SME administration: simplify processes without losing control

An SME’s administration rarely becomes cumbersome overnight. It builds up in layers: a spreadsheet created as a stopgap, an approval added after a mistake, a shared folder duplicating the business software, then a few “temporary” emails that become the real process. Each element seems reasonable; together, they end up consuming time and obscuring responsibilities.

Simplification therefore does not mean removing controls. It means eliminating duplicate entry, steps without value and mechanical approvals while retaining what prevents mistakes, detects anomalies and proves what was done.

The first question is not “which software should we buy?” but “what result must we achieve, who is responsible and what evidence must we keep?” Software comes afterwards. It is less spectacular than an artificial intelligence demonstration, but considerably more useful on Monday morning.

At a glance

• Start by mapping the process actually followed, including workarounds through email and spreadsheets.
• Assign each workflow an owner, a deputy, a deadline, a reference system and an escalation rule.
• Reserve dual approvals for transactions where an error would be genuinely costly: payments, bank details, wages, contracts and official filings.
• Automate only a stable process with identified exceptions and a manual fallback.
• Preserve the audit trail, access rights, supporting documents and statutory deadlines: saving three clicks does not justify losing the evidence.

Why do administrative processes become complicated?

Most administrative burdens do not arise from a legal obligation. They emerge when information circulates without clear rules. A supplier invoice might, for example, arrive in three inboxes, be saved on a shared drive, be emailed for approval, be re-entered in the accounts and then be copied into a tracking spreadsheet. Five records exist, but nobody immediately knows which is authoritative.

The most common symptoms are easy to recognize:

• the same data is entered in several tools;
• a case only moves forward when a particular person is present;
• approvals are given through scattered channels;
• exceptions gradually become the rule;
• deadlines are tracked in an employee’s memory;
• a control exists, but its performance cannot be traced.

Before adding an application, distinguish three functions: performing the transaction, checking it and retaining the evidence. A single step can sometimes fulfill all three; confusing them without thought, however, creates a blind spot.

What to simplify—and what to protect

A practical method in seven steps

1. Start with the expected result

Define where the process starts and ends. “Manage invoices” is too vague. “Receive each invoice, check the supplier and service, obtain the required approval, prepare payment, record it and archive the document” is actionable. The result must be observable and verifiable.

2. Map the actual workflow

For a few days, follow several cases from start to finish. Note each entry, wait, return, decision and document search. The official process may fit on one page; the real one passes through an inbox, two conversations and a spreadsheet called “final_v3_def”. It is the latter that needs improving.

3. Designate an authoritative source

For each important item of information, one system must be authoritative: the accounting software for entries, the document repository for supporting records, the HR tool for employee data and the CRM for business contact details. Other tools may display or transmit the information but should not become competing databases.

4. Assign roles and plan for absences

Each workflow needs an owner responsible for its proper operation, identified operators, an approver where the risk warrants it and a deputy. Add an escalation rule: after which event or delay must the case be referred upwards? Without this, dashboards become museums of overdue tasks.

5. Match controls to risk

A useful control addresses a specific risk. Changing a supplier’s IBAN, amending base salary, releasing a payment or submitting an official declaration warrants stronger checks. A routine order for a low-value supply does not necessarily require three approvals. Thresholds and roles are internal: they must reflect the amounts, activity and financial capacity of the business.

6. Automate after stabilization

Automation is appropriate when the rule is repetitive, input data is sufficiently reliable and exceptions can be isolated. It should leave a log, report failures and allow manual recovery. Automating a confused process mainly accelerates the production of consistent mistakes.

Artificial intelligence can help classify, extract or summarize, but identifiable files should not automatically be sent to it without a defined framework. The principles of data minimization, access control and human review discussed in our article on generative AI and data protection remain fully applicable.

7. Document just enough and measure

A one-page process sheet is often sufficient: trigger, expected result, owner, deputy, reference tool, steps, controls, exceptions, evidence retained and deadline. Then measure a few simple indicators: overdue cases, waiting time, rework, missing documents and unresolved exceptions. There is no universal threshold; changes over time are generally more informative than an isolated figure.

The five workflows to address first

Example: streamline invoice processing without weakening payment controls

1. The invoice arrives through a single channel and automatically receives a reference.
2. Data is extracted; duplicates and incomplete fields are flagged.
3. The person responsible for the expenditure confirms that the service was actually provided.
4. Enhanced checks apply only to specified cases: a new supplier, a changed IBAN or an unusual amount or transaction type.
5. Payment is prepared in the reference system and then authorized in accordance with banking authorities.
6. The invoice, approval and payment trail are linked and retained.

This arrangement removes unnecessary manual transfers without conflating the person requesting the expenditure, the person confirming the service and the person releasing payment where the stakes require separation. Controls focus on risky cases, not every click.

