Fraud Prevention in Small Business Bookkeeping: The Internal Controls That Actually Work

The short answer

Small businesses do not lose less to employee fraud than big companies. They lose about the same per incident, with far less cushion to absorb it. The Association of Certified Fraud Examiners' 2026 study of 2,402 investigated cases put the median loss for organizations with fewer than 100 employees at $126,000 — slightly higher than the $123,000 median for organizations with more than 10,000 employees. A typical scheme ran 12 months before anyone caught it, and in more than half of cases the money was never recovered at all.

The good news is buried in the same study: fraud is not random. It follows the gaps. More than half of the cases involved controls that were missing or were overridden. Organizations that ran management review as a real control saw losses about 55 percent lower and detected schemes about 44 percent faster. Fraud is caught by tips more than by any other method — 43 percent of cases — and organizations with a reporting hotline saw median losses of $100,000 caught in 11 months, against $150,000 in 17 months without one.

For a bookkeeping firm, this is both a client-service subject and a product. Your clients are exactly the organizations in that $126,000 row. This article walks through what the current data says, the schemes that actually hit small businesses, a worked example of what delay costs, and a control set sized for a team of two to ten people — including the honest version of segregation of duties when there are not enough people to segregate everything.

What the current data actually says

Start with scale. The ACFE estimates that organizations lose about 5 percent of revenue to fraud each year. That estimate has held across editions of the study for decades, which is itself the finding: occupational fraud is a standing cost of doing business, not a rare disaster. Apply it to a client doing $1.2 million in revenue and the expected annual exposure is about $60,000 — not a prediction that this client will be hit for exactly that, but a reminder that the background rate is material at every size.

The 2026 edition examined 2,402 cases across 143 countries, with total losses above $3.4 billion. The median loss was $104,000 per case; the average was about $1.46 million, pulled up by the one case in five that topped $1 million. Three categories cover nearly everything:

• Asset misappropriation appeared in about 90 percent of cases — theft of cash or other assets — with a median loss around $100,000. It is the everyday fraud: billing schemes, check and payment tampering, skimming, expense abuse, and payroll schemes.
• Corruption appeared in about 45 percent of cases, with a median loss around $150,000 — kickbacks, conflicts of interest, and bid manipulation.
• Financial statement fraud appeared in only about 6 percent of cases but carried a median loss around $1 million. Rare, and catastrophic when it happens.

More than a third of cases involved more than one category at once, which matters for prevention: a billing scheme with a cooperative vendor is both misappropriation and corruption, and a control tuned to only one of them can miss the combination.

Two findings deserve to be read slowly by any small-business advisor. First, size did not protect anyone: the small-firm median loss matched the largest firms'. The structural reason shows up everywhere in the research — small organizations concentrate financial duties in a few trusted people, run thinner independent checks, and have fewer resources for preventive and detective controls. Second, recovery is the exception, not the plan. In the 2026 study, about 56 percent of victim organizations recovered nothing, about 29 percent recovered part of the loss, and only about 15 percent recovered all of it. Prevention and early detection are not just cheaper than recovery. Most of the time, recovery simply does not happen.

The schemes that actually hit small businesses

Textbook fraud lists are long. The small-business list is short, and a bookkeeper who knows these five patterns cold will recognize most of what ever walks through a client's books.

Billing schemes. A fake or inflated vendor invoice gets paid. The ACFE's scheme data puts billing at roughly a fifth of asset-misappropriation cases with a median loss near $90,000, leaking at a median pace the 2024 edition measured at about $5,600 a month. The tell is rarely the invoice itself — fakes are easy to make look right. The tells live around it: a vendor with no website or a post-office-box address, round-dollar invoices just under an approval threshold, a vendor master record created by the same person who approves its payments, and bank details that match an employee's.

Check and payment tampering. Checks remain the most fraud-targeted payment method in the Association for Financial Professionals' survey work — in the 2025 AFP survey covering 2024 activity, 63 percent of organizations that experienced payments fraud reported it via checks, even though most organizations planned to keep using them. Tampering was also the costliest common misappropriation scheme in the ACFE data. Washed checks, altered payees, and forged signatures all exploit the same gap: the person who prepares the payment is not checked by anyone who compares it to the bank's record.

