How to Set Up a Financial Control System in a Hotel: Revenue Control, Cash, Fraud, and Internal Control

Imagine we are looking at a hotel's monthly report.

According to the PMS,

10 million TL of Revenue

was generated.

The accounting records

show about the same figure.

At first glance,

everything looks fine.

But

this information alone

answers none of the following questions:

• Were all the services sold really entered into the system?
• Was the right price applied?
• Were the discounts given authorized?
• Were the complimentary transactions genuine?
• Why were cancelled transactions cancelled?
• Was all cash collected fully deposited in the bank?
• Did all POS collections reach the bank?
• Were OTA receivables collected correctly?
• Were refund transactions genuine?
• Did supplier payments really relate to goods and services received?
• Can the same person make a transaction, approve it, and also check it?
• If fraud occurs, can the system detect it?

This is exactly what

Financial Control

is the systematic answer to.

Because:

It isn't enough for a hotel to generate revenue; you have to be sure that the revenue it generates is fully collected, correctly recorded, and that the business's assets are protected.

1. What Is Financial Control?

Financial control

is not just

accounting control.

In a broader sense,

it is the control system

that ensures the hotel's economic processes such as

• Revenue,
• cash,
• bank,
• POS,
• receivables,
• payments,
• purchasing,
• inventory,
• payroll,
• discounts,
• refunds,
• complimentary transactions,
• financial records

operate within defined rules.

The aim

is not merely

to find errors.

The aim

is to build a system that makes errors and misuse harder to occur, and ensures they are noticed early when they do.

2. What Is Internal Control?

Internal Control

is the whole of the

policies,

procedures,

authorities,

controls

and:

verification mechanisms

a business creates to

protect its assets,

improve the accuracy of financial information,

prevent unauthorized transactions,

and reduce the risk of error and fraud.

Put simply:

Good internal control means the business doesn't merely trust its employees; it can verify the system.

3. Trust + Verify

In hotel management,

trust

is necessary.

But

a financial system

should not be built on trust alone.

The right approach

should be

Trust + Verify,

that is,

Trust + Verification

Because

a control system

is not distrust of the employee.

On the contrary,

it is the institutional mechanism

that protects both

the employee

and

the business.

4. The Four Core Purposes of Internal Control

A good financial control system

should produce four core outcomes.

1. Prevention

Making errors or fraud

harder to occur.

2. Detection

Detecting an error that has occurred

early.

3. Correction

Correcting

the problem.

4. Learning

Preventing

the same problem

from recurring.

Therefore

control

is not just the question

“Who made the mistake?”

The real question

should be:

“How did the system allow this mistake to happen?”

5. Preventive Control

Preventive Control

tries to stop the problem

before it occurs.

For example:

• discount authority limit,
• refund approval,
• system access restriction,
• purchase approval,
• dual approval,
• user-specific login,
• cash limit,
• approved supplier list.

These are examples of

Preventive Control.

6. Detective Control

Detective Control

tries to find

an error

or anomaly that has already occurred.

For example:

• daily reconciliation,
• exception report,
• void report,
• discount report,
• cash count,
• bank reconciliation,
• inventory variance,
• audit log review.

These are examples of

Detective Control.

7. Corrective Control

The problem

has been detected.

What happens next?

For example,

a wrong price was applied.

Just

correcting the transaction

is not enough.

These questions

must also be answered:

• why did it happen?
• was it a system setting?
• a training problem?
• an authority problem?
• is the SOP missing?
• was it deliberate?
• how do we prevent it recurring?

This is the

Corrective Control

layer.

8. The Basic Cycle of a Financial Control System

A good system

works like this:

Transaction → Authorization → Recording → Collection / Payment → Reconciliation → Verification → Exception → Investigation → Root Cause → Corrective Action → Verification → Management Reporting

If one link in this chain

is missing,

the control system

weakens.

9. What Is Revenue Control?

Revenue Control

is the system that controls

whether the revenue the hotel generates

is recorded and collected

correctly,

completely

and:

with authorization.

The core question:

“Has all the Revenue the hotel economically earned really been converted into the system and into collection?”

This

is not only

accounting's job.

Front Office,

Reservations,

F&B,

Finance,

Night Audit

and:

Management

are together

part of the Revenue Control system.

10. What Is Revenue Leakage?

Revenue Leakage

is when part of the revenue

the hotel has earned

doesn't reach the business

or:

isn't recorded correctly.

For example:

• a service not entered into the system,
• a wrong rate,
• an unauthorized discount,
• a wrong complimentary,
• an unnecessary refund,
• a wrong cancellation,
• a POS error,
• an OTA reconciliation problem,
• minibar not charged,
• transfer revenue not recorded.

Each of these

can create

Revenue Leakage.

11. Revenue Leakage Is Not Always Fraud

This

is an important distinction.

Revenue loss

can occur because of:

Human Error

A wrong transaction.

Process Failure

A missing procedure.

System Error

An integration or software problem.

Training Gap

Staff not knowing the process.

Control Failure

A control not working.

Fraud

Deliberate misuse.

Therefore

not every variance

should be treated as

fraud.

But

every variance

should be

investigated.

12. Where Does Revenue Control Start?

Revenue Control

doesn't start

when the guest pays.

It starts earlier.

For example,

in a room sale

there is the chain of

Reservation → Rate → Discount → Stay → Posting → Check-Out → Payment → Settlement → Bank → Accounting → Reconciliation

At every stage,

Revenue Leakage

can occur.

