09/15/2026
🚨 Fraud Risk? Not Here – Not My Team!
We’ve all read the articles or watched the news and seen stories about fraud or embezzlement. Those interviewed always seem to say the same thing: “I never thought this would happen here…” or “I trusted them and never thought they would do this!”
But have you ever flipped that around? “I always knew that person was capable of fraud. I always suspected they would do something!” It sounds completely unreasonable, doesn’t it? No one expects someone they work with to commit financial fraud or crimes, and yet it happens.
As auditors, we ask our clients each year if they are aware of any fraud, whether suspected, alleged, or actual. We don’t specifically design tests for fraud, but it is an ever-present risk in the environment in which we work. Many clients don’t like hearing the “F” word (fraud), and many want us to take their word for whatever it is they are telling us. For auditors, our standards require us to verify what we are told. We can trust that a client is telling us the truth, but we have to prove it.
We have it easy… what about you?
🔍 What do you do to prevent fraud? How can you detect it before it becomes larger than your organization can survive?
The simple answer: internal controls.
Internal controls are processes and procedures put in place to help prevent and/or detect fraud or errors that may occur. You may notice that this definition doesn’t have anything to do with office efficiency or making anyone’s job easier. In fact, in many cases, internal controls do quite the opposite.
What are some examples of these controls?
🔹 Segregation of Duties: Accounting and financial functions should be adequately segregated to ensure one person does not have the ability to receive documents, record transactions, and reconcile them. Giving one person the ability to do all of these things could allow them to commit fraud and cover their tracks. Involving at least one other person provides a necessary check and balance.
🔹 Requiring Approval: Requiring approval on invoices or checks before payment is made is a good way to make sure someone else is looking at things. If someone knows another person is going to review something before it can be completed, that alone may deter an attempt at fraud. Another good rule, and one that isn’t always considered, is requiring approval for changes to payroll, especially for those who regularly control the payroll process. If I were the Director of HR at your company, you wouldn’t want me to be able to approve my own pay increases, would you?
🔹 Monitoring: This is one of the most important control processes, especially in an environment where there is limited opportunity for segregation of duties, such as when your accounting staff is very small. Similar to the above, simply knowing someone is going to be looking at things can often deter a potential fraudster.
A few easy things to monitor:
🏦 Bank statements and cleared checks: Make sure your bank statements provide copies of cleared checks. Someone outside of the check-writing process, or the final approval person, can review check copies for any that were signed or approved by improper individuals or contain a signature that doesn’t match.
đź“ŠMonthly financial statements: Review financial statements and information regularly, specifically comparing periods to identify anything outside the norm and confirming that expected outliers are properly reported.
đź“‹ Vendor lists: Regularly review vendor lists, paying particular attention to any new vendors added during the period. Fraudsters may create fake vendors and use them to receive funds directly from the company.
đź’» ACH payments: Watch those ACH payments on your bank statements. Make phone calls once in a while and review the invoices supporting them. Do what you need to do to ensure payments are going to a legitimate entity that is actually providing your company with a benefit.
⚠️ One last thing: Remember that some fraud originates outside your organization. You also need to protect yourself from hackers, phishing emails, and other scams. If a vendor emails saying they have changed their banking information, call them to confirm it. Be careful about what you send through regular, unencrypted email. Sending personally identifiable information about yourself, your employees, or your company is never a good idea.
When in doubt, follow what we auditors use: Trust, but VERIFY! âś…
— Jacques H. Labo, CPA
Partner
