Hotel Financial Controls Checklist: Internal Controls That Work
Practical internal controls for hotels, from segregation of duties and cash handling to overrides, refunds, AR and OTA commission review, as a checklist.
Quick answer: Good hotel financial controls separate who records a transaction from who approves and reconciles it, require documented approval for rate overrides, comps, voids and refunds, and review exception reports every day and every month. Controls should also reach outside the PMS: OTA invoices, commissions, virtual cards and direct bill all need regular independent review.
Why do hotels need internal financial controls?
Controls protect the hotel from errors, fraud and revenue that is earned but never collected. They also give owners and lenders confidence that the financials are accurate.
Hotels are exposed because many people handle money and adjust charges every day: front desk agents, night auditors, restaurant staff, sales managers and accounting. Most problems are honest mistakes. A few are not. Well-designed controls catch both without slowing down service.
What does segregation of duties look like in a hotel?
No one person should be able to create a transaction, approve it, record it and reconcile it. Split those steps across different people, and where staffing is thin, add a manager review.
- The person who posts an adjustment is not the person who approves it.
- The person who handles cash deposits is not the person who reconciles the bank account.
- The person who sets up direct bill accounts is not the person who posts payments to them.
- The person who approves vendor invoices is not the person who sets up new vendors.
- System user roles match job duties, and shared logins are not allowed.
Smaller properties often cannot fully separate duties. In that case, the GM or an off-site controller should review the relevant reports regularly.
How should cash handling be controlled?
Every cash bank should be assigned to one person, counted at the start and end of each shift, and dropped under dual control. Overages and shortages should be logged, not absorbed.
- Individual, fixed house banks signed out to named employees.
- Blind drops, with a witness and a signed drop log.
- Safe access limited and logged.
- Surprise bank counts on a regular schedule.
- Deposits reconciled to the daily revenue report and bank statement.
How should rate overrides, comps, voids and refunds be controlled?
Each one should require a reason code, a manager approval at a set threshold, and daily review of the exception report. These are the most common ways revenue disappears inside the PMS.
- Rate overrides: Limit who can override, require a reason, and review the override report daily.
- Comps and discounts: Define who can authorize them and up to what amount. Report monthly by approver.
- Voids and allowances: Require manager approval above a threshold and keep the original documentation.
- Refunds: Refund to the original form of payment only, with manager approval and a documented reason.
For example (illustrative numbers only): a monthly review shows 46 rate overrides, 31 of them entered by one user, most on walk-in stays paid in cash. That pattern is worth a closer look, whether it turns out to be a training issue or something more serious. The review only works if someone runs the report and asks the question.
What credit card controls should hotels have?
Protect card data, charge cards correctly and document everything needed to defend a dispute. Card controls touch both security and revenue.
- Follow PCI DSS requirements as directed by your processor and brand, and never store full card numbers on paper.
- Restrict who can key-enter card transactions and issue refunds.
- Obtain signed registration cards and keep authorization records.
- Charge eligible no-show and cancellation fees according to posted policy. See no-show and cancellation fees.
- Track every chargeback and respond before the deadline. See winning more chargebacks.
- Reconcile settlements to processor reports and bank deposits daily or weekly.
What AR controls should be in place?
Approve credit before the stay, invoice promptly, age the ledger weekly and require documented approval for every write-off and adjustment. Our guide to hotel accounts receivable and direct bill covers each step.
- Written direct bill approval with credit limit and terms.
- Invoices issued within a set number of days after checkout.
- Aging reviewed weekly with notes on every past-due account.
- Write-offs approved by level and reported to ownership monthly.
- Contract and crew invoices checked against contract terms.
Why should OTA invoices and commissions be reviewed?
Because they are bills the hotel pays based on someone else's records. Without review, commissions on cancelled, no-show, shortened or fraudulent stays get paid as invoiced.
- Match every OTA invoice line to a completed stay and the contracted commission rate.
- Dispute mismatches within the OTA's dispute window.
- Reconcile every virtual card for full charge before it expires.
- Review travel agent commissions payable against actual stays. See travel agent commissions.
- Track commission expense as a percentage of OTA revenue monthly.
What should the monthly financial review include?
A monthly review by the controller and GM should confirm that every balance sheet account is reconciled, every exception report was reviewed, and every material variance is explained. It is where daily controls get verified.
- Balance sheet reconciliations completed and signed.
- Override, comp, void and refund reports reviewed by approver.
- Cash over/short log reviewed for patterns.
- Card settlements, chargebacks and refunds reconciled.
- OTA, virtual card and travel agent reconciliation completed.
- AR aging, write-offs and adjustments reviewed.
- User access list reviewed; departed employees removed.
- Budget variances explained in writing.
This review fits naturally into the month-end close.
How do financial controls connect to revenue leakage?
Most controls focus on what happens inside the hotel. Much of the leakage happens outside it: at the OTA, the card processor and the billing program. Hotels typically lose 3–12% of revenue this way. x·quic's OTA Commission 360°, Virtual Card 360°, No-Show / Cancel Fee 360° and Credit Card Chargeback 360° add an independent, reservation-level control over those outside parties, and a free 1-Year Profit Audit shows where yours stand. See the FAQ for how access works.
Frequently asked questions
What is the most important hotel financial control?
Segregation of duties. When the same person can create, approve and reconcile a transaction, most other controls can be bypassed.
How can a small hotel segregate duties with a small team?
Use compensating controls: an off-site controller or the GM reviews exception reports, bank reconciliations and write-offs, and system permissions are kept tight.
How often should exception reports be reviewed?
Daily for overrides, voids, refunds and comps; monthly for patterns by user and approver.
Do these controls replace an external audit?
No. Internal controls reduce risk day to day. An external audit is a separate, independent review. Confirm your audit requirements with ownership, lenders and your accountant.
See your own leakage number.
Your free 1-year Profit Audit runs all six 360° audits on your own data and shows exactly what was lost and what is recoverable. No cost, no commitment, nothing to install.