13. Revenue Control with Reservations

When a reservation is created,

the following

must be correct:

• guest,
• dates,
• room type,
• rate plan,
• source,
• channel,
• discount,
• payment condition,
• tax structure,
• package.

Because

wrong reservation data

can corrupt the entire subsequent financial process.

14. Rate Control

What price

was applied to the guest?

Is the Rate

consistent with the

approved rate plan?

Was a manual change made?

Who made it?

Why?

Did they have authority?

In a good PMS setup,

rate override

transactions

should be traceable.

15. Discount Control

A discount

is a normal commercial tool.

But

uncontrolled discounting

can create

Revenue Leakage.

Therefore

a Discount Policy

can define:

Front Office

Up to a certain limit.

Supervisor

A higher limit.

GM

Higher authority.

Owner

Exceptional cases.

Here,

the aim

is not to ban discounts.

The aim

is to make the discount decision visible and accountable.

16. Discount Report

Management

can regularly see

the following:

The last row

could be an

Exception.

17. Complimentary Control

Complimentary

is a room,

meal,

drink

or:

service given free.

Sometimes

it is entirely legitimate.

For example:

• guest recovery,
• influencer agreement,
• business partner,
• staff meal,
• owner guest,
• promotional package.

But

every complimentary

should carry

Reason + Authorization + Record.

18. Complimentary ≠ Free

The guest

may not be paying.

But

the hotel

bears a cost.

For example,

a complimentary room

can create the cost of

• housekeeping,
• laundry,
• amenities,
• utilities,
• breakfast.

More importantly,

in high-demand periods

it can occupy a room

that could have been sold.

So

a complimentary

is an economic decision.

19. Void Control

A transaction

was entered at the POS.

Then

a Void.

Why?

Wrong item?

Wrong table?

Did the guest change their mind?

Staff error?

Or was it

an attempt to delete an already-collected transaction

from the system afterwards?

Therefore

the Void Report

is an important control tool,

especially

in F&B operations.

20. The Pattern Matters More Than the Void Count

A single void

can be normal.

But if the same staff member

makes

many voids

every night,

this

may be an

Exception.

For example:

C's

transactions

should be reviewed.

This

does not automatically

mean

fraud.

But

it is a control signal.

21. Refund Control

A refund

is one of the high-risk transactions.

Because

it creates

a cash outflow

from the business.

Every refund

can at least be linked to:

• original transaction,
• guest,
• reason,
• amount,
• date,
• approving person,
• payment method,
• refund evidence.

22. Should One Person Process a Refund Alone?

As far as possible,

no.

Especially

for high-value

refund

transactions,

Maker-Checker

logic

can be applied.

Maker

Prepares the transaction.

Checker / Approver

Reviews and approves.

This

is part of the logic of

Segregation of Duties.

23. What Is Segregation of Duties?

It is one of the most important principles

in financial control.

In plain terms:

Separation of Duties.

The basic idea

is that the whole of a critical financial process

should not be under one person's control.

For example,

if the same person

• creates the supplier,
• makes the purchase,
• enters the invoice,
• prepares the payment,
• approves the payment

the risk

is very high.

24. Four Critical Functions

As far as possible,

the following

should be separated:

Authorization

Who approves?

Custody

Who holds the money or asset?

Recording

Who records?

Reconciliation

Who checks?

One person

doing all four

creates high risk.

25. How Is Segregation Done in a Small Boutique Hotel?

In a small hotel,

the number of staff

is limited.

Full segregation of duties

may not be possible.

In this case,

Compensating Controls

are set up.

For example:

Front Office

takes the cash.

Accounting

records it.

The GM

reviews the daily cash report.

The Owner

weekly

checks the bank deposit

and:

the exception report.

That is,

two people

don't have to do the same job.

But

there must be

independent verification.

26. Cash Control

Cash

is a high-risk

asset.

Because

it is easily portable

and:

can disappear without a trace.

Therefore

cash handling

should be tied

to a written procedure.

27. Cash Float

At the reception or restaurant till,

there may be a certain

opening float.

For example:

10,000 TL.

At the start of the shift:

10,000 TL.

At the end of the shift,

the expected amount

should be:

Opening Float + Cash Sales − Approved Cash Payments

The actual till

should reconcile

with this figure.

28. Cash Over / Short

For example:

Expected Cash:

35,000 TL.

Actual Cash:

34,750 TL.

Variance:

-250 TL

This is

a Cash Shortage.

The reverse:

Cash Over.

In both cases,

the variance

must be recorded.

Because

excess money too

is a control problem.

29. Don't Say “250 TL Is a Small Amount”

A single

250 TL difference

may look insignificant.

But if the same staff member

has a small cash shortage

every week,

the pattern

matters.

Internal Control

examines not only the amount

but also the dimensions of

frequency + pattern + person + shift.

30. Surprise Cash Count

The till

doesn't have to be checked

only at the end of the shift.

At certain intervals,

unannounced,

a

Surprise Cash Count

can be done.

This

provides both

control discipline

and:

deterrence.

31. Cash Drop

When the till rises above a certain amount,

the excess cash

can be moved

to a safe

or to a designated secure area.

The aim

is not to hold

unnecessarily high cash

in the till.

32. Cash Deposit Control

When was the cash collected

deposited at the bank?

Is the amount

the same as the till report?

