The handful of controls that stop most small-business fraud

When a small business gets robbed from the inside, it almost never looks like a heist. There's no mastermind. There's a trusted bookkeeper who, one tight month, "borrows" $4,000 against a vendor refund, fully intends to put it back, and never does. Three years later it's $180,000 and the only reason you found out is the company ran out of cash. Fraud in small companies is mostly about opportunity, not evil — and you control how much opportunity exists.

The structural problem is that small teams concentrate trust. One person often records the transactions, cuts the checks, reconciles the bank account, and tells you everything is fine. That isn't a character flaw; it's a design flaw. You handed one set of hands the ability to move money and to hide the movement. The fix isn't a forensic audit or expensive software. It's a handful of cheap controls that separate the hands.

Separate who records, who pays, and who reconciles

Segregation of duties means no single person controls a transaction end to end. The three powers you want to split are: recording (entering bills and invoices in the books), paying (releasing money), and reconciling (matching the books to the actual bank statement). When one person holds all three, they can invent a fake vendor, pay it, and erase the trail in the same afternoon. Split even two of the three and that becomes nearly impossible to pull off quietly.

You don't need a big staff to do this. If your bookkeeper records and pays, then you — or anyone else — should be the one who reconciles. The point is that the person moving money is never the same person confirming the money moved correctly.

Put a second set of eyes on payments and new vendors

Two controls do most of the work here, and both are cheap. First, dual approval over a dollar threshold: any payment above a line you set — say $2,500 — needs a second person's sign-off before it's released. Most banks and bill-pay tools let you turn this on in minutes. Second, control the vendor master file, which is just the list of approved payees the system can send money to. The single most common scheme is a fake or "ghost" vendor, so no brand-new payee gets added without a second person taking a real look.

• Set a dual-approval threshold and require a second sign-off above it
• Lock down who can add a vendor — a new payee always gets a second look
• Watch for vendors whose address or bank details match an employee's
• Be suspicious of round-dollar payments and slightly-altered familiar names

Open the bank statement yourself

This one costs you fifteen minutes a month and catches an astonishing amount. Have the bank statement delivered to you — physically or to an inbox only you see — and open it before anyone else touches it. Skim the actual cleared checks and transfers. You're not auditing; you're looking for a payee you don't recognize, a number that's bigger than it should be, or your own signature on something you never approved. When the person handling the books knows you personally see the raw statement every month, the temptation drops to almost nothing.

Reconcile every month, for real

A reconciliation matches your books to the bank's record, line by line, so that every dollar is accounted for. Done honestly each month, it's the backstop that catches what the other controls miss — a missing deposit, a duplicate payment, a check that cleared for a different amount than it was written for. The trap is letting the same person who pays the bills also be the one who declares the reconciliation "done." Make sure someone independent confirms it actually ties out, and that stale uncleared items get explained rather than ignored.

None of this is bureaucracy — it's five habits that fit in an afternoon to set up and a few minutes a month to keep. Pick the one you're missing today, the bank statement is usually the easiest, and turn it on this week. Trust your people; just don't let trust be the only thing standing between them and the checkbook.