Preventing embezzlement comes down to layering internal controls so that no single employee can both move money and cover their tracks. The strongest programs combine three types of safeguards: preventive controls that block theft before it starts, detective controls that surface it quickly when prevention fails, and independent verification that confirms both are actually working. Organizations lose roughly five percent of annual revenue to occupational fraud, with median losses above $1.5 million per case, according to the Association of Certified Fraud Examiners.1Association of Certified Fraud Examiners. ACFE Report to the Nations: Organizations Lost an Average of More Than $1.5M Per Fraud Case The organizations that avoid becoming that statistic are the ones that design their controls deliberately and enforce them without exception.
Segregation of Duties Is the Core Control
If you build only one control, build this one. Three financial functions must sit in separate hands: authorization (who approves a transaction), custody (who physically handles the cash, checks, or inventory), and record-keeping (who enters the transaction into the books). When one person controls all three, they can take assets and rewrite the records to hide the theft. Large embezzlement cases almost always trace back to a breakdown in this separation, either because the roles were never divided or because employees colluded to defeat the split.
A concrete example shows why it matters. If the same clerk collects customer payments and posts them to the ledger, they can pocket a check and delete the invoice. No one else sees the mismatch. Split those tasks so one person opens the mail and logs incoming checks, a second deposits them, and a third reconciles the bank statement, and any single theft creates a discrepancy that surfaces during routine review.
What to Do in a Small Office
A five-person business cannot assign three separate people to every financial task. The answer is not to give up on segregation but to compensate for it. The most effective substitute is direct owner review: the owner personally opens the bank statements, examines canceled checks, and reviews vendor invoices every month. This work is not delegated to the bookkeeper. The whole point is that someone outside the transaction cycle looks at the output.
Other workable substitutes include requiring a second signature on all disbursements above a threshold, rotating duties so no one employee owns a process indefinitely, and running surprise cash counts. These are weaker than true segregation but far stronger than no control at all.
Authorization Limits and Screening at the Front Door
Requiring upper-level approval for transactions above a set dollar threshold guarantees that no single employee can move significant funds without a second set of eyes. The exact amount depends on the organization; the principle is that bigger transactions get more scrutiny. Two signatures on checks or wire transfers above that threshold adds friction that makes it much harder to redirect money quietly. Document every approval so auditors can later trace who authorized what, when, and why.
Screening candidates before they touch organizational assets is one of the cheapest fraud controls available. Employers typically verify education, employment history, and criminal records to flag past financial dishonesty. When a third-party screening company runs the check, the Fair Credit Reporting Act requires written disclosure to the applicant and their consent before the check is run.2Federal Trade Commission. Background Checks: What Employers Need to Know Pair the screening with a written code of conduct that new hires sign during onboarding. That signature closes off the “I didn’t know it was wrong” rationalization that shows up in so many later cases.
Physical and Digital Access Controls
Access controls work independently of every other layer. On the physical side, use safes, biometric or key-code locks, restricted areas for inventory, and cameras in high-risk locations like loading docks and cash rooms. Keys and entry badges go only to employees with a documented business need.
Digital access needs the same discipline. Every employee gets a unique login, and financial systems require multi-factor authentication: something the user knows plus something they have, like a hardware token or phone.3Cybersecurity and Infrastructure Security Agency. Multifactor Authentication Tier permissions so a junior accountant can view records but not edit them, and match manager access to actual responsibilities. Activity logs recording who accessed which records, when, and what they changed, create an audit trail that makes data manipulation far harder to hide. Automatic session timeouts add one more barrier on unattended workstations.4National Institute of Standards and Technology. Multi-Factor Authentication
Detecting Fraud That Slips Past Prevention
No preventive control catches everything. Detective controls exist to shorten the time between when a scheme starts and when it is discovered. The strongest programs combine financial monitoring, employee reporting channels, forced absences, and awareness of behavioral warning signs.
Monitoring and Variance Analysis
Variance analysis compares actual spending against the budget and flags gaps for follow-up. When a department’s supply costs jump 20 percent with no matching increase in output, that gap warrants a question. Monthly reviews of expense reports and corporate card statements catch personal purchases dressed up as business expenses. Accounting software can flag transactions outside normal ranges, but a person still has to read the report and act on it. Software without accountability is a more expensive version of no control.
Tip Lines
Tips are the single most common way occupational fraud is discovered, accounting for about 43 percent of initial detections in ACFE’s study, nearly three times more than the next method, internal audits.1Association of Certified Fraud Examiners. ACFE Report to the Nations: Organizations Lost an Average of More Than $1.5M Per Fraud Case Anonymous hotlines and online reporting portals give employees, vendors, and customers a way to come forward. A hotline only works if the protection behind it is real. For publicly traded companies, the Sarbanes-Oxley Act prohibits retaliation against employees who report suspected securities fraud, with remedies including reinstatement, back pay, and legal fees. Without credible protection, people stay quiet, and schemes that could have been stopped in months run for years.