Is there a deposit slip?

Does it match

the bank statement?

The control chain

should be completed as:

Cash Collection → Cash Count → Cash Report → Safe → Bank Deposit → Bank Statement → Reconciliation

33. POS Control

Card collection

looks safer

than cash.

But

that doesn't mean

it needs no control.

The PMS or POS

shows 100,000 TL

of card revenue.

The POS terminal:

99,500 TL.

What reached the bank:

98,000 TL.

Why?

This is exactly

the question reconciliation

answers.

34. POS Reconciliation

At least three sources

can be compared:

System

PMS / POS.

Payment Processor

POS settlement.

Bank

The actual bank movement.

The aim

is for the chain of

System → POS → Bank

to match.

35. Why Can POS Differences Arise?

• wrong payment method,
• failed transaction,
• duplicate charge,
• refund,
• commission,
• settlement timing,
• chargeback,
• manual entry error.

Not every difference

is fraud.

But

it must be explained.

36. Bank Reconciliation

The bank balance

in the accounting records

is compared with

the actual

bank statement.

Differences

can arise, for example, because of

• outstanding payments,
• bank fees,
• deposits in transit,
• timing differences,
• incorrect posting,
• unknown transactions.

Bank Reconciliation

is one of the basic financial controls.

37. Unknown Transaction

If there is an

unidentified movement

in the bank,

“We'll look at it later.”

should not be said.

The Unknown Transaction

should be taken into the exception list.

An Owner

should be assigned.

A Deadline

should be set.

It should stay open

until explained.

38. OTA Revenue Control

If the hotel

sells through Booking,

Expedia

and similar channels,

OTA reconciliation

is a separate control area.

The control

is not just

the number of reservations.

The following

should be matched:

• reservation,
• room rate,
• commission,
• cancellation,
• no-show,
• virtual card,
• payment,
• invoice,
• bank settlement.

39. OTA Revenue Leakage

For example:

the guest's

stay completed.

The PMS

recorded the Revenue.

But

the OTA virtual card

wasn't charged in time.

Result:

there is Revenue

in the P&L.

There is no

cash.

This is

a very good example of the

Revenue ≠ Cash

distinction.

40. Accounts Receivable Control

If you work with corporate accounts,

agencies,

groups

or:

credit customers,

Accounts Receivable

must be controlled.

Core questions:

Whom did we invoice?

When?

What is the due date?

Was it collected?

How many days has it been open?

Who is following it up?

41. Aging Report

Receivables

can be classified,

for example,

as follows:

90+ days

in particular

should come to management's attention.

42. Generating Revenue Is Not the Same as Collecting It

The Sales team

may have brought in

1 M TL of corporate business.

But if

it isn't collected for 6 months,

working capital

comes under strain.

Therefore

commercial performance

should be evaluated not only by Revenue

but also by

Collection Quality.

43. Accounts Payable Control

Supplier payments

are another

high-risk area.

The core control:

Are we paying for goods or services we actually received?

This question

needs to be verified

with documents.

44. Three-Way Match

A very strong control in purchasing

is the logic of

Three-Way Match.

Three documents

are compared:

Purchase Order

What did we order?

Goods Received / Service Confirmation

What did we receive?

Supplier Invoice

What were we invoiced for?

If all three

are consistent,

the payment

is approved.

45. The Purchase-to-Pay Control Chain

Purchase Request → Approval → Purchase Order → Supplier → Goods Receipt → Invoice → Three-Way Match → Payment Approval → Bank Payment → Accounting → Reconciliation

This chain

significantly reduces

the risk of supplier fraud

and:

wrong payments.

46. Supplier Master Control

Who can add

a new supplier

to the system?

Who can change

a bank account?

Who

approves the change?

Changes to supplier bank accounts

are especially

high-risk

control points.

47. Duplicate Invoice

The same invoice

can be paid

twice.

Especially

in manual processes,

this risk

is high.

Controls

can run

duplicate detection

on

• invoice number,
• supplier,
• amount,
• date,
• purchase order.

48. Payment Approval Matrix

Not every payment

has to be at the same authority level.

For example:

0–25,000 TL

Department Manager.

25,000–100,000 TL

GM.

Over 100,000 TL

Owner / Board.

The figures

are examples.

Each hotel

should set limits

according to its own

risk,

size

and:

organization.

49. Exceeding the Limit by Splitting Approvals

For example,

the approval limit:

100,000 TL.

A payment of

180,000 TL

was split into two

90,000 TL

transactions.

This

may be

control circumvention.

Therefore

the system

should be able to examine not only

the transaction amount

but also

supplier + date + purpose

patterns.

50. Payroll Control

Payroll

is one of the large expense items

in hotel businesses.

Control

can cover:

• active employee list,
• salary,
• attendance,
• overtime,
• bonus,
• leave,
• bank account,
• termination,
• payroll approval.

The aim

is to ensure the correct amount

is paid

for real employees.

51. Ghost Employee Risk

Especially

in weak systems,

having staff in the system

who don't actually work

can create a fraud risk.

Control

can include reconciliation between

the HR employee master

and:

Payroll

and:

Bank Payment.

52. Overtime Control

Overtime

is not only

a Labour Cost problem.

It is also

a financial control

area.

Questions:

• who did it?
• why?
• who approved?
• is it consistent with attendance?
• is it always the same people?
• is it over Budget?

Overtime

requires

Approval + Evidence + Analysis.

