7 Bookkeeping Controls That Catch Employee Theft Before It Gets Expensive
Sam's List Editorial | 2026-07-30
Almost nobody who steals from a small business set out to steal from a small business.
Bookkeeping controls for employee theft exist because of that, not because you have a criminal on payroll. That is the part owners get wrong. They picture a criminal and conclude they do not have one, so they skip the controls. What actually happens is a trusted bookkeeper with a bad month who moves money intending to put it back, discovers nobody noticed, and does it again. The average small business fraud runs for a long time before discovery, and the reason is almost always the same: one person had the whole cycle to themselves.
Controls are not an accusation. They are the thing that lets you keep trusting people, because the system is doing the checking instead of your gut.
Here are seven that work at small scale.
1. Split the Cycle: The Bookkeeping Control for Employee Theft That Matters Most
The single control that matters most is that no one person can approve a payment, execute it, and reconcile it afterward. Fraud needs all three. Break any one link and most schemes stop being possible.
You do not need a department to do this. The minimum viable split at a five-person company usually looks like: the bookkeeper prepares and enters, the owner or a manager approves, and someone other than the preparer reviews the reconciliation. If the bookkeeper must both enter and pay, then the owner takes reconciliation review permanently.
The honest cost: this adds friction to every payment, and in a small business friction is measured in the owner's evenings. Decide which approvals genuinely need you and set a dollar threshold for the rest, rather than pretending you will review every fourteen dollar charge.
2. Open the Bank Statement Yourself, Unopened, Every Month
This is the cheapest control in existence and the one most often skipped.
The owner receives the bank and credit card statements directly, before anyone else touches them, and spends fifteen minutes looking at actual images of cleared checks and the payee list. Not the bookkeeper's summary. The source document.
What you are scanning for is narrow: payees you do not recognize, checks with a signature that looks off, round-dollar transfers to accounts you cannot name, and any payment to an individual rather than a business. You are not auditing. You are making it known that the raw data passes through your hands.
The limitation is real, though. Reviewing statements catches unfamiliar payees, and it does not catch a scheme built on payments to a vendor you already know. That is what the next control is for.
3. Lock Down the Vendor Master File
Fake vendors and altered payment details are the most common way money leaves a small business quietly, because the transaction looks completely normal in the general ledger.
Two rules fix most of it. First, adding a new vendor requires approval from someone who is not the person who requested it, plus a W-9 on file. Second, and more important, any change to an existing vendor's bank details or remit-to address requires verbal confirmation with a known contact at a phone number you already had, not the number in the email requesting the change.
That second rule is also your defense against business email compromise, which is now a bigger dollar risk for most small firms than internal theft is. The same control covers both.
Run a vendor list review once a year. Sort by payment volume, look for vendors with no address, vendors sharing a bank account with an employee, and vendors nobody in operations can identify.
4. Reconcile Payroll to a Headcount List
Payroll is the largest expense in most service businesses and the least reviewed, because the numbers are big, boring and roughly the same every cycle.
Once a quarter, print the payroll register and match it line by line against a list of people you can name. You are looking for employees who no longer work there, hourly totals that do not match the schedule, and unauthorized rate changes. If someone other than the owner can both add an employee and approve the payroll run, that gap is worth closing before anything else on this list.
Also check who is authorized to change direct deposit details, and require a confirmation step when they do.
5. Write a Card Policy With a Threshold You Will Actually Enforce
Expense and card abuse is usually small per transaction and large in aggregate, which is exactly the profile that survives review.
A workable policy has three parts: a receipt requirement above a threshold you set high enough to be enforceable, a rule that nobody approves their own expenses including the owner, and a monthly review of the card statement by category rather than by line item. Category review is what surfaces the pattern. Line-item review just makes you tired.
Watch the categories that are easy to hide inside: office supplies, software subscriptions, travel meals and fuel. Software is the current favorite, because a personal subscription looks identical to a business one.
6. Treat the Monthly Close as a Control, Not a Report
A real monthly close is a fraud control that happens to produce financial statements.
The close should include cash reconciled to the bank with no unexplained items, credit cards reconciled, accounts receivable and accounts payable aged and reviewed, and a variance explanation for anything that moved materially against last month. That last piece is the control. Someone has to say out loud why an expense category jumped, and "not sure" has to be an unacceptable answer.
Undeposited funds, an aging suspense account, old outstanding checks and journal entries with no description are the usual places problems accumulate. None of them are proof of anything. All of them are worth a question.
The trade-off worth naming: a fast close and a thorough close are in tension at small scale. Closing in five days with three open items is often better than closing in twenty with none, as long as the open items get named rather than buried.
7. Know What You Will Do in the First Hour
Most owners handle discovery badly, and it costs them the recovery.
Do not confront the person. Do not fire them on the spot. Do not send an accusatory email. Call an attorney first, then your insurance carrier if you have crime or employee dishonesty coverage, because most policies have notice requirements and evidence expectations that get violated in the first emotional hour.
Preserve access rather than cutting it, secure backups of the accounting file, and stop making changes to the records yourself. If you have an outside bookkeeper or accountant, loop them in for reconstruction, and understand that a bookkeeping firm is not a forensic accounting firm or a law firm, and should not be asked to be either.
Where an Outside Bookkeeper Fits Into Your Controls
Bringing in an outside firm is itself a control, because it puts a third party between the person recording transactions and the person who benefits from them.
Two honest caveats. An outside bookkeeper reduces opportunity but does not eliminate it, since someone inside still approves payments and controls banking access. And no bookkeeping arrangement is a guarantee against loss, which is why crime coverage exists as a separate product.
You can compare firms and their verified client reviews in the Sam's List bookkeeper directory before you have a reason to need one urgently.
Frequently Asked Questions
What is the most important internal control for a small business? Segregation of duties, meaning no single person can approve a payment, execute it, and reconcile the account afterward. Most theft schemes require control of all three steps, so breaking any one of them removes the opportunity. At very small headcount this usually means the owner permanently owns reconciliation review.
How can I set up controls with only two or three employees? Split the cycle rather than adding people. The owner approves and reviews reconciliations, the bookkeeper prepares and records, and vendor or payroll changes require a second confirmation. Outsourcing the bookkeeping function creates separation without a hire, since the record keeper is then outside the payment approval chain.
How long does small business fraud usually go undetected? Research on occupational fraud consistently finds schemes at smaller organizations run for a substantial period and cost proportionally more than at large companies, largely because small firms lack segregation of duties. The pattern matters more than any single statistic: detection usually comes from a review process or a tip, not from an accident.
What should I do if I suspect an employee is stealing? Contact an attorney before you contact the employee, then notify your insurance carrier if you carry crime or employee dishonesty coverage, since policies typically have notice requirements. Preserve records and system access rather than deleting or confronting, and get outside help for reconstruction. Acting emotionally in the first hour is what usually damages both the legal position and the insurance claim.
About the author: Kimberly Green is the cofounder of Sam's List, where business owners and high earners find vetted CPAs, financial advisors, and fractional CFOs. She's met one-on-one with 400+ financial professionals and writes from the real data behind thousands of client-advisor matches. Ask her anything about finding an accountant - she's heard it all, including the questions people are afraid to ask.