Legal boundaries that must not be “optimized”

Responsibilities of governing bodies

In a Swiss public limited company (SA), the board retains, in particular, its non-transferable responsibilities for organizing accounting, financial control and, where necessary, financial planning. Comparable duties fall on the managers of a Swiss limited liability company (Sàrl). Entrusting execution to an employee, an accounting firm or software therefore does not remove the governing body’s supervisory responsibility. This does not require every small business to adopt the same formal system; controls must remain proportionate to size and risk.

Accounting and archiving

The Code of Obligations requires accounting that makes it possible to track the transactions and events needed to present the economic position. Accounting books and records must generally be retained for ten years. Electronic retention is permitted where the link to transactions, integrity, availability and readability are guaranteed under the Code of Obligations and the accounting records ordinance (Olico). A digital folder that can be altered without a history therefore does not become compliant archiving simply by being called “cloud”.

The quality of these records also facilitates accounting closing and year-end checks : reconciliations are faster when each important entry refers to an accessible document, approval and explanation.

Data protection and outsourcing

The Federal Act on Data Protection (FADP) requires appropriate technical and organizational measures to be built into processing from the outset and data to be limited to what is necessary by default. Access rights should therefore not be copied from an old folder “because it has always worked that way”. Where a provider processes data, the business must regulate the outsourcing, verify security measures and maintain control over any further processors. Outsourcing shifts execution; it does not transfer primary responsibility.

A 30-day action plan

Mistakes to avoid

• reproducing every step of the old process in a new tool;
• rolling out several workflows simultaneously without a pilot or an owner;
• automating exceptions before the normal case;
• keeping parallel files “just in case” without a retirement date;
• granting overly broad rights to avoid managing access;
• measuring only time saved without tracking errors and delays;
• assuming that a software provider takes on the business’s obligations.

The opposing view: do more controls mean more security?

Not necessarily. An additional approval can reduce risk if the person has different information and knows what to check. If they simply click “approve” because the case cannot otherwise proceed, the control is decorative. Worse, an excessively cumbersome procedure encourages employees to create parallel routes.

The opposite argument nevertheless deserves consideration. In a dispute, tax audit, fraud case or payment error, the business will need to show who decided, on what basis and when. Defensible simplification therefore does not remove steps indiscriminately; it concentrates controls on significant risks and makes their performance visible.

How Delta Conseil SA can support you

Delta Conseil SA can analyze an administrative workflow, identify duplicate entry and gaps in responsibility, define useful controls and formalize a proportionate process. Support can cover document organization, accounting, payroll, tax and social insurance deadlines, as well as preparing automation or integration with existing tools.

Where the project involves cybersecurity, complex IT architecture or a specialist legal issue, we coordinate the involvement of the appropriate specialist.

Speak to an adviser

Caution

The method must be adapted to the industry, size, signing authorities, contractual obligations and data processed. Some documents or processes are subject to specific rules. Before removing an original, a control or an approval step, its actual legal and operational function must be checked.

Frequently asked questions

Which administrative process should you start with?

Choose a frequent, measurable and troublesome workflow whose scope remains manageable. Supplier invoice processing, employee onboarding or mail tracking often make good pilots. Avoid starting with the rarest and most complex process.

Do you need ERP software to simplify administration?

No. An ERP can reduce gaps between functions, but it does not correct unclear responsibility or contradictory rules. An SME can already achieve substantial gains by establishing an authoritative source, roles, templates and a single tracking system. The choice of tool should follow from the target process.

Can paper records be discarded after scanning?

Accounting books and records can generally be retained electronically if the requirements of the Code of Obligations and the accounting records ordinance (Olico) are met, particularly integrity, readability and the link to transactions. However, check whether a particular document must be kept in a specified form or whether the original has evidential value of its own.

Must a small SME apply the four-eyes principle everywhere?

No. Dual control should target sensitive operations and remain workable. For routine, low-risk tasks, an automated check, periodic reconciliation or exception-based review may be more effective. Payments, IBAN changes, payroll data and major commitments, however, generally warrant stronger separation of duties.

Does outsourcing transfer responsibility to the accounting firm or provider?

It transfers certain tasks, not the overall responsibility of the business and its governing bodies. The engagement must define roles, deadlines, approvals, access, data exchanges and expected evidence. Management must retain enough visibility to supervise the process and make the decisions that remain its responsibility.

Official sources

• Code of Obligations (CO), in particular Articles 716a, 810, 957a and 958f.
• Ordinance on keeping and retaining accounting records (Olico).
• SECO SME portal — Electronic retention of accounting records.
• Federal Act on Data Protection (FADP), in particular Articles 7–9.
• FDPIC — Information security and guide to technical and organizational measures.
• FDPIC — Outsourcing (processing by third parties).
• National Cyber Security Centre — Information security: guidance for SMEs.

Last legal review: September 2, 2026.

Disclaimer

This publication is provided for information only and does not constitute individualized legal, tax, accounting or financial advice. Each situation must be assessed in light of its specific circumstances and the law applicable at the time of the decision.

For further information, please consult our Legal notice and disclaimer.