Separate the jobs where you can
The classic idea is that no single person should handle a transaction from start to finish. The one who approves a payment should not be the one who records it, and neither should be the person who reconciles the bank account. Even if you have only a bookkeeper and an owner, you can split them: the bookkeeper enters bills, the owner approves and signs, and someone independent reviews the bank statements.
If that is not possible, the owner should personally review the key reports, especially the bank statement and the vendor list.
Control access to bank and software
Give each person their own login and the lowest level of access needed. Turn on two-factor authentication. Remove access immediately when someone leaves. Do not share the online banking password, and limit who can add a new payee or change bank details.
Review the user list quarterly. Old accounts for former staff or past bookkeepers are an open door.
Approvals and limits
Set a written approval rule, such as owner sign-off on any payment over a chosen amount, and any new vendor. Require invoices or receipts for all payments. Use purchase orders for larger buys.
For card spending, set per-card limits and review statements as they arrive, not just at month end.
Independent review
Have someone other than the person who does the day-to-day books look at the monthly bank reconciliation, the vendor list and the payroll register. They are checking for unfamiliar names, round-number payments, duplicate vendors and payments to employees outside payroll. This takes under an hour a month.
If the owner does the books, ask your CPA or an outside bookkeeper to perform a periodic review, as a second pair of eyes.
Make the controls part of routine
Write the rules on a single page and share it. People follow rules they understand. Take vacations: a person who is never away may be hiding something, and a replacement will notice irregularities.
Controls cost time but they also protect honest employees from suspicion. Revisit them once a year as the business grows, and add steps when volume or headcount rise.
Controls for cash and card payments
Cash-heavy businesses need a few extra steps. Count the till at open and close, with two people signing when possible. Deposit receipts intact and promptly, and compare daily sales reports to deposits. For card terminals, restrict refund permissions and review refund reports weekly, since refunds to a personal card are a classic scheme. These steps cost almost nothing and they send a clear message that records are checked.
Document your controls briefly and test them. Once a year, ask a trusted outsider to try the process: submit a fake invoice from a new vendor and see whether it gets approved without questions. If it does, you have found a gap before a dishonest person does.
Worked example with numbers
A five-employee office sets three rules: the bookkeeper cannot sign checks, the owner reviews the bank statement monthly, and payments over $1,000 need a second approval. The cost is about an hour a month. One missing control, such as the same person paying and reconciling, is where most small losses start.
Mistakes that cost money
Trusting without verifying. Sharing logins. Unlimited card access.
Check your work
List who can approve, pay, record and reconcile. Any name appearing in all four is a risk.
Common questions
Is a small business really at risk of fraud?
Yes. Small firms often lose a larger share to fraud because they have fewer controls and more trust.
What is the most valuable single control?
Owner review of the bank statements and reconciliation each month.
Do controls slow things down?
Slightly, but a few minutes of review prevents far costlier problems.
This guide is general information, not tax, legal or accounting advice. Rules, fees and due dates change; check with the IRS, the NJ Division of Taxation or a licensed professional for your situation.