53. Inventory Control

The hotel's

stocks of, in particular,

• F&B,
• minibar,
• housekeeping supplies,
• amenities,
• beverages,
• cleaning products

are

financial assets.

Therefore

inventory

is not only

an operations topic.

54. Inventory Reconciliation

A simple equation:

Opening Inventory + Purchases − Expected Consumption = Expected Closing Inventory

It is compared with

the actual Closing Inventory.

The difference

creates an

Inventory Variance.

55. Why Does Inventory Variance Occur?

• waste,
• spoilage,
• wrong portion,
• recording error,
• transfer error,
• complimentary,
• breakage,
• theft.

So

a variance

is not just

an accounting difference.

It is an operational signal.

56. Theoretical vs Actual Consumption

Especially

in F&B,

theoretical consumption

can be calculated

from the products sold.

For example:

100 cocktails were sold.

Each cocktail

uses 50 ml of a particular spirit.

Theoretical consumption:

5 litres.

Actual consumption:

7 litres.

The 2-litre difference

should be investigated.

57. What Is Fraud?

Fraud

is the deliberate manipulation

of a business's

assets,

revenue

or:

financial information

for personal gain

or another purpose.

But

the aim of fraud control

is not to suspect everyone.

The aim

is to reduce fraud opportunity.

58. The Fraud Triangle

To understand fraud risk,

the commonly used

Fraud Triangle

approach

looks at three elements:

Pressure

The person's pressure or motivation.

Opportunity

The system allowing misuse.

Rationalization

The person justifying the behaviour to themselves.

Hotel management

cannot fully control the first and third factors.

But it can build

very strong control over

Opportunity.

59. How Is Fraud Opportunity Reduced?

• Segregation of Duties
• Approval Limits
• System Access Control
• Audit Trail
• Reconciliation
• Exception Reporting
• Surprise Checks
• Mandatory Documentation
• Rotation
• Independent Review

can be used

to reduce fraud opportunity.

60. Fraud Red Flags

A single Red Flag

is not proof of fraud.

But

it may call for

investigation.

For example:

• consistently high voids,
• unusual discounts,
• too many refunds,
• a cash shortage pattern,
• duplicate payments,
• supplier bank changes,
• unexplained inventory variance,
• unusual overtime,
• off-hours transactions,
• user sharing.

These

are signals of anomaly.

61. Why Is User Sharing Risky?

If everyone

at Front Office works

with the same

PMS username,

when a transaction is made

it can't be known

who did it.

In this case,

the Audit Trail

loses its value.

Therefore

in critical systems

the principle of

One User = One Identity

should be applied.

62. Access Control

Should every employee

be able to do everything

in the system?

No.

Front Office

can create

reservations.

But

should not change

supplier bank accounts.

The Restaurant

can make

POS transactions.

But

should not see

payroll.

This is the principle of

Least Privilege.

63. Least Privilege

A user is given

the minimum authority

needed to do their job.

Neither too little

nor too much.

This reduces the risk of both

fraud

and

accidental error.

64. Access Must Be Removed Immediately from Departing Staff

An employee

has left.

But

their PMS,

POS,

banking,

accounting,

email

access

is still open.

This

creates high risk.

Therefore

offboarding

is not just

an HR process.

It is also

an Internal Control process.

65. Audit Trail

Good systems

should be able to show:

Who?

What did they do?

When?

What was the previous value?

What is the new value?

For example:

Room Rate:

6,000 TL.

Time:

21:14.

User:

X.

New Rate:

4,500 TL.

Reason:

Manager Discount.

This is

an Audit Trail.

66. If There Is an Audit Trail, Is There Control?

No.

An Audit Trail

only

produces

data.

If no one

reviews it,

it isn't control.

Therefore

Data + Review + Exception + Action = Control

is what it should be.

67. Exception-Based Control

Reviewing thousands of

normal transactions

one by one

is inefficient.

A stronger approach

can be

Exception Management.

For example,

the system

can flag:

• >20% discount,
• high refund,
• repeated void,
• cash variance,
• duplicate invoice,
• unusual supplier,
• late bank deposit,
• rate override,
• negative inventory.

The manager

focuses

on exceptions first.

68. Exception Threshold

Not every small difference

should go to the GM.

Otherwise,

control fatigue

results.

Therefore

a threshold

can be set.

For example:

Green

Normal.

Yellow

Review.

Red

Immediate Investigation.

This

lets management

focus on critical matters.

69. Daily Revenue Reconciliation

Daily,

the following

can be compared:

PMS Revenue

POS Revenue

Cash

Card

OTA / City Ledger

Discounts

Refunds

Voids

Complimentary

Adjustments

The aim

is to close out

the day's financial story.

70. The Role of Night Audit in Financial Control

Night Audit

is not just

a day-closing

procedure.

It is also

an important

Revenue Control

layer.

Night Audit

can provide control in areas such as

• room charges,
• payment methods,
• open folios,
• rate exceptions,
• no-shows,
• adjustments,
• postings.

But

Night Audit

should not be

the only control.

71. Daily Revenue Report

The GM or Finance

can see

a short

Daily Revenue Report

each morning.

For example:

But

the figures

alone

are not enough.

72. Daily Exception Report

The same report

can also show:

Unusual Discount

Room 205 — 35%.

High Refund

25,000 TL.

Cash Variance

-500 TL.

Rate Override

3 transactions.