Business email compromise and vendor impersonation. This is the external scheme that behaves like an internal one. The FBI's Internet Crime Complaint Center recorded 21,442 business email compromise complaints in 2024 with about $2.77 billion in reported losses — close to $8.5 billion across 2022 through 2024. The AFP survey found BEC was the top avenue for attempted or actual payments fraud, cited by 63 percent of respondents, and vendor-imposter fraud jumped sharply. The classic play is a plausible email asking accounts payable to change a vendor's bank details. The control that defeats it is not vigilance; it is a callback to a number already on file before any bank-detail change takes effect.

Payroll schemes. Ghost employees, inflated hours, and rates quietly raised after approval. Payroll fraud runs long — historically among the longest-running scheme types before detection — because each individual payment looks ordinary. The control is a periodic, independent tie-out: the payroll register compared against the approved headcount and rate list by someone who does not run payroll.

Skimming and cash larceny. Cash taken before it is recorded, or after it is recorded but before it is deposited. Businesses that still handle meaningful cash — restaurants, trades, retail, events — carry this risk in proportion to how informal the receipt process is. Numbered receipts, daily deposit discipline, and a monthly comparison of recorded sales patterns against deposits are the unglamorous controls that work.

Notice what these five share. None of them requires defeating a sophisticated system. Every one of them requires exactly one gap: a step nobody independent ever looks at.

Why small firms are exposed: the trust concentration problem

Ask a small-business owner why there is no second review of payments and the answer is almost never carelessness. It is arithmetic. A six-person business cannot staff a four-person finance department. One trusted person opens the mail, records the bills, prepares the payments, and reconciles the bank account — not because the owner designed a risky system, but because that is what six people can cover.

Layer on the human facts the ACFE data keeps surfacing. Most perpetrators are first-time offenders with no prior charge or conviction. A large share display ordinary-life red flags — financial pressure, living beyond their means, an unwillingness to share duties or take vacation. Fraud in a small business is usually not a criminal who infiltrated the firm. It is a trusted person under pressure who discovered, often gradually, that a particular step was never checked. The fraud triangle — pressure, opportunity, rationalization — is a cliché because it keeps being true, and of its three legs, opportunity is the only one an owner or bookkeeper directly controls.

That framing changes the tone of the whole conversation with a client. Controls are not an accusation. A second set of eyes on payments protects the honest bookkeeper as much as the owner: when money goes missing in a business with no controls, suspicion falls on everyone who touched it. When money goes missing in a business with real controls, the records themselves narrow the question. Good controls are how honest people prove they are honest.

How fraud gets caught — and what that implies

Detection data is prevention data read backwards. Tips detected 43 percent of cases in the 2026 study — nearly three times the next method. Internal audit and management review followed, each in the low-to-mid teens. External audit, the control many owners mentally rely on, detected only a low single-digit share; an annual audit is not designed to catch a $5,600-a-month billing scheme, and mostly does not.

Three implications follow for a small firm:

1. Give tips somewhere to go. More than half of tips came from employees. Yet only about 24 percent of organizations with fewer than 100 employees had a reporting hotline, against about 73 percent of organizations overall. A small firm does not need a vendor hotline on day one — a dedicated email address the owner actually reads, plus a stated no-retaliation norm, captures much of the value. What it cannot be is a suggestion box nobody opens.
2. Management review must be real. The ACFE associates management review with losses about 55 percent lower and detection about 44 percent faster — but the review in those organizations is a person examining transactions and variances and asking questions, not a signature applied to a stack. A five-minute skim earns five-minute results.
3. Proactive data monitoring pays. Looking systematically for duplicates, round-dollar clusters, weekend postings, and vendor-employee matches was associated with losses about 53 percent lower and detection about 44 percent faster. For a bookkeeping firm serving many clients, this is the control that scales: the same exception checks run across every set of books, every month.

The worked example: what a year of delay costs

Take the billing scheme, because it is the most common shape. Use the ACFE's measured median velocity for billing schemes of about $5,600 a month, and run three detection scenarios. This arithmetic is illustrative — your client's scheme will differ — but the shape of the curve is the point.

