Internal Controls for Hotels: Protecting Revenue, Cash and Assets

Protecting Revenue, Cash and Assets in a Business With Thousands of Daily Transactions

Oct 13, 2026 · @Someone

A hotel's profit is only as safe as its controls

A hotel handles thousands of small transactions every month: room charges, restaurant bills, bar tabs, cash deposits, supplier invoices, stock movements, payroll and refunds. Each one is a point where money can be lost through error, waste or dishonesty.

Internal controls are the checks that make sure those transactions are complete, accurate and authorised. They protect revenue, cash and assets. They also protect people, because a clear system makes it easier to show that staff have done their jobs properly.

This article is part of our series built around How Hotels Really Work. It explains what internal controls are, why hotels are especially exposed, the main areas that need control, and how owners can keep oversight when they are not on site.

What internal controls are, in plain terms

Internal controls are the rules, routines and system settings that make sure the business works as intended. According to the Committee of Sponsoring Organizations of the Treadway Commission (COSO), whose Internal Control — Integrated Framework (2013) is the most widely used reference in this field, effective internal control rests on five components: the control environment, risk assessment, control activities, information and communication, and monitoring activities. In everyday terms, that means the tone set by leadership, an understanding of risks, the checks themselves, reliable information and ongoing review.

In a hotel, controls usually take two forms:

• Preventive controls stop a problem before it happens. Examples include requiring approval before a purchase, limiting who can void a bill in the point-of-sale system, and keeping stores locked.
• Detective controls find a problem after it happens. Examples include reconciling cash to sales every day, counting stock and comparing it with records, and reviewing discounts and refunds each week.

Neither type works alone. Preventive controls can be bypassed under pressure, and detective controls only help if someone acts on what they find. Good control combines both, and makes sure the results reach someone with the authority to respond.

Why hotels are especially exposed

Few businesses combine as many control risks as a hotel. The same features that make hospitality work also make it vulnerable.

• High transaction volume. Many small sales, adjustments and payments happen every day, often at night and at weekends, across several outlets.
• Cash and multiple payment methods. Cash, cards, mobile money, bank transfers, deposits and operator settlements all need to be matched to the right guest and the right sale.
• Valuable, portable stock. Food, beverages, linen, amenities and fuel are easy to use, waste or remove, and hard to trace without regular counts.
• Many staff and high turnover. Access to systems, stores and cash changes hands frequently, and new staff may not know or follow procedures.
• Discretion at the point of service. Staff can give discounts, complimentary items, upgrades and refunds, which are legitimate tools but also common routes for loss.
• Remote and seasonal operations. Lodges and camps far from town, and hotels that slow sharply in low season, often run with lean teams where one person covers several roles.
• Owners who are not on site. When the owner lives elsewhere, much of the oversight that would happen naturally in a small business disappears.

The stakes are real across every industry. According to the Association of Certified Fraud Examiners' Occupational Fraud 2024: A Report to the Nations, organisations surveyed estimate they lose around 5 percent of revenue to fraud each year. That is a broad estimate across all industries, not a hotel-specific loss rate. But it shows how material losses can become when controls are weak, particularly in a business where margins after costs are often modest.

The key control areas

Every hotel is different, but the same eight areas carry most of the risk. The table summarises each; the notes below explain the ones most often underestimated.

Adjustments are where controls are tested. Most systems record sales well. The risk sits in what happens afterwards: voids, discounts, complimentary items, rate changes, refunds and write-offs. Reviewing these regularly, and asking who made them and why, is one of the most effective controls a hotel can have.

Receiving is the forgotten step in purchasing. Hotels often control ordering and payment but leave receiving to whoever is available. If no one independently checks quantity and quality on arrival, the hotel may be paying for goods it never received.

Former staff often keep access. With high turnover, it is common for system logins, keys and payment approvals to outlast the people who held them. Removing access on the day someone leaves is a simple, often neglected control.

