The standard advice does not fit
Separating authorisation, custody and recording requires at least three people in finance. Most small businesses have one, often part-time. Pretending otherwise produces a control framework nobody follows.
Compensating controls that work
- The owner reviews the bank statement directly, from the bank, not from a report prepared by the person being checked.
- Dual authorisation above a threshold for payments.
- New vendor setup approved by someone other than the person entering invoices.
- Payroll changes reviewed by someone outside payroll processing.
- Monthly review of the vendor list for unfamiliar names.
The highest-risk gaps
The combinations that cause most small business fraud are one person who can both create a vendor and approve payment to it, and one person who both receives cash and records it. If you address nothing else, address those two.
Why the owner review matters most
A bank statement reviewed independently by the owner catches most schemes, because almost every scheme eventually requires money leaving the bank. It takes fifteen minutes a month and is the single highest-value control available to a small business.
Document what you do
Controls that exist only as habits disappear when people change roles. Writing them down, even briefly, is what makes them survive turnover.
TallyWise provides this as part of our bookkeeping services. Book a call to talk through your situation.