Unsettled Folio

2 items.

POS Difference

1,250 TL.

This

shows the manager

where to look

in the morning.

73. Weekly Financial Control

In weekly control,

the patterns

in daily transactions

can be examined.

For example:

• cash over/short,
• discounts,
• refunds,
• voids,
• outstanding receivables,
• overdue supplier invoices,
• inventory variance,
• payroll exceptions,
• bank reconciliation status.

The aim

is to move from single events

to trends.

74. Monthly Financial Control

At the monthly close,

broader

control is carried out.

For example:

• Bank Reconciliation
• AR Reconciliation
• AP Reconciliation
• Inventory Reconciliation
• Payroll Reconciliation
• Revenue Reconciliation
• Tax / accounting checks
• Accruals
• Prepayments
• Fixed assets
• CAPEX
• Budget vs Actual

This

is part of the

Month-End Closing

system.

75. What Is Reconciliation?

Reconciliation

is checking whether two independent data sources

show the same economic reality.

For example:

PMS

100,000 TL card payment.

POS

100,000 TL.

Bank

100,000 TL settlement.

If all three

match,

the control

is strengthened.

76. The Strength of Reconciliation Comes from an Independent Source

Comparing two cells

in the same Excel file

is not

real reconciliation.

Wherever possible,

a different

independent source

should be used.

For example:

PMS

vs

bank statement.

POS

vs

accounting.

Inventory system

vs

physical count.

77. Physical Verification

Some controls

can't be done

through the system alone.

For example,

the system

shows 100 bottles

of wine.

Physical Count:

82.

Therefore,

for certain assets,

Physical Verification

is necessary.

78. Dual Authorization for Bank Payments

Especially

for high-value

bank payments,

dual authorization

can be used.

One person

prepares the

payment.

Another person

approves it

at the bank.

This is

a very strong

fraud prevention

mechanism.

79. Payment Batch Review

Approving payments

one by one

may not be enough.

A Payment Batch

can be reviewed

as a whole.

For example:

• supplier,
• invoice,
• amount,
• due date,
• bank account,
• approval,
• supporting document.

In particular,

a new supplier

and:

a bank account change

can be flagged.

80. The Owner Is Not Immune to Fraud Risk

Internal Control

is not only

for employees.

If the Owner

uses the company till

for personal expenses,

financial reporting

is distorted.

The business

cannot see

its real performance.

Therefore

Owner Withdrawal

and:

business expense

must be kept separate.

81. Related-Party Transactions

Goods or services

may be bought for the hotel

from the Owner's

other company.

This

is not prohibited.

But

the transaction

must be visible.

Is the price

reasonable?

Is there

approval?

Is there

a Conflict of Interest?

Such transactions

especially require

transparency.

82. A Fraud Prevention Culture

The best control system

is not only

SOPs

and software.

Culture

matters too.

Staff

should know that:

• transactions are on record,
• authorities are clear,
• exceptions are reviewed,
• reporting a problem is safe,
• the rules apply to everyone.

This

creates

deterrence.

83. Speak-Up / Whistleblowing

An employee

should be able to report

a suspicious situation

safely.

Especially

when the complaint

concerns the manager directly,

there should be an alternative

reporting channel.

Even in a small hotel,

a confidential escalation

mechanism

directly to the GM

or the owner

can be defined.

84. A Fraud Report Is Not Proof of Fraud

Not every report

will be correct.

Therefore

the system

should work like this:

Report → Confidential Review → Evidence → Investigation → Finding → Action

People

should not be accused

without evidence.

85. Control Owner

Every critical control

should have

an owner.

For example:

If a control

has no owner,

it often

doesn't get done.

86. Control Frequency

Not every control

should be done at the same frequency.

Daily

Revenue, cash, POS, exceptions.

Weekly

AR, discount trends, voids, refunds.

Monthly

Bank, inventory, payroll, AP, balance sheet.

Quarterly

Access review, supplier master, policy review.

Annual

Full Internal Control Review.

This

can be adapted to the risk level.

87. Control Evidence

“I checked it.”

is not enough.

The control

should have

evidence.

For example:

• signed checklist,
• system approval,
• reconciliation report,
• digital log,
• exception resolution,
• review date.

Because:

If a control was done, it should leave a trace.

88. Control without Evidence

A problem

surfaced

6 months later.

The GM says:

“I was checking every month.”

But

which month?

Which report?

Which exception?

Which action?

It isn't clear.

In this case,

the system

isn't institutional;

it is person-dependent.

89. Control Register

A hotel

can keep a simple

Control Register.

This

is the map

of the Internal Control system.

90. Risk-Control Matrix

In a more advanced system,

each financial risk

can be matched

with the control

against it.

For example:

This

can be called a

Risk-Control Matrix

approach.

91. Key Control

Not every control

is of equal importance.

Some

can be designated as

Key Controls.

For example:

• bank payment approval,
• daily revenue reconciliation,
• bank reconciliation,
• payroll approval,
• inventory reconciliation,
• system access control.

If these controls

don't work,

financial risk

rises significantly.

92. Key Control Failure

For example:

Bank Reconciliation

hasn't been done

for 3 months.

This is not

just an overdue task.

It should be reported

as a

Control Failure.

Because

in a 3-month period,

an unknown transaction

or:

error

may have gone undetected.

93. Control Effectiveness

The control

exists.

But

does it work?

For example,

a Refund Approval Policy

exists.

