How to Establish Financial Controls in a Business You Just Bought

The short version

• The standard first-100-days advice is to change nothing and observe. There is exactly one exception, and it is the bank.
• Financial controls are the one area where day-one action is correct: signatory authority, spending approval limits, and daily cash visibility.
• You borrowed to buy this. The cash that services that debt is the thing those three controls protect, starting the hour you close.
• Below: the exact day-one control list, and the hard line between it and the operational changes that still wait.

The one place the "change nothing for ninety days" advice is wrong is the bank. Every other instinct to fix things in week one is a mistake you should resist, but financial controls and bank signatories are the exception you act on the day you close.

This is the narrow carve-out in the post-close rulebook, not a license to start changing the business. You install three controls, you draw a hard line, and you go back to watching everything else.

The reason the bank is the exception is simple. You borrowed against this business, and the cash moving through those accounts is what services the loan you signed.

The one thing you change on day one

Financial controls are the single exception to the post-close rule that you change nothing in the first months. On day one you should change bank signatory authority, set spending approval limits, and put a daily cash view in place.

These three controls protect the cash that services your acquisition debt. Unlike pricing, staffing, or systems, they cannot safely wait while you learn the business.

Everywhere else, the discipline of the first 100 days after buying a business is to preserve and understand before you touch anything. You keep the team, the vendors, the prices, and the way the work gets done exactly as they were.

Financial controls break that rule on purpose. The seller's name should not stay on the accounts, and undefined spending authority should not survive the close.

The mechanism is the debt. You financed the purchase, often through an SBA 7(a) loan, and that debt is serviced out of the cash the business produces every month.

Revenue is not the thing your loan payment comes from. Cash is, and cash is the one resource a new owner can lose fastest and recover slowest.

If money can leave the accounts without your knowledge in week one, the thing at risk is the cash flow your loan payment depends on. That is why this one area moves first.

Take control of the bank accounts and signatory authority

The first control is the most urgent, because it decides who can move money. Until you change it, the previous owner may still have signatory authority on the accounts you now own.

Walk into the bank, with closing documents in hand, on the first business day. Here is the order:

1. Remove the seller's signatory access. Their authority to sign checks, initiate transfers, and use account cards ends at close, and the bank needs the paperwork to make that real. This is not distrust, it is the basic transfer of control you paid for.
2. Establish yourself as the controlling signatory. Add yourself to every operating, payroll, and reserve account, and confirm you can see and authorize every movement of money.
3. Re-credential online banking and payment tools. Reset logins, ACH origination access, and any saved payment methods so nothing transacts under the prior owner's credentials.
4. Map every account and recurring payment. List each account, each auto-draft, and each standing vendor ACH, so you know what leaves the business without anyone touching it.

Your due diligence checklist should already have surfaced most of these accounts and auto-payments. Day one is when you convert that knowledge into actual control of the money.

One practitioner note. Do not cancel auto-payments in this step, only catalog them, because killing a recurring payment you do not yet understand is exactly the kind of operational change that waits.

Set spending approval limits before anyone spends

The second control names who can spend what, and up to how much, before the first uncontrolled purchase happens. Without it, the team keeps spending on the old owner's unwritten rules while you are still learning the business.

A spending limit is a named authority, not a form. The point is that every dollar over a threshold passes through a person, and in the first weeks that person is you.

• Set a single approval threshold you sign off on. Pick an amount, for example any spend over $500, that requires your approval before it happens. Hold it low at first, then raise it as you learn what is routine.
• Name who can approve what below that line. A manager may already approve normal purchases, and that can continue, but the authority is now written down and known rather than assumed.
• Freeze new vendor relationships and new recurring charges. Existing vendors keep running untouched, but no new auto-draft or contract starts without your sign-off in the early weeks.
• Require two eyes on payroll and large transfers. Payroll runs as scheduled, but you review the run before it goes out until you trust the numbers and the process.

These limits are deliberately temporary in their tightness. The first version is conservative because you do not yet know which expenses are real, and that calibration is part of the work, not a permanent bureaucracy.

