Financial Controls for Small Business Fraud Prevention

Financial controls for small business owners get dismissed as corporate overhead until something happens, and then they get bought at ten times the price. The uncomfortable arithmetic is that small South African businesses are more exposed than large ones, not less: one trusted person usually captures the invoice, loads the payment, reconciles the bank and files the paperwork, and nobody else ever looks at the full cycle.

This is not an argument for hiring a finance department. It is a set of controls that work with five people, cost almost nothing, and survive a resignation.

Why small teams are the easy target

Fraud needs three things: opportunity, pressure and rationalisation. An owner-manager can do almost nothing about the second and third, so every practical control attacks the first. In a small business, opportunity is concentrated because roles are concentrated. The bookkeeper who has been there eight years, who never takes leave, and whom nobody wants to insult with a check, is a description of concentrated opportunity, not a character judgement.

• One person owns the whole payment cycle from invoice to bank release.
• The owner reviews the profit, not the bank statement, so a payment that never touches profit is invisible.
• Supplier details are changed on an email request with no independent verification.
• Nobody else can run the payroll, so nobody else ever sees it.
• Reconciliations are prepared and reviewed by the same person, which makes them a formality.

Segregation of duties when you only have five people

Textbook segregation splits four roles: authorisation, recording, custody and reconciliation. You will not achieve that with five people, and you do not need to. Split the three that matter and accept a compensating review for the rest.

Payment authorisation that actually holds

A payment control is only as good as its weakest step, and in most small businesses the weak step is the beneficiary, not the amount. Approving a payment run without checking who is being paid is approving the total, not the transaction.

1. 1Three-way match before payment. Purchase order or approved request, delivery evidence, and the supplier invoice.
2. 2Approve the beneficiary list, not just the total. The approver should see payee names and account numbers.
3. 3Separate loading from releasing in the banking profile, with different credentials for each.
4. 4Set authorisation limits in writing, with a second approver above the limit, and no exceptions for urgency.
5. 5Never pay from a statement. Pay from invoices matched to the ledger, and reconcile the supplier statement separately.
6. 6Keep the payment pack. Approved payment schedule, proof of payment and supporting invoices, filed together.

The masterfile is where the money leaks

Supplier and employee banking details are the highest-value target in a small business, because a change there redirects legitimate payments without creating an unusual transaction. The invoice is real, the amount is right, the approval is genuine, and the money is gone.

• Verify every banking change by phone, using a number you already hold, never a number on the emailed letterhead.
• Require a second person to make the change after a different person has verified it.
• Log every masterfile change with date, requester, verifier and old and new details.
• Review the change log monthly alongside the payment listing.
• Treat employee banking changes the same way, and reconcile employee counts on every payroll run.

Detective controls to run every month

Preventive controls stop things happening. Detective controls tell you when one has failed. An owner can perform the useful ones personally, and they take under an hour if the monthly close is already producing clean output.

1. 1Read the bank statement line by line, not the summary, looking for payees you do not recognise.
2. 2Review the new supplier and new employee listing for the month.
3. 3Check the credit note and write-off listing, which is where a receivable fraud is hidden, and watch the debtors days trend.
4. 4Compare payroll cost to headcount and query any movement you cannot explain.
5. 5Look at round-rand and just-under-limit payments, which are the classic signatures of an amount tuned to avoid a second approver.
6. 6Confirm that reconciliations were prepared and reviewed by different people, and that reconciling items were cleared, not carried.

The control that catches most problems in a small business is not sophisticated. It is an owner who opens the bank statement personally every month and asks about one line they do not recognise.

Rishen Narsing, CA(SA)

Write it down, or it leaves with the person

An undocumented control is a habit, and habits do not survive resignations, illness or growth. A short finance policy covering authorisation limits, who may change banking details, how payments are approved, how leave is covered and who reviews what monthly, is usually five or six pages. It is also what an insurer, a lender and an auditor will ask for, and what makes audit readiness routine rather than annual panic.

Mandatory leave belongs in that document. Requiring every finance role to take a continuous block of leave each year, with someone else performing the duties, is one of the oldest and most effective controls in existence, because most schemes need constant maintenance to stay hidden.

How Synergy helps

Our process and policy service documents your finance procedures, system descriptions and authorisation framework, and assesses where duties are concentrated in a way you can actually fix with the team you have. Where the practical answer is to move the recording or the reconciliation work outside the business entirely, our outsourced finance service creates real segregation without another salary, because we do the recording and you keep the authorisation.