Financial Governance for Scaleups:
The Controls to Add Before €5M ARR

Short answer

Before €5M ARR, a scaleup should put in place segregation of duties (no one person controls a payment end to end), a written approval matrix with spending limits, monthly close and reconciliations, board-level financial reporting, and access controls on banking and accounting. Around €3–5M ARR is also when most companies add strategic finance leadership.

In a founder-run startup, one person can raise an invoice, approve it and pay it — sometimes before lunch. That's efficient at ten people and dangerous at eighty. Financial governance is what lets a scaleup delegate spending without losing sleep: the controls, limits and hires that replace "I trust everyone" with "the system doesn't depend on trust." Most companies hit the wall around €3–5M ARR, where the volume of decisions outruns founder bandwidth. This is the framework to install before you get there, grounded in the COSO internal-control standard and adapted for a fast-moving company.

What financial controls should a scaleup have before €5M ARR?

You don't need a corporate control environment. You need a short list of controls that stop the failures that actually sink scaleups: payment fraud, cash surprises, and financial statements that fall apart in due diligence. CRV's 2026 guidance makes the timing point well: decision frameworks, operational controls and measurement disciplines "all need to be running before revenue complexity makes them painful to install." Retrofitting controls during a Series B raise is the expensive way to learn this.

Here is the checklist to work through before €5M ARR:

• Segregation of duties on cash. Whoever initiates a payment cannot also approve and release it.
• A written approval matrix. Spending authority by amount and category, signed off by the board (see the next section).
• Dual authorisation on outgoing payments above a set threshold, and on any change to bank payee details.
• A monthly close on a fixed calendar (say, by working day ten) with bank and balance-sheet reconciliations.
• Board-level financial reporting each month or quarter that ties back to the ledger, feeding your board reporting.
• Access controls. Named logins, least-privilege roles on banking, accounting and payroll; revoke access the day someone leaves.
• Supplier and payee verification. Call back to confirm any bank-detail change before you pay — the single cheapest defence against invoice fraud.
• An expense policy with pre-approval thresholds and corporate cards carrying per-card limits.
• One owned budget and rolling forecast, maintained by finance, not scattered across personal spreadsheets.
• An audit trail. No direct edits to posted entries; corrections go through journals so history stays intact.

Tighten cash and treasury controls first — that's where a single mistake or bad actor does the most damage, fastest.

The backbone of scaleup financial governance: segregation of duties

Every item on that list traces back to one idea, and it isn't a startup invention. The COSO Internal Control–Integrated Framework, the reference standard used worldwide, comes from a body founded in 1985 specifically to study the causes of fraudulent financial reporting. It organises internal control into five components and seventeen principles. Segregation of duties and approval authority live in the "control activities" component. The scaleup version is simple: split every money transaction so no one person owns it end to end.

A clean split covers four roles across any payment:

• Initiate: someone raises the payment or purchase.
• Approve: someone else authorises it against budget and the approval matrix.
• Record: the transaction is booked in the ledger.
• Reconcile: a different person checks it against the bank.

At fifteen people you can't fully separate all four, so you compensate: the founder reviews a weekly payment run, or a board member gets read-only access to the bank. As you hire, you separate them properly.

The approval matrix

The approval matrix turns "ask me" into a rule anyone can follow. It's the documented approval hierarchy that lets you delegate spend without losing control. Thresholds below are illustrative: scale them to your revenue and risk.

Write it down, have the board approve it, and revisit it at each funding stage. An approval matrix that lives only in the founder's head isn't a control — it's a bottleneck that fails the moment you're on a plane.

When to hire: from founder-run books to a real finance function

Controls need an owner, and that owner changes as you grow. The finance function scales in stages (CRV maps the ladder as bookkeeper, then controller, then VP of finance, then full-time CFO), and hiring the wrong level wastes money either way.

• Seed to ~€1M ARR: founder plus a bookkeeper or outsourced accounting. Clean books, nothing fancy.
• ~€1–3M ARR: add a controller for accurate books and compliance, and bring in a fractional CFO for the strategic work — forecasting, fundraising prep, cash management. CRV puts the fractional trigger in exactly this window.
• ~€3–5M ARR: this is where real financial governance has to be in place, and where a part-time finance leader starts feeling stretched. Controls, reporting and forecasting all need a genuine owner.
• Past ~€8–15M ARR: the strategic workload sustains a full-time CFO. CRV warns that pushing much past $15M ARR with no dedicated finance leadership is where inefficiency and exposure outweigh the salary you saved.

The trigger is rarely the revenue number alone. Fundraising lead times, a business that moves customer money, and board questions your books can't answer all pull the hire forward. Build in stages, and the finance function is ready before you feel the pain — not during a raise.

Germany: what the GoBD adds

German scaleups (usually a GmbH) carry an extra, non-negotiable layer: the GoBD. These are the Finance Ministry's principles for keeping and retaining books and records in electronic form and granting data access to the tax authorities. In practice they demand that your records be complete, correct, timely, ordered and, crucially, unalterable, backed by a written process description (Verfahrensdokumentation). The BMF refreshed the rules through 2024 and 2025, partly to reflect mandatory e-invoicing between domestic businesses from January 2025.

The good news: the controls above and GoBD compliance pull in the same direction. An audit trail with no direct edits, a documented close process and proper access controls are exactly what the GoBD expects. Build the governance once and you satisfy both your investors and the Finanzamt.

What this means for you

Sequence beats perfection. Start with the two controls that stop the worst outcomes (segregation of duties on payments and a signed approval matrix), then add a disciplined monthly close and board-grade reporting. Match the finance hire to the stage: bookkeeper, controller, fractional CFO, full-timer, in that order, without skipping rungs. If you're German, build to the GoBD from the start so you never have to reconstruct an audit trail you didn't keep. Do this before €5M ARR and financial governance becomes a quiet advantage in every board meeting and every diligence, instead of the thing that blows up the raise.