Internal fraud in small business is common, usually committed by a long-serving trusted employee, and typically continues for years before discovery. The reason is structural rather than moral: small businesses concentrate incompatible duties in one person because they cannot afford to separate them.
The conditions that enable it
Fraud generally requires opportunity, some pressure or motivation, and the ability to rationalise it. The only one an employer controls is opportunity, and it is created by:
- One person handling both the transaction and the reconciliation.
- Nobody reviewing bank statements independently of the person who prepares them.
- The owner not looking, because the person is trusted and the reporting looks fine.
- No holiday cover — the employee who never takes leave is a genuine warning sign, because a substitute would notice.
The separations that matter most
Full segregation of duties is impossible in a small business. These four separations do most of the work:
- Whoever enters supplier invoices should not be able to approve payments alone. Payment authorisation by a second person, ideally the owner, on anything above a low threshold.
- Whoever handles receipts should not do the bank reconciliation.
- Whoever sets up a new supplier should not be the only person who can pay one. Fictitious supplier fraud depends on that combination.
- Whoever processes payroll should not be able to add an employee unilaterally.
In a very small business the second person is the owner. That is sufficient provided the owner genuinely looks.
What the owner should look at personally
Fifteen minutes a month, and it should not be delegated:
- The bank statement, directly from the bank rather than a report prepared internally. Scan for payees you do not recognise.
- New suppliers added since last month, and who added them.
- Changes to supplier bank details — the single highest-risk transaction type in any business.
- The payroll register, checking the names against people who actually work there.
- Credit notes and write-offs, which are how receipts fraud is concealed.
- Petty cash and expense claims above a threshold.
Bank detail changes: the rule that prevents most loss
Invoice fraud is the most common way New Zealand businesses lose material sums. An attacker compromises email, watches the conversation, and sends an invoice with altered bank details at the right moment.
Verify every change of bank account details by phone, using a number you already hold, before paying. Not by replying to the email. Not using a number on the invoice.
Make it a rule that applies to everyone including the owner, and make it socially acceptable for a junior staff member to enforce it against a director. The businesses that lose money are usually the ones where someone felt unable to question an instruction.
Multi-factor authentication on email is the other essential control, because email access is what enables the whole attack.
Other controls that cost nothing
- Mandatory annual leave with someone else covering the role. Fraud requiring continuous concealment is frequently discovered during a substitute’s week.
- Rotating duties where practical.
- Two signatures above a threshold, genuinely applied rather than pre-signed.
- Dual authorisation in online banking, which most business banking supports.
- Regular stocktakes, cycle counted rather than annual, by someone other than the person controlling stock.
- Reference and qualification checks on hire for anyone in a finance role.
Reconciliation is the detection mechanism
Most concealment fails at reconciliation. Bank, debtor, creditor, stock and payroll reconciliations performed monthly and reviewed by someone independent of the preparer detect the majority of internal fraud.
The failure mode is reconciliations prepared and never reviewed, or reviewed by the same person who prepared them.
If you find something
- Do not confront immediately. Preserve evidence first, including system access logs and documents.
- Take advice — legal and accounting — before acting.
- Follow a fair process if employment action is contemplated. Even where misconduct seems obvious, dismissal requires substantive justification and procedural fairness, and getting that wrong produces a personal grievance on top of the loss.
- Consider your insurer. Fidelity or crime cover may respond, and policies typically require prompt notification.
- Report to police where the amount warrants it. The Serious Fraud Office handles serious and complex fraud.
- Fix the control gap, since the same weakness will otherwise be exploited again.
The uncomfortable framing
Controls are not an accusation. They protect honest employees from suspicion as much as they prevent dishonesty, and a good employee in a finance role generally welcomes them for exactly that reason.
The Serious Fraud Office publishes counter-fraud guidance under CC BY, CERT NZ publishes material on invoice fraud and business email compromise, and business.govt.nz publishes financial controls guidance. All free.
General information only, not legal advice.