But

the GM

approves every refund

without reviewing.

On paper

the control exists.

In reality,

it is ineffective.

Therefore

Control Design

and:

Control Effectiveness

should be separated.

94. Design Effectiveness

Is the control

designed correctly?

For example:

payment over 100,000 TL:

dual approval.

Risk:

high-value payment fraud.

Control:

sensible.

Design:

may be good.

95. Operating Effectiveness

But

is it actually

applied?

Are payments

being split

to stay under the limit?

Does the second approver

approve without looking at the document?

Is a shared banking user used?

In this case,

the control

is designed;

but

may not be working.

96. Internal Audit

In larger

hotels

or hotel groups,

Internal Audit

can review the control system

independently.

In a small boutique hotel,

a separate

Internal Audit Department

may not be necessary.

But

periodic

owner review,

external accountant review

or:

independent control review

can be done.

97. Surprise Audit

Some controls

can be done

without advance notice.

For example:

• cash count,
• inventory count,
• petty cash,
• minibar stock,
• selected invoice review.

The aim

is not to catch staff.

The aim is to prevent controls

from working only

on “audit day.”

98. Petty Cash

For small expenses,

Petty Cash

can be used.

But

a small amount

doesn't mean

lack of control.

Every transaction

should be recorded with

• receipt,
• purpose,
• date,
• person,
• approval.

99. Petty Cash Replenishment

Starting amount:

10,000 TL.

At period end,

cash:

3,000 TL.

Approved receipts:

7,000 TL.

Total:

10,000 TL.

Reconciliation:

complete.

Then

7,000 TL

replenishment

is made.

This is the logic of the

Imprest System.

100. What the Owner Should Check Is Not Every Invoice

If the Owner

tries to check

every

250 TL expense

one by one,

the system

becomes

owner-dependent.

A better approach:

the owner

looks at:

• exceptions,
• large payments,
• unusual transactions,
• cash variances,
• bank balance,
• overdue receivables,
• fraud indicators,
• control failures.

That is,

the owner

should be not a

transaction checker

but a

control system overseer.

101. Owner Dashboard

The owner's

financial control dashboard

could include, for example:

Revenue

Actual vs PMS vs Accounting.

Cash

Cash Variance.

Bank

Reconciliation Status.

Receivables

Overdue AR.

Payments

Large / Unusual Payments.

Discounts

Exceptional Discounts.

Refunds

High Refunds.

Inventory

Major Variance.

Controls

Overdue Key Controls.

Fraud

Open Investigations.

This

lets the owner

see risk

without drowning in detail.

102. GM Dashboard

The GM

can see more operational

controls.

For example:

• Daily Revenue
• Cash Over/Short
• POS Difference
• Discount %
• Complimentary
• Void Count
• Refund
• Open Folio
• AR Aging
• Inventory Variance
• Overtime Exception
• Pending Approval

This way,

financial control

is integrated

into daily management.

103. Financial Control KPIs

A sample KPI set:

Cash Variance Rate

Cash Difference / Cash Transactions.

Refund Rate

Refund / Revenue.

Discount Rate

Discount / Gross Revenue.

Void Rate

Void Transactions / Total Transactions.

AR Overdue %

Overdue Receivables / Total Receivables.

Inventory Variance %

Actual vs Expected Inventory.

Bank Reconciliation Completion

Completed / Planned.

Key Control Completion %

Completed Key Controls / Planned Key Controls.

Exception Closure Time

How long it takes

an exception to close.

104. Define the KPI Before Turning It into a Target

For example:

“Refund Rate should be below 1%.”

Why?

Not every hotel

is the same.

Resort,

city hotel,

luxury,

boutique,

all-inclusive

can behave differently.

So

first

a baseline

should be built.

Then

based on trend,

budget,

risk tolerance

and:

business model,

a threshold

should be set.

105. Exception Closure Rate

Detecting an exception

is not success.

It has to be closed.

For example:

20 exceptions.

15 resolved.

5 open.

Closure Rate:

75%

But

more important

is the risk of the

5 open exceptions.

A

100 TL difference

and a

1 M TL payment anomaly

are not the same.

106. Risk-Based Prioritization

Exceptions

can be prioritized

by:

Financial Impact

How much money?

Probability

Likelihood of recurrence?

Fraud Risk

Likelihood of intent?

Guest Impact

Does it affect the guest?

Regulatory Impact

Is there legal risk?

Control Failure

Is it systemic?

This

lets management

intervene

on the right problem first.

107. Root Cause Analysis

A cash variance

occurs

every day.

Just

collecting the difference from the staff

may not solve the problem.

The Root Cause

could be:

• shift handover?
• POS integration?
• cash training?
• shared cash drawer?
• change process?
• system posting?
• theft?

If the problem

is systemic,

the system

must be fixed.

108. When Fraud Is Found, Removing the Person Isn't Enough

Fraud

has occurred.

The staff member

has left.

Is the matter closed?

No.

The real question:

“How was this person able to do this?”

For example:

• shared password,
• no approval,
• no reconciliation,
• no audit trail,
• no exception report.

If these

aren't fixed,

the same fraud

can be repeated

by someone else.

109. Incident → Root Cause → CAPA

Financial control

can be linked

with the quality system.

Incident → Investigation → Root Cause → Corrective Action → Preventive Action → Verification → Closure

This is

the CAPA

logic.

This way,

financial control

turns into

a continuous improvement system.

