The answer first
Most fraud in small businesses is not sophisticated. It happens because one trusted person controls a whole process (ordering, approving, paying and recording) and nobody checks. A handful of simple internal controls prevents most of it, and catches errors as well as dishonesty.
Separate duties so that no single person can both make and conceal a payment, and reconcile every bank account monthly with someone else reviewing it. Directors remain responsible for the company's records and assets; delegating the work does not delegate the responsibility.
Ten controls every SME should have
| Control | Why it matters |
|---|---|
| 1. Two-person approval for payments above a set limit | Stops a single person moving money alone |
| 2. Separate set-up of new suppliers from payment approval | Prevents fictitious suppliers and changed bank details |
| 3. Verify supplier bank detail changes by phone on a known number | The most common payment fraud is a fake "change of bank details" email |
| 4. Monthly bank reconciliations, reviewed by someone else | Catches unrecorded or unusual transactions quickly |
| 5. Payroll changes approved by a manager outside payroll | Prevents ghost employees and unauthorised pay rises |
| 6. Regular review of customer balances and credit notes | Detects diverted receipts and unauthorised discounts |
| 7. Stock counts and comparison with records | Reveals theft, waste and recording errors |
| 8. Expense claims with receipts, approved by a line manager | Limits personal spending on company accounts |
| 9. Access controls on accounting and banking systems | Each user has their own login and only the rights they need |
| 10. Monthly management accounts reviewed by the owner | Unusual movements are spotted early |
Key takeawayIf one person in your business could pay a supplier, change the supplier's bank details and record the transaction without anyone else seeing, that is your first control to fix.
Warning signs
- Someone who never takes leave or resists sharing their work.
- Bank reconciliations that are late or have unexplained items.
- New suppliers with addresses or bank accounts that match employees.
- Rising costs or falling margins that nobody can explain.
- Customer complaints about payments the company says were not received.
- Urgent payment requests by email from "senior management", especially outside office hours.
If you suspect fraud
| Do | Do not |
|---|---|
| Secure records and system access quietly | Confront the suspected person before evidence is secured |
| Contact your bank immediately if funds have been sent | Delete emails or alter records |
| Take legal advice on reporting and employment steps | Discuss suspicions widely inside the business |
| Consider an independent investigation | Assume the loss is limited to what you have found |
Please noteSpeed matters with payment fraud: funds can sometimes be frozen if the bank is told quickly. Police reports and legal steps should follow professional advice.
Self-check: where do you stand?
| Question | If the answer is no |
|---|---|
| Do two people approve larger payments? | Set a limit and require a second approver |
| Are supplier bank changes verified by phone? | Introduce a call-back rule today |
| Are bank reconciliations reviewed by someone other than the preparer? | Assign a reviewer each month |
| Does each system user have an individual login? | Remove shared logins |
| Are payroll changes approved outside payroll? | Require manager sign-off |
| Does the owner review monthly management accounts? | Schedule a monthly review |
How DBMS Global can help
- Monthly bookkeeping and bank reconciliations, so that exceptions are visible.
- Payroll processed with independent checks.
- RENT-CFO reviews and designs internal controls, strengthens finance processes and carries out fraud investigations when something has gone wrong.
Official references
- Hong Kong Police Force: Anti-Deception Coordination Centre, www.adcc.gov.hk
- Companies Ordinance (Cap. 622), section 373: accounting records