This is the financial half of the same authority map that the post-acquisition systems audit builds for operations. You are documenting who decides what, starting with money because money is where the exposure is highest.

Get cash visibility you can read daily

The third control is sight. You cannot protect cash you cannot see, and most new owners spend the first weeks with no daily read on money moving in and out.

Build a simple cash view you check every morning. It does not need software you have to buy, only a consistent place where you see what came in, what went out, and what is scheduled.

• Track the operating account balance daily. A single number, read at the same time each day, tells you fast when something is off.
• List the next thirty days of known outflows. Loan payment, payroll, rent, and large vendor drafts, so no scheduled debit surprises you.
• Watch receivables and the inflow timing. Knowing when cash actually lands matters as much as how much, because the loan payment has a date.

The gap between when you deliver work and when you get paid is the cash conversion cycle. In the first weeks it is the number most likely to surprise you, because the seller absorbed it on instinct and never wrote it down.

This is also where you start reading the books in earnest. Learning to read the P&L you inherited turns the seller's numbers into your own understanding of where the money comes from and goes.

Hold one distinction while you do it. The metric that protects your debt service is cash, not paper profit, because a profitable month can still run short on the day the payment is due.

Daily visibility is what keeps the gap between those two from catching you.

What financial controls are NOT: the line you do not cross in week one

Here is the line, and it matters as much as the controls themselves. Installing financial controls does not mean you have started changing the business, and treating it as permission to do so is the most common way new owners damage what they bought.

Controls are the narrow exception. Everything operational still waits, and the list of what waits is long:

• Pricing stays as it is. You do not yet know why a price is set where it is, and changing it in week one is a guess with the customer relationship as the stake.
• Staffing stays as it is. The team is the institutional knowledge you paid for, and a reorganization before you understand the work is how that knowledge walks out.
• Vendors stay as they are. Existing terms keep running, even ones you suspect are bad, until you understand what they buy you.
• Systems and process stay as they are. The way the work gets done is preserved and observed first, then improved later, in that order.

The sequence is preserve, understand, stabilize, improve, then scale. Financial controls sit outside that sequence as the day-one carve-out you complete before it begins, alongside the legal transfer and the bank signatories.

Integration is the phase where the price you paid is either captured or destroyed. Controls protect the cash that lets you reach the capture; an early operational change is how owners destroy it instead.

Where the rest of it lands in time is the job of the 30-60-90 day plan, which sequences the operational changes that controls are explicitly not.

Cross this line and you stop being a careful new owner and become the risk the previous owner's customers were worried about. Hold it, and the controls do their job quietly while you spend ninety days learning what you actually own.

FAQ

What financial controls should you set up after buying a business?

Set up three controls on day one: change bank signatory authority so the seller can no longer move money, set spending approval limits so purchases above a threshold pass through you, and build a daily cash view. These protect the cash that services your acquisition debt while you learn the business.

What should you change first after buying a business?

Change the bank signatories first, the same day you close. Removing the seller's access and making yourself the controlling signatory is the single most urgent post-close action, because it decides who can move the money the business runs on before anything else can go wrong.

Should a new owner change anything immediately after an acquisition?

Only financial controls, legal transfer, and bank signatories change immediately. Everything operational, including pricing, staffing, vendors, and systems, is preserved and observed for the first months, and the bank is the deliberate exception to the rule of changing nothing right after close.

---

You cannot protect cash you have not measured, and you cannot see the gap a buyer will eventually see in the business without measuring it either.

The free Keystone diagnostic gives you three scores and an estimated sale price, calibrated against 10 years of BizBuySell Insight Reports and 1.6M+ SBA 7(a) loan records. You see your real number and what is discounting it.

Get your three scores and an estimated sale price, free, at app.trykeystone.io.

Once the business is stable, the Systems Sprint installs the operating layer that the day-one controls only started. The Sprint is a 30-day engagement priced at $1,500 Beta, $1,900 Standard, and $4,500+ for the Portfolio Edition, and Keystone Core ($129/mo, $1,290/yr) sustains the decision routing and the controls after.