110. A Bigger Risk Than the Fraud Loss

50,000 TL

may have been lost

to fraud.

But

the bigger problem

is that the same control weakness

may exist elsewhere too.

Therefore,

a fraud case

should be seen not just as

a single transaction

but as a

system weakness indicator.

111. Small Errors Can Reveal Big Control Weaknesses

For example:

a 500 TL

cash difference.

The amount

is small.

But

when investigated,

it turned out

the same user

could modify a cash transaction

and approve their own transaction.

Now

500 TL

is not insignificant.

Because

there is

a much bigger

fraud opportunity

in the system.

112. Control Has a Cost Too

If every transaction

needed approval from 5 people,

the business

couldn't operate.

Therefore

Internal Control

is not maximum bureaucracy.

The aim

is to strike the right balance between Risk and Control Cost.

113. Risk-Based Internal Control

High risk:

strong control.

Low risk:

lighter control.

For example,

a 1,000 TL

office supply

and

a 1,000,000 TL

CAPEX payment

may not require

the same

approval process.

This is

the risk-based control

approach.

114. Control Fatigue

If too many

unnecessary controls

are created,

staff

start doing the controls

as a formality.

Result:

the genuinely critical controls

lose value.

Therefore

the

Key Controls

in particular

should be defined clearly.

115. Automation

Wherever possible,

controls

can be automated.

For example:

• rate override alert,
• high discount alert,
• duplicate invoice detection,
• overdue AR alert,
• user access log,
• inventory variance,
• bank feed reconciliation.

Automation

can speed up control.

But

it doesn't fully remove

human judgment.

116. AI and Anomaly Detection

In more advanced systems,

AI

can learn normal transaction behaviour

and flag

abnormal patterns.

For example,

a certain user

is making

far more refunds

than normal.

A certain supplier

shows an unusual

payment pattern.

On a certain shift,

cash shortages

are rising.

But

AI

should not pass

a verdict of fraud.

AI

should produce an

investigation signal.

117. The Link Between Internal Control and Human Resources

Financial Control

is not independent of HR.

For example,

• background verification,
• clear job descriptions,
• authority matrix,
• training,
• performance management,
• leave,
• job rotation,
• offboarding

affect the control system.

Therefore

financial control

is part of

organization design.

118. Mandatory Leave

In certain critical financial roles,

requiring the employee

to take leave for a set period

can be useful

from a control perspective.

Because

if one person

keeps checking their own process,

some anomalies

can stay hidden.

Another person

taking over the duty

can surface

exceptions.

119. Job Rotation

Similarly,

in critical positions,

suitable

Job Rotation

can reduce

key-person dependency

and:

control risk.

But

rotation

does not fully substitute

for segregation of duties.

120. The Link Between Internal Control and the Budget

The Budget

is not only

a plan.

It can also be

a control baseline.

For example:

Housekeeping Supplies:

Budget:

100 K.

Actual:

160 K.

Variance:

+60%.

This

is not automatically

fraud.

But

it may be an

exception

requiring investigation.

121. Budget Variance = Control Signal

The same logic

can be used for

• payroll,
• overtime,
• utilities,
• food cost,
• maintenance,
• marketing,
• procurement.

The Budget

is one of the

important benchmarks of financial control.

122. Forecast and Internal Control

The Forecast

shows what we expect

in the future.

If Actual

deviates significantly

from the Forecast,

the reason is investigated.

This

is not always

fraud.

But

management

can see unexpected financial movements

earlier.

123. Daily → Weekly → Monthly Control Architecture

A good system

can work

on three layers.

Daily

Transaction integrity.

Weekly

Pattern and exception.

Monthly

Financial completeness and reconciliation.

This way,

control

stops being merely

a month-end accounting task.

124. Daily Control

For example:

• Revenue
• Cash
• POS
• Refund
• Void
• Discount
• Complimentary
• Open Folio
• Rate Override

are checked.

125. Weekly Control

For example:

• Cash Variance Trend
• Refund Trend
• Discount Trend
• AR Aging
• Supplier Payment
• Overtime
• Inventory Exception
• Control Failure

are reviewed.

126. Monthly Control

For example:

• Bank Reconciliation
• AR/AP Reconciliation
• Payroll
• Inventory
• Revenue Reconciliation
• Balance Sheet
• CAPEX
• Budget Variance
• Control Register
• Open Investigation

are reviewed.

127. Internal Control Meeting

Once a month,

a short

Financial Control Meeting

can be held.

Participants:

• GM,
• Finance,
• Operations,
• department managers where needed.

Agenda:

Open Exceptions

High-Risk Transactions

Reconciliation Status

Control Failures

Fraud / Incident

Corrective Actions

Overdue Actions

New Risks

This

turns control

into a living management system.

128. Decision Log

Important

financial control

decisions

can be written into a Decision Log.

For example:

Restaurant Void Rate has risen.

Decision:

Supervisor approval mandatory.

Owner:

F&B Manager.

Deadline:

15 days.

Verification:

Void Rate + audit sample.

This

ensures the control

turns into action.

129. 15 Common Financial Control Mistakes

1.

Everyone using the same PMS user.

2.

Not doing cash counts.

3.

Bank reconciliation running late.

4.

Processing refunds without control.

5.

Having no discount authority.

6.

Not reviewing the void report.

7.

Not verifying supplier bank account changes.

8.

The same person preparing and approving a payment.