• Caught at month 3 by a quarterly vendor review: about $16,800 gone. Painful, survivable, and usually partly recoverable because the trail is fresh.
• Caught at month 12, the typical duration in the 2026 study: about $67,200. Now it is a real event — an investigation, a termination, possibly a police report and an insurance claim.
• Caught at month 24: about $134,400 — right at the small-firm median loss in the study, and the point at which many small businesses are choosing between recovery efforts and making payroll.

Same scheme, same monthly leak. The only variable was how long it ran. That is why the control conversation should be about detection speed, not just prevention. A monthly reconciliation done by someone independent, a quarterly vendor-list review, and an owner who actually reads one exception report a month compress the middle scenario toward the first one. Nothing on that list requires new headcount.

Put the control cost next to it. Suppose the independent monthly review takes the bookkeeper two hours and the owner thirty minutes — call it $200 to $400 a month at ordinary rates, or roughly $2,400 to $4,800 a year. Against an expected exposure the ACFE pegs at about 5 percent of revenue, a client would need revenue under about $96,000 before that control budget stopped making sense on expected value alone — and that ignores the recovery data, which says the loss, once it happens, mostly stays lost.

The control set, sized for a small team

Here is the practical stack, ordered by value per hour of effort. Every item names the scheme it interrupts.

1. Separate the four steps of a payment

Segregation of duties is the control everything else hangs on: the person who requests a purchase is not the person who approves it, who is not the person who pays it, who is not the person who reconciles it. With four people, that maps cleanly. With two, split it as request-plus-pay on one side and approve-plus-reconcile on the other, and use the outside bookkeeper as the independent reconciler — which is, quietly, one of the strongest arguments for outsourced bookkeeping that exists. The external bookkeeper who codes transactions and works the reconciliation is a person with no ability to benefit from a payment and every ability to spot one that does not belong. That independence is a control, and firms should say so in plain language when they sell it.

Two bright lines matter more than the full matrix: nobody creates a vendor and approves its first payment alone, and nobody who handles payments reconciles the account alone. Hold those two lines and the most common schemes need a colluder — and collusion is rarer, louder, and faster to surface than a solo scheme.

2. Reconcile monthly, independently, to the statement

A reconciliation only controls fraud if it is tied to the bank's own record, not to what the books expect. The reviewer compares the cleared activity to the stored statement, investigates old outstanding items — a check outstanding for 90 days is a question, not a footnote — and confirms the difference is explained, in plain sight, rather than plugged. Monthly cadence matters because of the velocity math above: a quarterly reconciliation triples the detection window of the worst schemes.

This is where current bookkeeping tooling genuinely helps, within verified limits. In LedgerHQ, as shown on its public site, Tally codes transactions and works reconciliations from the stored statement, keeping the source beside every transaction and leaving the remaining difference visible, while the human stays in control of judgment calls. Used that way, the software shortens the routine work so the human review — the actual control — happens every month instead of whenever there is time. It does not replace the independent reviewer; it makes the reviewer's job small enough to actually get done.

3. Lock the vendor master

Most billing fraud needs a vendor record. Control the record and you control the scheme. Practical settings: only one role can create vendors; new vendors require a tax form and an independent verification call for the first payment; bank-detail changes require a callback to a number already on file, never the number in the requesting email; and once a quarter, someone compares the vendor list against the employee list for shared addresses, phone numbers, and bank accounts. That quarterly comparison is a one-hour exercise that directly hunts the most common scheme in the data.

4. Put approval thresholds in writing — and honor them

Thresholds fail in two ways: they do not exist, or they exist and get overridden. The ACFE counts overridden controls alongside missing ones in that more-than-half figure. Written thresholds — for example, owner approval above a set amount, two approvals above a higher one — should include the unglamorous rules: no splitting a purchase to stay under a threshold, no retroactive approvals as routine, and the owner is bound by the same thresholds as everyone else. Owner override is not a theoretical risk; severity in the ACFE data scales with authority, which is why tone at the top has to be a control and not a slogan.

5. Run payroll like someone is watching — because someone should be

Each quarter, a person who does not process payroll ties the register to the approved roster: every paid name is a real, current employee, at the approved rate, with approved hours. New hires and rate changes require a second person's sign-off before the first affected run. Owners of very small firms should read the payroll summary themselves; it is fifteen minutes, four times a year, against one of the longest-running scheme types.

