A business owner trusted her bookkeeper completely. Nine years, never a problem. The bookkeeper handled everything — accounts payable, the check runs, the bank reconciliations, and vendor management. When a new CPA did a deeper review at year-end, he found that over four years the bookkeeper had created twenty-three fictitious vendors and paid each of them, signing the checks herself and reconciling the same bank account afterward. The total came to a hundred and seventy-eight thousand dollars. The bookkeeper had been trusted. The system had been nonexistent.
This isn't a rare story. The Association of Certified Fraud Examiners studies thousands of real cases every two years, and its 2024 report found that the typical organization loses an estimated five percent of revenue to occupational fraud annually, with a median loss of $145,000 per case. More than half of those cases traced back to weak internal controls or a lack of separation of duties — and smaller businesses, which tend to have the fewest controls, get hit the hardest as a percentage of revenue. The median fraud runs for about a year before anyone catches it. Every month it goes undetected, the loss compounds.
The most important defense is also the cheapest: separation of duties. The principle is simple — no single person should be able to both commit a transaction and conceal it. The person who creates new vendors should not be the same person who approves payments to them. The person who opens the mail and receives checks should not be the same person who records those payments in the books. And the person who reconciles the bank account should not have the authority to create or approve transactions, because their entire job is to catch discrepancies, and that job is compromised the moment they can also hide them. You don't need a big team to do this. Two people is usually enough to close the most common fraud vectors.
Beyond separating duties, a few low-cost controls go a long way. Set spending thresholds — small amounts can be approved by one person, but anything over a set dollar figure requires owner sign-off. Require owner approval for every new vendor, and review the full vendor list once a quarter, scanning for unfamiliar names, odd addresses, and round-number payments. That quarterly review takes about thirty minutes and is one of the most reliable fraud-detection tools available. Reconcile every bank account monthly, and have someone other than the person who prepared it review the result. None of this is an accusation against the people you trust. Good controls protect honest employees from suspicion as much as they deter dishonest ones. They take a few hours to put in place, and they stand between your business and a loss that averages six figures before anyone notices.