Mandatory Vacations
Requiring employees in sensitive financial roles to take at least two consecutive weeks off is one of the most underused fraud detection tools. Most schemes need the perpetrator’s daily presence to keep the manipulation going. When a substitute processes the work, transactions that do not add up come to light. The Federal Reserve has recommended this practice for banking employees for decades.5Federal Reserve. Supervisory Guidance on Required Absences from Sensitive Positions For the policy to work, the absent employee must lose remote access to systems and records during the leave. If they can log in from home or ask a colleague to process transactions on their behalf, the control is defeated. It works just as well outside banking, in any organization where employees handle money or financial records.
Behavioral Warning Signs
Financial data is not the only signal. ACFE research found that 85 percent of fraud perpetrators displayed at least one behavioral red flag while committing the fraud.6Association of Certified Fraud Examiners. Report to the Nations 2020 – Behavioral Red Flags of Fraud The most common:
- Living beyond means, visible in 42 percent of cases: new cars, expensive vacations, or purchases inconsistent with salary.
- Financial difficulties, present in 26 percent of cases.
- Unusually close relationships with vendors or customers, seen in 19 percent, often a marker of kickback or billing schemes.
- Unwillingness to share duties or take time off, found in 15 percent of cases, because daily access is what keeps the cover-up going.
No single flag proves anything. But when the employee who insists on handling all the billing also starts driving a car they clearly cannot afford, that combination is worth a closer look. Train managers to notice these patterns and give them a clear reporting path.
Independent Audits and Reconciliation
Every control described so far can rot from neglect if no one independently checks it. Independent verification is the backstop that catches both the theft and the control failures that let it happen.
Bank reconciliations should be done by someone with no authority over the accounts and no role in recording transactions. When the person who writes checks also reconciles the statement, both errors and theft disappear from view. Physical inventory counts should be run by an audit team rather than the employees who manage that inventory day to day. Discrepancies between the books and the shelves are one of the most reliable signs of a long-running theft scheme.
Publicly traded companies face a specific mandate under Section 404 of the Sarbanes-Oxley Act: management must assess and certify the effectiveness of internal controls over financial reporting each year, and an external auditor must independently evaluate that assessment. Private companies and nonprofits are not legally required to do this, but periodic outside audits still help. Employees who know an outside accountant will review their work behave differently than employees who believe no one is watching.
Investigating a Suspected Case Without Creating New Problems
How you investigate matters as much as what you find. A sloppy investigation can produce defamation claims, wrongful termination suits, and evidence problems that ruin any chance at prosecution or recovery. Bring legal counsel in from the first hour of a serious suspicion, not after decisions have been made.
Two rules deserve specific attention. First, the Employee Polygraph Protection Act generally bars private employers from requiring lie detector tests. A narrow exception exists for ongoing investigations of specific economic losses like theft or embezzlement, but it requires reasonable suspicion based on observable, articulable facts pointing to the specific employee. Access or opportunity alone does not qualify. The employer must give the employee a written statement at least 48 hours before the exam identifying the specific loss, the employee’s access to the property, and the factual basis for suspicion.7eCFR. 29 CFR 801.12 – Exemption for Employers Conducting Investigations of Economic Loss or Injury Random testing and fishing expeditions are prohibited, and missing any condition strips the statutory authority for the test.
Second, accusations carry defamation risk. Even the appearance of an accusation counts; escorting someone out with security in front of coworkers can imply criminal conduct without a word being said. Internal investigation reports and discipline letters generally enjoy a qualified privilege from defamation claims when made without malice and shared only with people who have a legitimate need to know. That privilege disappears if the employer acts with ill will or discusses the accusation beyond that circle. Truth is an absolute defense, but you need confidence in your facts before making formal accusations.
Recovering Losses After the Fact
Getting stolen money back is much harder than preventing the theft. Most embezzlers spend what they take, and a criminal conviction does not guarantee the victim sees a dollar. Realistic recovery usually means pursuing multiple channels at once.
A commercial crime insurance policy, sometimes called a fidelity bond, reimburses direct losses from employee dishonesty, including theft, unauthorized transfers, forgery, and social engineering fraud. Coverage typically includes on-premises and in-transit theft of money and securities. These policies do not cover losses of intangible items like data, trade secrets, or proprietary information. The time to buy this coverage is before anything happens; organizations that discover they have no crime policy after a major theft have already made the most expensive mistake in the sequence.
Criminal courts can order restitution to the victim as part of sentencing, but restitution orders are notoriously hard to collect when the perpetrator has no remaining assets. A parallel civil lawsuit for fraud or conversion opens remedies the criminal case does not, including pre-judgment asset freezes, garnishments, and claims against third parties who knowingly benefited from the stolen funds. If insurance or a civil settlement has already paid out, a criminal court may credit that amount against the restitution order to prevent double recovery. Running both tracks generally gives the best chance of recovering at least part of the loss.