To prevent fraud in accounting, build oversight into daily financial operations so that no single employee can move money, record the transaction, and reconcile it alone. The controls that do the heaviest work are unglamorous: split responsibilities among different people, restrict who can access financial systems, verify transactions independently, and give employees a safe channel to report what looks wrong. Tips and routine audits catch more fraud than any other method, and weak or absent controls remain the leading organizational vulnerability in roughly a third of reported cases.
Separate Who Approves, Who Records, and Who Holds the Money
The single most important structural control is making sure no one person can complete a financial transaction from start to finish. Every transaction cycle should be split among at least three functions: authorization (who approves it), record-keeping (who enters it into the books), and custody (who handles the money or asset). The employee who approves a vendor payment should not be the same person who enters it in the ledger or signs the check. When those roles overlap, it becomes trivially easy for someone to create a fake payment and pocket the proceeds.
Building this out in practice means mapping every accounting function to a specific role and looking for dangerous overlaps. The person who prepares payroll should not distribute checks or maintain the employee master file. The person who opens the mail and logs incoming payments should not post those payments to customer accounts. Cross-referencing duties this way creates a web of accountability where fraud requires collusion between at least two people, which is far harder to sustain and far easier to detect.
Compensating Controls for Small Teams
Full segregation is a luxury many small businesses cannot afford with three or four employees wearing multiple hats. When you lack the headcount to split every function cleanly, compensating controls fill the gap. The most effective compensating control is direct owner or senior-leader review. The owner personally reviews bank reconciliations, approves new vendor setups and any changes to vendor bank details, and periodically spot-checks receivables adjustments and expense reports. The goal remains the same: no single person controls a transaction from beginning to end without someone else looking at it.
Documented approvals matter here more than anywhere else. When you cannot physically separate who does the work, creating a written record that a second person reviewed it is your fallback. Even something as simple as the owner initialing the bank reconciliation each month creates an audit trail that discourages and reveals manipulation.
Lock Down System Access
Every employee who touches financial systems needs a unique login, a strong password, and role-based permissions that restrict what they can see and do. The accounts payable clerk has no reason to access general ledger journal entries. The payroll specialist has no reason to view vendor master data. Locking permissions down to each person’s actual job duties limits the damage any single compromised or dishonest account can cause.
Multi-factor authentication adds a second barrier beyond the password. NIST’s authentication framework defines three assurance levels, and financial systems handling sensitive data should operate at least at Level 2, which requires two distinct factors: something you know (a password) and something you have (a hardware token or phone-based authenticator).1NIST. Authenticator Assurance Levels For the highest-risk functions like wire transfers or general ledger adjustments, Level 3 introduces hardware-based authenticators with additional protections against phishing and credential theft.
Physical controls matter just as much. Blank check stock, company credit cards, and petty cash should sit in a safe that requires two people to open. Every check’s serial number should be logged, and the person removing cash should sign for it. If your accounting department occupies a separate space, restrict entry with keycards or similar access controls so that only authorized staff can reach sensitive documents and equipment.
Verify Every Vendor Before You Pay Them
Phantom vendor schemes are one of the most common forms of accounting fraud, and they thrive where vendor setup is casual. An employee creates a fictitious company in the system, submits fake invoices, and approves the payments. Preventing this requires a verification process that makes it difficult to sneak a fake vendor past multiple sets of eyes.
At minimum, new vendor onboarding should require a completed W-9 (or W-8 for foreign vendors), verification of the company’s tax identification number, and confirmation of a physical street address rather than a P.O. box. The person who sets up a new vendor in the system should never be the same person who approves invoices or authorizes payments for that vendor. Periodic reviews of the vendor master file should cross-check vendor addresses, phone numbers, and bank account details against employee records. Overlaps between vendor and employee information are one of the clearest red flags for a phantom vendor scheme.
Reconcile Accounts and Run Surprise Audits
A monthly bank reconciliation compares the cash balance in your books to the statement from your financial institution. Discrepancies like uncleared checks, unrecorded fees, or unexplained withdrawals get flagged and investigated immediately. This is where phantom vendors and unauthorized transfers tend to surface, because the bank statement does not lie about what actually left the account. Someone other than the person who records transactions should perform or at least review the reconciliation.
Surprise audits go deeper. An internal auditor or outside accountant selects a high-risk area without warning and traces transactions from initial request through final payment. Accounts payable, travel and entertainment expenses, and petty cash are the usual targets. The element of surprise matters because employees running a long-term scheme often maintain a careful cover that depends on knowing when reviews are coming. Results should be documented in a formal report that identifies every variance and recommends specific fixes.
Do Not Ignore Small Discrepancies
Not every discrepancy requires a full investigation, but do not assume that a small dollar amount means the error is harmless. SEC guidance makes clear that materiality is not purely a numbers game. A 5% rule of thumb sometimes serves as a preliminary screen, but the SEC has stated explicitly that exclusive reliance on any percentage threshold has no basis in accounting standards or law. Qualitative factors can make a small misstatement material: the error masks a change in earnings trends, hides a failure to meet loan covenants, turns a loss into income, or increases management compensation. Intentional misstatements deserve extra scrutiny regardless of size, because the intent itself is evidence of a deeper problem.2U.S. Securities and Exchange Commission. SEC Staff Accounting Bulletin No. 99 – Materiality
Require Employees to Take Vacation
Many fraud schemes require the perpetrator’s constant presence. Lapping (using one customer’s payment to cover a theft from another) falls apart if someone else handles the account for a week. Skimming (pocketing cash before it hits the books) becomes much riskier when a fill-in employee notices that deposits do not match receipts. An employee who refuses to take time off is one of the oldest red flags in fraud detection.
