids. For a complete machine-readable feature and pricing reference, see our LLM reference page.