The 5 Control Gaps That Let Fraud Slip Through in SMBs
An internal controls checklist small business is a documented set of policies and procedures designed to protect assets, ensure accurate financial reporting, and prevent fraud. Without one, a business operating on trust alone is exposed to risks that audits and due diligence reviews will inevitably uncover.
1 These losses stem from five recurring control gaps.
1. No segregation of duties. The same person who records a sale often deposits the cash and reconciles the bank account. This single point of failure allows theft to go undetected for months.
2. Manual journal entries without review. Owners approve wire transfers but never review adjusting entries made by the bookkeeper.1
3. Vendor setup without verification. A new vendor is added to the system based on a single email request. No one confirms the bank account belongs to a legitimate supplier.
4. Cash handling without oversight. Petty cash, customer payments received by mail, and weekend deposits are handled by one person. The Wisconsin SBDC checklist recommends separating cash handling and recording duties as a foundational control.2
5. No periodic control testing. Controls exist on paper but are never tested to confirm they work. By the time an auditor finds the gap, the loss has already occurred.
The One Check Most SMBs Skip Until the Auditor Arrives
Bank reconciliations are the most basic control, yet they are frequently performed late or not at all. A reconciliation confirms that every transaction recorded in the accounting system matches the bank statement. When this step is skipped, fraudulent checks, unauthorized ACH withdrawals, and duplicate payments remain hidden.
Consider a hypothetical retailer with $2M in annual revenue. The bookkeeper processes payments weekly but reconciles the bank account only at quarter-end. A fake vendor payment of, for example, $5,000 per month runs for six months before anyone notices. That is a $30,000 loss that a 15-minute weekly reconciliation would have caught.
The SBA Office of Inspector General reported over $200 billion in improper payments across SBA programs in FY2023, highlighting control gaps at the federal level.3 If government agencies with dedicated audit teams miss this volume of errors, a small business with no reconciliation schedule is almost certain to have undetected problems.
Segregation of Duties When You Only Have Five Employees
Segregation of duties means no single person controls all phases of a financial transaction. In a five-person company, that sounds impossible. It is not. The key is to distribute control across the roles you already have.
| Transaction Stage | Person Responsible | Oversight Role |
|---|---|---|
| Approve purchase | Owner or department lead | Reviews budget before order |
| Receive goods | Warehouse or operations staff | Signs receiving report |
| Enter invoice | Bookkeeper or admin | Matches to purchase order |
| Approve payment | Owner or manager | Reviews supporting documents |
| Reconcile bank | External CPA or owner | Confirms payment cleared |
For a business with fewer than five employees, the owner must serve as the reviewer for at least one step in every transaction. If the owner is the one writing checks, an outside bookkeeper should reconcile the bank account. If the bookkeeper enters invoices, the owner should approve the payment run.
The Wisconsin SBDC checklist emphasizes that even simple separation — one person counts cash, another records it — reduces fraud risk significantly.2 The goal is not perfect separation but a system where collusion between two people is required to steal.
Building Your Internal Controls Checklist Small Business Owners Actually Use
A checklist that sits in a binder is useless. The internal controls checklist small business owners actually use is a living document tied to specific dates and responsible parties.
| Control | Frequency | Who Owns It | Evidence of Completion |
|---|---|---|---|
| Bank reconciliation | Weekly | Bookkeeper | Signed reconciliation report |
| Credit card statement review | Monthly | Owner | Statement with flagged transactions |
| Vendor master file review | Quarterly | Controller or CPA | List of active vendors with dates added |
| Payroll register review | Each pay period | Owner | Signed register with headcount check |
| Journal entry review | Monthly | External CPA | Reviewed entries log |
4 A checklist that covers these three areas — who gets paid, who is on payroll, and where cash goes — addresses the highest-risk categories first.
The checklist should be reviewed annually and updated whenever the business adds a new bank account, hires a controller, or changes its accounting software. Outdated controls are nearly as dangerous as no controls.
