Theft From Inside: The Controls Small Businesses Skip

Our payment fraud guide covered the deception that comes from outside. This one is harder to talk about. Internal fraud is usually committed by a long-serving, trusted employee, runs for years before anyone notices, and is enabled by a single condition: one person holding a process from beginning to end. It's almost never the new hire. It's the person who's been handling it alone since the business was small, whose reliability is precisely why nobody checks. The controls that prevent it are unglamorous and cheap, and the genuinely difficult part is putting them in without treating people as suspects.

The enabling condition

One sentence carries most of this guide: if the same person can move money and record what happened, nothing in your business will surface a diversion.

A complete chain looks like this:

Step	Who should do it
Create a payee or vendor	Approved by the owner
Set up a payment	Staff member
Release the payment	Someone else
Record it in the books	Staff member
Reconcile the account	Someone else
Review the statements	The owner

Break the chain at any point and most of the opportunity disappears. You don't need all six separated — that's unachievable with three staff and it isn't necessary. One break is enough to make ongoing concealment hard.

Which is why this is a solvable problem at small scale, and why the usual response — "we're too small for controls" — has the logic backwards. Small businesses are where the condition is most common and where breaking it is cheapest.

How it actually happens

Knowing the methods tells you where to look.

• Fictitious vendors. A payee is created that looks legitimate and the payments go to an account the employee controls. Per our cash management guide, new payees are the single highest-risk event in payment operations.
• Payroll additions — a fictitious employee, or inflated hours.
• Diverted receipts. Payments taken and not recorded, which per our reconciliation guide is why sales-to-deposit reconciliation matters.
• Expense inflation — personal purchases, duplicated reimbursements.
• Card misuse on a business card with no review.
• Refund and void abuse, per our refunds guide — processing a refund to a card the employee holds.
• Inventory, where goods rather than cash move.
• Payment redirection, where a legitimate supplier's details are altered — which looks identical to the external fraud in our payment fraud guide.

The first two are the most common and the most preventable, because both leave a permanent record you can review in minutes: a list of who you pay. Most owners have never looked at theirs.

And note the concealment pattern that runs through all of them. Each requires ongoing effort to hide — a reconciliation adjusted, a statement intercepted, a record altered every month. That's the property the absence control below exploits.

Separation with three people

The objection is always headcount. The answer is the owner's minutes, not a hire.

Separation achievable at any size:

• The owner approves new payees and vendors. One message, a few seconds, and it breaks the fictitious vendor method entirely.
• The owner reviews the payroll list periodically — names, amounts, accounts.
• The owner releases payments above a threshold, or dual authorization applies.
• The person who reconciles is not the person who records, even if the second person is the owner or the accountant.
• The owner sees the bank statements, below.
• The accountant reviews independently, per our bookkeeping guide — an outside party is a separation of duties even with one employee.

None of these requires a person you don't have. They require perhaps thirty minutes a month from the owner, which is the cheapest control in this guide and the one most often skipped because delegation was the point of hiring.

And the tiered account structure from our cash management guide does independent work here: an operating account holding only what's needed caps the maximum loss from any internal event, the same way it caps external ones.

The ten-minute control

If you implement one thing: the owner opens the bank statements, unopened by anyone else, and looks at them.

Why this specific habit is disproportionately effective:

• Every method eventually shows in the bank account. Money that left the business left through there.
• Concealment usually operates on the books, not the bank. An employee can adjust a ledger; they can't adjust what the bank records.
• So comparing the bank to the books is where a discrepancy appears — and if the same person does both, nobody ever compares.
• It takes ten minutes and requires no accounting knowledge.

What to look at:

1. Every payee you don't recognize.
2. Payees with similar names to real suppliers.
3. Round-number payments and repeated identical amounts.
4. Payments just under any approval threshold you've set.
5. The payroll total, against what you expect.
6. Transfers to accounts you don't recognize.

