A small business prevents fraud and theft with five internal controls: separating financial duties so no single person handles a transaction from start to finish, requiring approval before money moves, reconciling bank and credit card accounts independently every month, limiting who can touch cash and accounting systems, and having someone outside the bookkeeping review the numbers on a regular schedule. Most theft inside a small business isn’t sophisticated. It happens because one trusted person controlled the money, the records, and the review, and nobody was checking the work. Here is what each control does and how to put it in place without slowing the business down.
Why small businesses are the target, not the exception
Smaller businesses run lean, and that’s exactly the problem. One person often makes the deposits, writes the checks, enters the bills, and reconciles the account. That concentration is what fraud needs to take hold. National fraud research has shown for years that businesses with fewer than 100 employees lose a larger share to fraud than big companies do, and the median loss runs well into six figures. The cause usually isn’t a bad hire. It’s a good hire given complete control with no structure around it. Internal controls are that structure, and most of them cost nothing but discipline.
Control 1: Separate financial duties
Segregation of duties means no single person controls a transaction from beginning to end. The person who writes the checks shouldn’t also reconcile the bank statement. The person who enters vendor bills shouldn’t also approve the payments. The person who opens the mail and logs customer payments shouldn’t also make the deposit and adjust the receivables ledger.
In a back office with three or four people, real separation is achievable. In a two-person shop it’s harder, and that’s where the owner has to stay in the loop. If one bookkeeper handles everything, the owner becomes the control by reviewing the bank statement and signing the larger checks personally. A contractor with a single office manager doesn’t need a second hire to be safe. The owner reviewing what the office manager can’t review on her own is the control.
Control 2: Require approval and documentation before money moves
Every payment should have a paper trail before it leaves the account: a purchase order, an invoice, or a signed approval. Set a dollar level above which a second person, usually the owner, has to approve the payment. Where you set that level depends on the business.
New vendors are where a lot of fraud starts. A fake vendor with a real-looking invoice is one of the oldest schemes there is, and it works because nobody questions a bill that looks routine. Approve new vendors yourself, and confirm there’s a real company behind the name before the first payment goes out.
Control 3: Reconcile accounts independently every month
Reconciliation catches what approval misses. The key idea is segregation of duties. The person who reconciles the bank and credit card accounts shouldn’t be the person who writes checks or makes deposits. The owner, or someone outside the payment process, opens the statement, reviews the cleared checks, and looks at who actually got paid.
This is where altered checks, unfamiliar payees, and duplicate payments surface. Online banking makes the monthly review straightforward, and it’s the single most effective thing a small business owner can do to catch theft early. Skip it for a few months and a small problem becomes a large one.
Control 4: Restrict access to cash, checks, and systems
Control who can physically and digitally touch the money. Lock up that stack of blank checks. Keep signing authority to as few people as the business can manage. Give each person their own login to the accounting system, with no shared passwords and permissions matched to the role. Remove access the day someone leaves, not the week after.
Company credit cards need the same attention. Each card tied to a named person, statements reviewed against receipts every month, and a quick conversation the first time a charge doesn’t have a clear business reason.
Control 5: Put a second set of eyes on the books
Even with the first four controls in place, someone outside the daily bookkeeping should review the numbers on a regular schedule. For many owners that’s a monthly look at the financial statements with their CPA. The point is to have someone who isn’t entering the transactions watching for patterns the bookkeeper might miss or might be hiding: vendor payments that don’t track with activity, payroll that doesn’t match the headcount, an expense category that keeps creeping up.
An outside CPA review, or a formal review or audit engagement when a lender or investor asks for one, adds a layer the in-house team can’t provide on its own. It’s not a sign you distrust your people. It’s the structure that lets you trust them.
Where compliance errors fit in
Fraud gets the headlines, but compliance errors quietly drain a business too, and they’re easier to commit by accident. Missed or late payroll tax deposits, sales tax collected but not remitted, 1099s never filed, workers misclassified as contractors. Each one carries penalties, and some carry personal liability for the owner.
Maryland adds its own obligations on top of the federal ones: the annual report and personal property return filed with the Maryland Department of Assessments and Taxation, state income tax withholding, and sales and use tax. The same controls already mentioned that help to catch theft, namely documentation, monthly review, and a second set of eyes, can catch these errors before they turn into a notice from the state.
Frequently asked questions
Q: Can accounting software like QuickBooks replace internal controls?
A: No. Software records what people enter, and it will record a fraudulent transaction as cleanly as a legitimate one. The controls live in who is allowed to do what, who approves it, and who reviews it. Software helps you run those controls, with separate logins and permission levels, but it doesn’t replace them.
Q: How do internal controls work in a two-person business?
A: When you can’t separate duties fully, the owner becomes the second set of eyes. That means personally reviewing the bank statement, signing the larger checks, and approving new vendors, even if a bookkeeper handles everything else. The structure shifts from separation to owner review, but the protection is the same.
Q: What are the warning signs that an employee might be stealing?
A: Common ones include a bookkeeper who won’t take a vacation or let anyone else touch the books, customer complaints about payments that were made but not credited, vendors you don’t recognize, and reluctance to share the bank statement. None of these proves anything on its own, but together they’re a reason to look closer.
Q: Does Maryland require a small business to have internal controls?
A: Maryland doesn’t impose a general internal-control requirement on small private businesses the way regulators do on public companies. But Maryland does require accurate tax filing and remittance, and weak controls are how those go wrong. Lenders, insurers, and buyers also expect to see real controls before they commit.
If you’re not sure which of these five controls your business actually has in place, that’s the first conversation to have. Strauss can help you to analyze how money moves through your business, show you where one person has too much control, and help you put the missing pieces in place. Reach out and we’ll start with a look at your current setup.