The small-team problem

The textbook answer to most control risks is separation of duties: no single person should handle a transaction from start to finish. But a boutique hotel, a remote lodge or a camp in low season may have only a few people covering reception, cash, stores and administration.

When full separation is not practical, the answer is compensating controls: checks that achieve a similar result in a different way.

• Independent review. Someone outside the transaction, such as the owner, the general manager or an external accountant, reviews key reports regularly: cash reconciliations, voids and discounts, supplier payments and payroll changes.
• Rotation and leave. Rotating duties and requiring staff to take their leave means someone else handles the work periodically, which tends to reveal irregularities.
• System restrictions. Configuring systems so that sensitive actions, such as deleting transactions or changing rates, require a second login or leave an audit trail.
• Surprise checks. Unannounced cash counts and stock counts are more revealing than scheduled ones.
• Payments approved outside the property. Bank payments set up by one person and released by another, who may be off site, protect the largest outflows.

Compensating controls cost little, but they only work if they are actually performed and their results are followed up. A review that no one reads is not a control.

Oversight when the owner is not on site

Many hotels are owned by people who live elsewhere and rely on a general manager or management company to run the property. That arrangement can work very well, but it changes how control must be designed. An owner who is not present cannot rely on seeing problems first-hand.

The principle is simple: the owner should be able to verify, not only receive, information. Practical ways to do this include:

• Direct access to key systems. Read-only access to the property management system, point-of-sale reports and bank accounts lets the owner see the same data management sees. Access should be set by role: viewing rights for oversight, with payment initiation and approval rights allocated separately and deliberately.
• Bank statements from the bank, not the hotel. Receiving statements directly removes one point where information could be altered or delayed.
• Control over large payments and changes. The owner, or someone independent of management, approves payments above a set limit, new suppliers and changes to payroll.
• A consistent monthly reporting pack. Departmental results, cash position, receivables, payables and key exceptions, in the same format every month and delivered soon after month-end.
• Independent review. Periodic checks by an external accountant or internal auditor who reports to the owner, not to the people being reviewed.
• Clear authority limits. A written document setting out who may approve what, so that decisions above certain levels always come to the owner.

In managed and branded hotels, many of these rights are set out in the management agreement. Owners benefit from knowing exactly what information and audit rights the agreement gives them, and from using them.

Warning signs and questions to ask

Weak controls rarely announce themselves. A warning sign is a reason to verify the underlying records and understand the cause, not proof of fraud or misconduct. Many have ordinary explanations, but each deserves a closer look.

Warning signs

• Cash deposits that are irregular or do not match daily sales.
• A rising number of voids, discounts, complimentary items or refunds.
• Food, beverage or linen costs rising without a change in business.
• Suppliers who are paid quickly while others wait, or new suppliers added without explanation.
• Staff who never take leave or resist sharing their duties.
• Reports that arrive late, change format or cannot be traced back to source records.
• Bank and system access shared between staff or still held by people who have left.

Questions to ask

• Who can void a bill, change a rate or issue a refund, and who reviews those actions?
• How often is cash counted and reconciled to sales, and by whom?
• Who orders, who receives and who approves payment for supplies?
• When were stock and fixed assets last counted?
• Who can add a new supplier or employee to the system?
• What can the owner see directly, without going through management?

Control protects the business and the people in it

Good internal controls do not signal distrust. They make results reliable, protect honest staff, and give owners confidence in the numbers they receive. They also make a hotel easier to finance, audit and sell.

For how controls fit into day-to-day operations, read Hotel Operations and Cost Control: A Guide to Departmental Profitability. [Link] For the wider picture, start with How Hotels Really Work. [Link]

Your next step

Download the Hotel Owner's Reporting Checklist to see whether your monthly reports give you the information you need to oversee your property. [Download link]

About Glenrich Consultants

Glenrich Consultants works with hotels, resorts and lodges in Tanzania Mainland and Zanzibar. We help owners and management design practical internal controls, review how well existing controls work, and give owners an independent view of their property.