Item four is the one that catches deliberate structuring. A pattern of payments at $4,900 against a $5,000 threshold is not a coincidence, and it's visible to anyone reading a statement.

Why time off is a control

The control that feels like a benefit and functions as a detection mechanism.

Ongoing concealment requires ongoing attention. A diversion that needs a monthly reconciliation adjusted, a statement intercepted, or a query deflected can't survive an absence.

Which is why requiring that anyone handling money take consecutive time off — with someone else covering the role — is a genuine control. The features:

• It must be consecutive, long enough for a cycle to pass.
• Someone else must actually do the work, not let it accumulate.
• It applies to everyone, which removes any suggestion of suspicion.
• It's presented as a policy, not as a request.

And the behavioural signal is as valuable as the control. An employee who never takes leave, insists on handling things personally while away, or resists coverage may simply be conscientious — and it's also the most consistently reported pattern in these cases. It isn't evidence of anything. It's a reason to make sure the policy applies.

The arrangement has an independent benefit worth stating: it's the same cross-coverage our continuity guide argues for, so a business that implements it has solved two problems with one policy.

What to notice

Handled carefully, because none of these is evidence and treating them as accusation causes real harm.

Process signals, which are the ones to act on:

• One person controlling a process end to end.
• Reluctance to share access or cross-train.
• Reconciliations consistently late or adjusted.
• Missing documentation for specific transactions.
• Supplier queries about payments you thought were made.
• Customer disputes about payments you have no record of.
• Margins declining with no operational explanation.

The fifth and sixth are the ones that surface from outside, and they're frequently the first indication. A supplier chasing an invoice you believe was paid is worth tracing rather than resolving.

Personal signals are different and should be handled with care. Financial pressure, lifestyle changes, or unusual attachment to a role appear in accounts of these cases and are also entirely ordinary in people who've done nothing. The right response to any of them is to check that your controls apply — never to investigate a person. Per our disclosure analysis, financial difficulty is common and treating it as a suspicion signal is both unfair and unreliable.

Introducing controls without insult

The genuinely hard part, and where implementations fail.

What works:

• Apply everything to yourself too. If the owner's payments need a second look, the policy is about the business.
• Introduce it as growth — "we're putting in the processes a business this size should have" — which is true.
• Say it protects them. A person handling money alone with no oversight cannot demonstrate they did nothing wrong when something goes missing, and that's a real exposure to them. Controls give an honest employee an alibi.
• Introduce it at a natural moment — a new system, a new hire, an accountant's recommendation.
• Don't explain it as a response to anything, because that's how it reads as an accusation.
• Don't exempt anyone, including the longest-serving person — an exemption defeats the control and signals the hierarchy of suspicion you were avoiding.

The third point is the honest argument and it lands. Most employees understand immediately that sole control over money is a position they'd rather not be in.

If you find something

Brief, because this needs professional help rather than a guide.

1. Don't confront anyone. Per our incident guide, early confrontation destroys evidence and prompts concealment.
2. Call an attorney first. Employment law, evidence handling, and any reporting question all run through them, and the order of steps matters.
3. Call your accountant, about scope.
4. Preserve everything — records, access logs, statements. Don't tidy.
5. Restrict access carefully, on advice, since abrupt removal signals what you know.
6. Notify your insurer, since coverage typically requires prompt notice and may exist where you didn't expect it.
7. Establish the period and the amount before deciding anything.

Step two is the one to take seriously. The sequence of actions after discovery affects employment exposure, insurance coverage, and any recovery — and it's a sequence owners routinely get wrong in the first hour because the discovery is personal as well as financial.

Frequently asked questions

---

This guide is educational and does not constitute legal, accounting, insurance, or employment advice. Employment law, evidence handling, reporting obligations, and insurance coverage in cases of suspected internal fraud vary substantially by jurisdiction and circumstance, and the order in which steps are taken can affect both exposure and recovery. Consult a qualified attorney before acting on any suspicion, and never treat the indicators described here as evidence about an individual.