Fraud Prevention for Small Businesses: Internal Controls That Work
Small businesses are hit hardest by fraud because they trust more and check less. You do not need an audit department to protect yourself. A handful of simple controls, applied consistently, close most of the gaps that fraudsters use. This checklist walks through them in order of impact.
Key takeaways
- The ACFE estimates organizations lose about 5% of revenue to fraud each year, and the typical case runs for a year before it is found.
- Tips are the most common way fraud is detected, so make it easy and safe for staff, customers and vendors to speak up.
- The core control is separation of duties: the person who approves a payment should not be the one who records it or reconciles the bank.
- The owner reviewing the bank statement every month, personally, is the cheapest and most effective control there is.
The Association of Certified Fraud Examiners (ACFE) publishes a study of occupational fraud cases every two years, the Report to the Nations. Its findings are consistent across editions: the median loss per case is large relative to a small company's profit, cases typically run for around a year before discovery, and the single most common weakness that allowed the fraud was a lack of internal controls. Small organizations appear in these reports with a disproportionate share of losses, because they tend to have fewer controls and the owner is often too busy to look.
The good news is that the controls that work are not expensive. They are habits: separating tasks, requiring two sets of eyes on money leaving the business and having the owner look at the actual bank records rather than a report someone else prepared. This article is organized as a checklist, grouped by the area of the business each control protects.
How small business fraud actually happens
The ACFE groups occupational fraud into three types. Asset misappropriation, which means stealing cash, inventory or other assets, is by far the most common, appearing in roughly nine out of ten cases, though with the lowest median loss. Corruption, such as kickbacks from vendors and conflicts of interest, is next. Financial statement fraud is rare but the most expensive when it happens. For a small business, the typical cases look like this:
- A bookkeeper who pays themselves through payroll twice, or adds a fictitious employee.
- A manager who sets up a fake vendor and approves its invoices.
- An employee who skims cash sales before they are recorded.
- A purchasing lead who steers orders to a supplier in exchange for gifts or cash.
- Expense claims padded with personal spending, month after month.
- Check tampering: altering the payee or forging signatures on company checks.
What these have in common is that one trusted person controlled a process end to end, and nobody else looked. The ACFE's research also finds that most perpetrators have no prior fraud record and that the majority display behavioral red flags such as living beyond their means or unusually close relationships with vendors. Trust is not a control.
Common mistake
Assuming a long-serving, loyal employee could not be the problem. ACFE data consistently shows that longer-tenured employees cause larger losses, partly because they know where the gaps are and partly because their work is checked least. Controls should apply to everyone, including family members and the owner's closest colleagues.
The checklist: controls by area
Cash and bank
- The owner opens the bank statements. Have statements, or online banking alerts, come to you directly, and read them before the bookkeeper does. Look for unfamiliar payees, round numbers, payments just under approval thresholds and transfers to accounts you do not recognize.
- Reconcile every account monthly, and have someone other than the person who records transactions do it. In a very small business this may be you or an outside accountant.
- Require two approvals for payments above a threshold. Most online banking platforms support dual authorization. Set the threshold low enough to catch meaningful amounts, for example $1,000 or $2,500.
- Limit who can create new payees or change bank details. Changing a vendor's bank account should require a call-back to a known phone number, not an email reply. Fraudsters impersonating vendors to redirect payments is one of the most common attacks on small companies.
- Keep signature authority tight. Few signatories, no signed blank checks, and the owner signs anything above a set amount.
Purchasing and vendors
- Separate ordering, receiving and paying. The person who places an order should not be the one who confirms goods arrived and should not be the one who releases payment. If you have only two people, split it two ways and have the owner review.
- Maintain an approved vendor list. New vendors need an application with a real address, tax ID and bank details, verified by someone other than the requester. Check that the vendor's address is not an employee's home.
- Match invoices to purchase orders and delivery records before paying. A three-way match stops fake invoices and double billing.
- Review vendor files once a year. Look for vendors with similar names, vendors with no physical address, vendors paid only in round amounts and vendors that appeared and grew quickly.
- Have a written gifts and conflicts policy. Staff who buy on the company's behalf should declare any relationship with a supplier and any gift above a small value.
Payroll and expenses
- The owner approves every change to the payroll master file. New employees, pay rate changes and bank detail changes should each need sign-off from someone outside payroll.
- Review the payroll register each period. Count the names. Compare total pay with the prior period and ask about any difference.
- Require receipts and a business purpose for expense claims, and have someone other than the claimant's friend approve them. Spot-check a sample every month.
- Issue company cards with limits instead of reimbursing personal cards where possible, so spending is visible in real time.
Sales, inventory and cash receipts
- Record every sale at the point of sale. Use a till or system that numbers transactions, and reconcile daily takings with system totals before banking.
- Separate the person who receives payments from the person who records receivables. Otherwise a customer's check can be diverted and the balance written off quietly.
- Review credits, refunds and write-offs. These are classic hiding places. Any credit note above a small amount should need approval from someone who did not create it.
- Count inventory regularly and investigate shrinkage. Rotating cycle counts by someone who does not manage the stock will show losses early.