9.

Not doing inventory physical counts.

10.

Not matching Payroll with the HR list.

11.

The Owner mixing company expenses with personal expenses.

12.

Not recording exceptions.

13.

Not keeping control evidence.

14.

Not reporting Control Failures.

15.

After fraud, focusing only on the person and not closing the system gap.

130. 15 Decision Gates — Is Your Financial Control System Sound?

Decision Gate 1

Can the source of every Revenue transaction be traced?

Decision Gate 2

Are Discount and Refund authorities defined?

Decision Gate 3

Is cash reconciled daily?

Decision Gate 4

Do PMS/POS → POS Settlement → Bank match?

Decision Gate 5

Are OTA collections controlled?

Decision Gate 6

Is Accounts Receivable Aging tracked?

Decision Gate 7

Is there segregation of duties in the Purchase-to-Pay process?

Decision Gate 8

Are supplier changes controlled?

Decision Gate 9

Is Payroll reconciled with independent data?

Decision Gate 10

Is an inventory physical count done?

Decision Gate 11

Are personal user accounts used in every critical system?

Decision Gate 12

Are Key Controls defined?

Decision Gate 13

Are Control Owner and Frequency clear?

Decision Gate 14

Do exceptions go through Investigation → Action → Verification?

Decision Gate 15

Can the Owner see whether the control system is working, rather than the transactions?

If most of these questions are answered

“No,”

the hotel

may have an accounting system;

but

may not have a real Internal Control system.

131. Minimum Financial Control System for a Small Boutique Hotel

In a small hotel,

a very complex

Internal Audit system

may not be necessary.

But

at a minimum,

1.

Daily Revenue Reconciliation.

2.

Daily Cash Count.

3.

POS Reconciliation.

4.

Discount / Refund / Void Review.

5.

Weekly AR Review.

6.

Supplier Payment Approval.

7.

Monthly Bank Reconciliation.

8.

Monthly Inventory Count.

9.

Payroll Reconciliation.

10.

User Access Control.

11.

Approval Matrix.

12.

Exception Register.

13.

Control Register.

14.

Monthly Owner / GM Review.

can be set up.

This

creates a very strong

financial control foundation

even for a small hotel.

132. A Financial Control Working File

In a management working file,

the following tabs

can be included:

Daily_Revenue

Daily Revenue.

Cash_Reconciliation

Cash reconciliation.

POS_Reconciliation

Card collection.

Bank_Reconciliation

Bank.

OTA_Reconciliation

OTA.

AR_Aging

Receivables.

AP_Control

Payables.

Payment_Approval

Payments.

Discount_Log

Discounts.

Refund_Log

Refunds.

Void_Log

Voids.

Inventory_Control

Stock.

Payroll_Control

Staff payments.

Exception_Register

Exceptions.

Control_Register

Controls.

Fraud_Incident

Suspicious transactions.

Action_Log

Actions.

Dashboard

Management summary.

But

the file

itself

is not the control system.

The real system

is the chain of

Owner + Frequency + Evidence + Exception + Action + Verification.

133. The Full Flow of a Financial Control System

Transaction → Authorization → System Record → Payment / Collection → Independent Source → Reconciliation → Variance → Exception → Risk Classification → Investigation → Root Cause → Corrective Action → Preventive Action → Verification → Closure → Management Reporting → Control Improvement

This

is the full life cycle

of a Financial Control system.

134. Conclusion: Trust Is a Good Culture, Control Is a Good System

A hotel

is a business

that runs on people.

So

trust

matters.

But

a financial system

cannot be built

on the sentence

“We trust our employees.”

alone.

Because

Internal Control

is not only

for preventing fraud.

It is also

needed to detect

• human error,
• wrong entries,
• system problems,
• Revenue Leakage,
• duplicate payments,
• cash differences,
• inventory loss,
• wrong authority,
• missing collections.

A good system

does not tell the employee:

“I don't trust you.”

It says:

In this business, critical transactions are verified independently of individuals.

Revenue

is visible in the PMS.

Collection

in the payment system.

Cash

in the till.

Money

in the bank.

Records

in accounting.

But

whether these

show the same economic reality

is proven by

Reconciliation.

Authorities

are controlled by

the Approval Matrix.

Risk

is reduced through

Segregation of Duties.

Anomalies

become visible through

Exception Reporting.

Transactions

are traced through

the Audit Trail.

Problems

are examined through

Root Cause Analysis.

Recurrence

is prevented by

Corrective and Preventive Action.

And

the owner

stops being the person who checks every invoice one by one.

Instead,

they become

an investor who sees whether the control system is working.

Because:

Professional financial control is not about distrusting people; it is about not making the business's accuracy dependent on individuals.

A good hotel

generates Revenue.

A well-run hotel

collects the Revenue.

An institutionally managed hotel

can

systematically prove that the revenue it generates, the payments it makes, and the assets it owns are correct, authorized, traceable, and verifiable.

Hotel Investment Guide — Volume VI

Volume VI — Management treats a hotel's financial performance not merely through Budget, Revenue, or Net Profit, but through the integrated relationship between Cash Flow, Break-Even, Departmental Profitability, Investment Return, and Internal Control.

The aim is not just to answer the question:

“How much money did the hotel make?”

it is to build a management infrastructure that can systematically answer the questions

“Was all of this revenue recorded correctly, collected correctly, are the payments made authorized, and are the business's assets safe?”