Stopping employee theft before it starts: internal controls for a small office

Split the duties and keep a second set of eyes

The most effective protection is making sure no one person controls a financial transaction from start to finish. Separate who approves, who records, who handles the money and who reconciles; require approval for payments; have someone other than the preparer review the bank reconciliation; count and safeguard assets periodically; and give people a way to report concerns. Even a two-person office can do most of this if the owner or a board member opens the bank statements and reviews the reconciliation every month.

Internal controls are a service area at Malnory, McNeal & Company, and in my audit and assurance work I see both sides: organizations where simple controls caught a problem early, and organizations where one capable, trusted person handled everything for years. This guide covers the controls that matter most for a small office. It is general information; if you suspect something is already wrong, talk to an attorney and a licensed CPA before taking action.

Why trusted people are where the risk sits

Theft inside a small business or nonprofit rarely involves a stranger. It usually involves someone with access and the confidence of the owner or board, often a long-serving bookkeeper or office manager who handles everything because they are good at it. That is not a reason to distrust your staff. It is a reason to design the work so that nobody is placed in a position where a mistake or a temptation can go unnoticed.

Good controls also protect honest employees. When the bank account does not reconcile or money seems to be missing, a system with clear duties and records shows quickly what happened and who was involved. Without it, suspicion spreads to everyone who had access. Our firm puts the message plainly on its internal controls page: do not let employee fraud be the downfall of your business.

Tone matters as much as procedure. When the owner or executive director visibly reviews statements, asks about unusual items and follows the same approval rules as everyone else, staff understand that the controls are normal business practice, not a sign of suspicion. When leadership skips its own rules, everyone notices, and the controls weaken.

The one-person problem, and how to divide the work

The core idea is segregation of duties. The person who can authorize a payment should not also record it and reconcile the account it came from. The person who receives customer checks or donations should not also post them to the books and prepare the deposit without review. When those roles combine, a single person can create a transaction and hide it.

In a small office, perfect separation is often impossible. The workable answer is to split what you can and add review where you cannot. If one employee must handle payables, receivables and reconciliations, the owner or a board member reviews the reconciliation, the bank statement and a list of new vendors every month. That review is the control.

• Authorizing a purchase or payment.
• Recording the transaction in the books.
• Holding the asset: cash, checks, inventory, the company card.
• Reconciling the account against the bank or a physical count.
• Assign at least one of these to someone other than the person who does the rest.

Controls that work with a tiny staff

These controls cost little and catch a great deal. Each one either separates a duty or adds an independent look. Pick the ones that fit your operation and write them down so they survive staff changes.

Ask your bank what it offers, too. Many banks provide services that add a check outside your office, such as requiring a second user to release wires and electronic payments, alerts for transactions above an amount you set, and tools that match presented checks against a list of checks you actually issued. These features are often inexpensive compared with what they prevent, and they do not depend on anyone remembering to look.

• Bank statements go directly to the owner or treasurer, or that person has their own online access and reviews activity monthly.
• Every payment above a set amount requires a second approval or signature.
• New vendors and changes to vendor bank details are approved by someone other than the person who pays bills.
• The owner reviews the payroll register each pay period for unfamiliar names and unusual amounts.
• Company credit card statements are reviewed by someone other than the cardholder, with receipts attached.
• Inventory, equipment and petty cash are counted periodically by someone who does not keep those records.

Warning signs worth a closer look

None of these proves anything on its own, and most have innocent explanations. But each is worth a calm, closer look, and several together deserve attention. If you notice them, review the records quietly before drawing conclusions.

• Reconciliations that are always late, or reconciling items that never clear.
• An employee who never takes vacation or resists letting anyone else cover their work.
• A vendor nobody recognizes, or a vendor address that matches an employee's.
• Rising write-offs, refunds or voided transactions without clear reasons.
• Missing receipts, altered documents or copies where originals should exist.
• Payroll costs that do not track headcount, or overtime that does not match the work.

Nonprofits carry extra exposure

Nonprofits face the same risks as businesses plus a few of their own. Cash donations at events, volunteers with access to funds, restricted gifts that must be spent as the donor intended, and small staffs with heavy workloads all create openings. Boards also carry fiduciary responsibility for the organization's assets, which makes oversight a governance issue, not only an accounting one.

Cash collected at events deserves its own procedure. Two unrelated people should count it together, sign a count sheet and keep it together until it is deposited, and the count sheet should go to someone who later compares it with the bank deposit. Prenumbered receipts or ticket stubs make it possible to check that what came in matches what was recorded. Donation checks should be logged when the mail is opened, before they reach the person who records them.

Organizations that receive federal awards have a specific obligation. Under 2 CFR 200.303, recipients and subrecipients must establish, document and maintain effective internal control over the federal award, and those controls should align with the federal Standards for Internal Control, known as the Green Book, or the COSO Internal Control framework. Even without federal money, those frameworks are a sensible reference. If you are working out whether your organization needs an audit at all, whether a nonprofit needs an audit explains the triggers.

What an internal controls assessment involves

When our firm assesses internal controls, we look at how transactions actually flow through the organization: who approves, who records, who handles assets and who reviews. We test the existing controls, identify weaknesses and deliver a report with practical recommendations. Typical recommendations include separating duties, requiring approvals, having someone other than the preparer review and reconcile records, safeguarding and counting assets, training employees, creating a channel for reporting concerns and documenting policies.

An audit produces some of the same insight. At the end of an audit engagement, the auditor often provides a letter describing control weaknesses noticed during the work. For many clients that letter is the most useful product of the first year, as I explain in what audited financial statements involve. An audit is not designed primarily to find fraud, though, so a targeted controls review is the better tool when prevention is the goal.

If you suspect something now

Resist the urge to confront the person right away. A confrontation without facts can lead to destroyed records, a wrongful accusation or legal trouble for you. Instead, quietly preserve records, including bank statements, accounting file backups and emails, and limit any new access to accounts if you can do so without alerting anyone. Then call an attorney and a CPA to plan the next steps together.

Keep the circle small while you look. Tell only the people who need to know, document what you find with dates, and avoid discussing it by email on systems the person may be able to read. If the review confirms a loss, your attorney can advise on reporting it to law enforcement and on recovering what was taken.

Check whether your insurance includes coverage for employee dishonesty, and read its notice requirements, since many policies set deadlines for reporting a loss. Payroll is a common area for manipulation, from unauthorized raises to unpaid withheld taxes, so review it carefully; the payroll tax mistakes that create personal liability explains why unpaid payroll taxes are especially serious.

Making controls part of the routine

Controls only work if they keep happening after the first month. Write them down in a short policy, assign each review to a named person, and put the monthly reviews on the calendar. Revisit them when staff changes, when the organization grows or when you add a new location, account or funding source. Cross-train so that someone else can step in when the bookkeeper takes vacation, and make sure that person actually does.

If you want an outside assessment, our Dallas office works with businesses and nonprofits across the Dallas–Fort Worth area, and our Paris, Texas office serves Northeast Texas. We will look at how your money actually moves, test the controls you have and give you a short list of changes sized to your staff. The goal is not suspicion; it is a system where honest mistakes are caught quickly and dishonest ones are hard to hide.

Questions people ask me