People and culture
- Check references and, where legal, backgrounds for anyone handling money. Rules on background checks vary by country and state, so confirm what you may ask.
- Make it easy to report concerns. According to the ACFE, tips are the leading detection method, accounting for roughly 43% of cases in the 2024 report, and more than half of tips come from employees. Even a small business can have a stated policy, a named person to contact and a promise that reports will be taken seriously without retaliation.
- Require vacations and rotate duties. Fraud that depends on constant maintenance often surfaces when the person is away for two weeks and someone else handles their work.
- Set the tone from the top. If the owner pads expenses or asks staff to bend rules for customers, staff learn that rules are optional.
Worked example
Imagine a small construction company where the office manager creates vendors, enters bills, prints checks and reconciles the bank. Over three years she adds a vendor named after a real supplier with one letter changed, with her own bank details, and pays it $1,500 every month for "site cleaning." Total loss: $54,000. Three controls would each have caught it: the owner reviewing bank payees, a call-back verification when the vendor was created, or a second person reconciling the bank. None of them costs more than an hour a month.
Scaling controls to the size of the business
A business with two staff cannot separate every duty. The principle is to put the owner in the loop at the points where money leaves. The table shows a practical minimum at three sizes.
| Team size | Minimum controls | Who does the checking |
|---|---|---|
| Owner plus 1 to 3 staff | Owner reads bank statements, approves all payments, signs all checks, reviews payroll | Owner, with an outside accountant for monthly reconciliation |
| 4 to 15 staff | Dual approval above a threshold, approved vendor list, separate ordering and paying, expense policy, formal reporting channel | Owner plus one trusted manager, with duties split between them |
| 15 to 50 staff | Documented procedures, three-way matching, annual vendor and payroll review, periodic external review, rotation of finance duties | Finance lead, with owner review and an outside accountant or auditor annually |
Pro tip
Ask your accountant to perform a short "surprise" review once a year: a sample of vendor payments traced to invoices and delivery, a sample of expense claims traced to receipts and a payroll headcount check. The cost is modest, and simply telling staff that such reviews happen is itself a deterrent.
Technology that helps
Most accounting platforms include features that make controls cheap: user roles that stop one person from both entering and approving bills, audit logs that show who changed what, and bank feeds that make reconciliation quick. Many business bank accounts offer dual authorization, payment alerts and employee cards with limits. Use them. The goal is not to make staff feel distrusted but to make the right process the default, so nobody has to rely on willpower.
Two external threats deserve their own controls. Business email compromise, where a fraudster poses as the owner or a vendor to request an urgent payment, is best countered by a rule that bank detail changes and unusual payment requests are always confirmed by phone on a known number. Card fraud and account takeover are reduced by two-factor authentication on banking and accounting logins and by never sharing credentials between staff.
Signs your controls are working
- The owner can name every vendor paid last month
- Bank reconciliation is done within a week of month end, by a second person
- No single person can add a vendor and pay it
- Staff know how to raise a concern and have done so without consequences
Warning signs
- One employee refuses to take vacation or share their work
- Reconciliations are always late or "nearly done"
- Vendors you have never heard of appear in the bank feed
- Unexplained inventory shrinkage, growing credit notes or rising expense claims
This month's action checklist
- Redirect bank statements and alerts to the owner and read last month's statement line by line
- Turn on dual authorization for payments above a set threshold
- Write a one-paragraph rule for verifying new vendors and bank detail changes by phone
- List who can order, who confirms receipt and who pays, and split the roles where they overlap
- Review the payroll register and count the names against the people you employ
- Tell staff how to report a concern, and who to
- Book a short review with your accountant and ask them to test a sample of payments
Frequently asked questions
I only have one person doing the books. How can I separate duties?
You become the second person at the points that matter: approving payments, reading the bank statement and reviewing payroll. Use your bank's dual authorization so that no payment leaves without your approval, and have an outside accountant reconcile the bank monthly. That alone removes most of the risk of a single bookkeeper controlling everything.
Will controls make my staff feel distrusted?
Present them as protection for everyone, including honest staff, who are otherwise the first suspects if money goes missing. Apply the same rules to yourself and to family members. Most employees welcome clear procedures because they remove ambiguity.
What should I do if I suspect fraud?
Do not confront the person immediately or alter records. Preserve evidence, restrict their access to systems and bank accounts, and get advice from your accountant, a fraud examiner or a lawyer before acting. Employment and privacy laws vary by country, and a mishandled investigation can create new problems. Report to your insurer if you have a crime or fidelity policy, since most have strict notice deadlines.
Does insurance cover employee theft?
Standard business insurance usually does not. Commercial crime or fidelity coverage can be added and is relatively inexpensive for small firms. Insurers typically require basic controls to be in place and expect prompt notice of any loss.
Related reading
The bottom line
Fraud in small businesses is common, expensive and usually simple. It happens where one person controls a process and nobody checks. The fix is equally simple: the owner reads the bank statement, two people are involved whenever money leaves, vendors and payroll changes are verified and staff have a safe way to speak up. Put those habits in place this month and review them once a year. They cost almost nothing and they protect the business you have built.