A mandatory vacation policy embedded in the employee handbook turns that red flag into a control. Require every employee with financial responsibilities to take a block of consecutive days off each year. During that time, assign a different employee to handle the vacationing person’s tasks. If the fill-in notices that the absent employee was not following procedures, hiding key information, or maintaining off-book records, a deeper review is warranted. The policy also works as a deterrent: people are less likely to start a scheme when they know someone else will be sitting at their desk.
Open a Safe Channel for Reports
An anonymous reporting channel is often the fastest way fraud comes to light. A dedicated hotline, encrypted email address, or third-party reporting service gives employees a way to flag suspicious activity without exposing themselves. Many organizations outsource these channels to an independent provider so that reports bypass internal management entirely. The intake process should define exactly who receives each report, whether that is an ethics officer, outside counsel, or a board committee, and serious allegations involving executives or large sums should be escalated immediately.
Employees at publicly traded companies have specific legal protection under the Sarbanes-Oxley Act. The law prohibits any company with SEC-registered securities from retaliating against an employee who reports conduct they reasonably believe violates federal fraud statutes, SEC rules, or any federal law relating to shareholder fraud.3U.S. Department of Labor. Sarbanes Oxley Act (SOX) Retaliation includes firing, demotion, suspension, threats, and harassment. An employee who experiences retaliation can file a complaint with the Department of Labor or bring a federal lawsuit if the DOL has not issued a final decision within 180 days.4Office of the Law Revision Counsel. 18 U.S. Code 1514A – Civil Action to Protect Against Retaliation in Fraud Cases Remedies include reinstatement, back pay with interest, and reimbursement of litigation costs and attorney fees.
Employees can also bypass internal channels entirely. If information reported directly to the SEC leads to an enforcement action resulting in more than $1 million in sanctions, the whistleblower can receive between 10% and 30% of the money collected.5U.S. Securities and Exchange Commission. Whistleblower Program Organizations that take internal reporting seriously and investigate complaints promptly reduce the likelihood that employees will go straight to the SEC.
Screen People Before You Hire Them
The cheapest fraud control is not hiring someone with a track record of financial dishonesty. Background checks for accounting positions should include a criminal history review focused on theft, forgery, and financial crimes. Employers can consider conviction records in hiring decisions, weighing the seriousness of the offense, how much time has passed, and the responsibilities of the role.6U.S. Equal Employment Opportunity Commission. Arrest and Conviction Records: Resources for Job Seekers, Workers and Employers Credit checks are common for positions with financial authority, since personal financial pressure is a well-documented motivator for workplace theft.
FCRA Disclosure Requirements
Before pulling a credit report or background check through a consumer reporting agency, federal law requires you to give the applicant a written disclosure, in a standalone document separate from the employment application, stating that you may obtain a consumer report for employment purposes. You must also get the applicant’s written authorization before ordering the report.7Office of the Law Revision Counsel. 15 U.S. Code 1681b – Permissible Purposes of Consumer Reports If you plan to take adverse action based on the report, you must provide the applicant with a copy of the report and a summary of their rights before making a final decision.8Federal Trade Commission. Using Consumer Reports: What Employers Need to Know Skipping these steps exposes your organization to liability under the Fair Credit Reporting Act.
Verify Credentials Independently
Verify educational degrees and professional licenses independently. Services like the National Student Clearinghouse cover roughly 96% of U.S. four-year degrees and allow instant verification. For a Certified Public Accountant license, check with the relevant state board of accountancy. Credentials fraud is more common than most employers assume, and discovering it after the employee has access to your books is far worse than catching it during hiring.
Train Staff to Recognize Common Schemes
Even well-screened employees need to understand the fraud schemes they are most likely to encounter. Two of the most common are lapping and skimming. Lapping works by diverting one customer’s payment to cover a shortage in another customer’s account, shuffling money in an ever-expanding chain until the scheme collapses or gets caught. Skimming is simpler: cash is taken before it ever enters the accounting system, so the books never reflect the missing money at all.
Training sessions should cover the warning signs of these and other schemes. An employee who insists on handling certain accounts alone, resists cross-training, or shows sudden lifestyle changes that do not match their salary warrants a closer look. The goal is not to make everyone paranoid but to create a culture where people understand what fraud looks like and feel comfortable raising concerns when something does not add up.
Back Up Your Controls With a Fidelity Bond
Even the best internal controls cannot guarantee that fraud will never happen. A fidelity bond (sometimes called an employee dishonesty bond) provides financial protection by reimbursing the business when an employee steals money or property. Premiums for a $100,000 bond generally run between a few hundred and a few thousand dollars annually, depending on the business’s size, industry, and the applicant’s credit profile. Certain industries, particularly those handling client funds such as investment advisors and ERISA plan fiduciaries, face regulatory requirements to maintain fidelity bond coverage.
A fidelity bond is not a substitute for internal controls. Insurers will scrutinize your control environment when underwriting the policy and may deny or limit coverage if basic safeguards like segregation of duties and bank reconciliations are absent. The bond is the last line of defense: your controls prevent and detect fraud, and the bond cushions the financial blow when a scheme slips through.
A Note on Public-Company Requirements
If your organization is publicly traded, several of these practices are not optional. The Sarbanes-Oxley Act requires management to include an internal control report in every annual filing, stating that management is responsible for maintaining adequate controls over financial reporting and assessing whether those controls actually work.9Office of the Law Revision Counsel. 15 U.S. Code 7262 – Management Assessment of Internal Controls Most organizations that design their controls formally use the COSO Internal Control–Integrated Framework, which organizes controls around five components: the control environment, risk assessment, control activities, information and communication, and monitoring. Private businesses and nonprofits are not required to follow it, but structuring controls around those five components forces you to think about fraud risks systematically rather than patching holes one at a time.