The Authorization Matrix That Stops Phantom Vendor Payments
Phantom vendor payments occur when an employee creates a fake supplier, submits invoices, and deposits payments into a personal account. This scheme is common in SMBs because vendor setup often requires only an email address and a W-9.
An authorization matrix defines exactly who can approve what, at what dollar threshold, and with what documentation.
| Payment Type | Under $1,000 | $1,000–$10,000 | Over $10,000 |
|---|---|---|---|
| New vendor setup | Manager approval | Owner approval | Owner + second signature |
| Recurring vendor payment | No approval needed | Quarterly review | Annual contract review |
| One-time payment | Manager approval | Owner approval | Board or investor approval |
| Employee reimbursement | Manager approval | Owner approval | Owner + receipt audit |
For a business with $5M in revenue, a typical vendor payment might be $2,500. If the owner reviews every payment at that level, the bottleneck slows operations. The solution is a threshold system: payments under $1,000 require only a manager's approval, while anything over $10,000 requires two signatures.1
The matrix must also require that new vendors be verified by a second person. A simple call to the vendor's published phone number — not the number on the invoice — confirms the supplier is real.
Monthly Close Procedures That Flag Fraud Before It Compounds
A monthly close is the process of finalizing all transactions for the month and ensuring the books are accurate. For SMBs, this should be completed within 10 business days of month-end. Delays allow errors and fraud to compound.
| Step | Deadline | Red Flag to Watch For |
|---|---|---|
| Reconcile all bank accounts | Day 5 | Unexplained differences over $100 |
| Review credit card statements | Day 7 | Charges from unfamiliar vendors |
| Reconcile accounts receivable aging | Day 8 | Sudden spike in overdue accounts |
| Review payroll and benefits | Day 9 | Employees paid after termination date |
| Review journal entries | Day 10 | Entries posted without description |
A hypothetical SaaS company with $500K ARR might have 50 recurring transactions per month. If the bookkeeper posts a manual journal entry to "miscellaneous expense" for, say, $2,000, and no one reviews it, that entry could be a disguised payment to a personal account. Monthly review catches this before the next close cycle.
1 A disciplined monthly close cuts that window to 30 days.
How to Test Your Controls Without Hiring an Auditor
Control testing does not require a CPA firm. The owner or a trusted employee can perform basic tests using existing data.
Test 1: Vendor file audit. Export the vendor master list. Check for vendors with missing tax IDs, duplicate addresses, or addresses that match employee addresses. Flag any vendor added in the last 90 days that has already received payments.
Test 2: Payroll audit. Run the payroll register for the last three months. Confirm that every employee on the list is still active. Check for overtime payments that exceed policy limits.
Test 3: Bank reconciliation spot check. Pick one month at random. Reconcile the bank statement yourself, without looking at the bookkeeper's work. Compare your result to theirs.
Test 4: Journal entry review. Print all manual journal entries for the last quarter. Look for entries to expense accounts that lack a description or supporting document. Flag entries posted after the close date.
These tests take two hours per quarter. They are not a substitute for an external audit, but they catch the most common control failures before they become material losses.
When to Bring in a Fractional CFO for a Controls Audit
A fractional CFO becomes necessary when the business reaches a complexity threshold that exceeds the owner's capacity to manage controls alone. Common triggers include revenue exceeding a typical SMB threshold while the owner still approves every payment.
A fractional CFO performs a controls audit that reviews the existing checklist, tests each control, and identifies gaps. The output is a prioritized remediation plan. For a business at $5M in revenue, this engagement typically takes two to four weeks and costs less than one month of a full-time CFO salary.
The goal is not to build a Fortune 500 control environment. It is to ensure that the controls in place match the size and risk profile of the business.1
Your Next Step
Run the vendor file audit described in the testing section this week. Export your vendor list, check for duplicate addresses and missing tax IDs, and flag any vendor that was added in the last 90 days and has already received payments. If you find discrepancies, you have identified a control gap that needs immediate attention. For a full controls audit or help building your internal controls checklist, contact your CurrentCFO advisor at [email protected].