6. Make the cash boring

Where cash exists: pre-numbered receipts or a point-of-sale record for every sale, deposits made intact and daily — expenses are never paid out of undeposited receipts — and a monthly look at sales patterns for the dip that skimming leaves behind. Cash controls feel old-fashioned right up until they are the only evidence a business has.

7. Open a reporting channel, and say what it is for

As the detection data shows, this is the highest-yield item on the list relative to its cost. Name the channel — an email address, a simple form, a third-party hotline when the firm is ready — state plainly that good-faith reports are protected, and route reports to someone other than the person most reports would concern. For a bookkeeping firm's clients, the firm itself can be part of the channel: staff who see something odd in a client's books need to know their own firm's path for raising it.

8. Review access, and use the audit trail

Quarterly, list who can do what in the accounting system, the bank, and the bill-pay tool. Remove departed staff the day they depart. Turn on alerts for large or unusual bank activity. And when something does look wrong, the audit trail — who created, changed, approved, and deleted what, and when — is what turns a suspicion into an answer. Retain statements, approvals, and source documents with the transactions they support; a control that leaves no evidence cannot be reviewed later.

Red flags worth a second look — not an accusation

The ACFE catalogs behavioral red flags because they correlate with cases, not because any one of them proves anything. Living beyond visible means, obvious financial pressure, a refusal to share duties or take vacation, an unusually close relationship with one vendor, and defensiveness around routine questions all appear in the case data. In a bookkeeping review, pair the human flags with record flags that are purely mechanical:

• Vendor records with missing tax information, or addresses matching an employee's.
• Invoices in round amounts, just under approval thresholds, or with sequential numbers from the same vendor.
• Duplicate payments — same vendor, amount, and near dates.
• After-hours or weekend postings by a single user, and deleted or voided transactions clustering around period-end.
• Outstanding checks and deposits that age instead of clearing.
• A reconciling difference that is explained by a plug entry rather than identified items.

Each item earns a question and a document, nothing more. Most resolve innocently. The discipline is that they get asked about every time, by routine, so that asking is never itself an accusation.

If you suspect fraud: the first 72 hours

Bookkeepers are often the first to see the pattern, so the first moves matter. Preserve, do not confront: secure the records, statements, and access logs before anything changes, and restrict — quietly and through the owner or counsel — the access the scheme depends on. Do not tip off the suspected person, and do not run your own interrogation; both can compromise recovery, insurance, and any later proceeding. Engage the client's CPA and attorney early, notify the insurer under the crime policy if one exists, and let counsel direct the investigation and any report to law enforcement or the bank. Your working papers and a clean timeline of what you found, when, and how will be the most useful things in the room. None of this is legal advice; it is the standard shape of a careful first response, and the professionals the client hires will adjust it to the facts.

What to do this month: a starter sequence

For a firm rolling this out across clients, sequence beats comprehensiveness:

Week 1. Pick the two bright lines — vendor creation and reconciliation independence — and check every client against them. Fix the violations you find. This is the highest-value week on the list.

Week 2. Write the payment thresholds down for each client, including the bank-detail callback rule, and get the owner's signature on the page. Unsigned controls get overridden.

Week 3. Run the first vendor-versus-employee comparison and the first aged-outstanding-items review. Log what you checked, even when the answer is clean; the log is part of the control.

Week 4. Stand up the reporting channel, tell staff it exists, and put the quarterly payroll tie-out and access review on the calendar as recurring work. Then put the whole set on the monthly close checklist, because a control that depends on memory is a control that expires.

Sold honestly, this is advisory work a client can understand: not software, not suspicion — a standing system that keeps a $5,600-a-month leak from becoming a $126,000 loss, run by the bookkeeper they already trust.

Frequently asked questions

What is the most common type of small business fraud? Asset misappropriation — theft of cash or assets by someone inside — appeared in about 90 percent of cases in the ACFE's 2026 study. Within it, billing schemes and check and payment tampering are among the most common and costly patterns a bookkeeper will encounter.

How much does employee fraud cost a small business? The ACFE's 2026 study put the median loss for organizations with fewer than 100 employees at $126,000 per case, with a typical scheme running about 12 months before detection. Across all organizations, the study estimates losses near 5 percent of revenue annually.

Can a two-person business segregate duties? Yes, partially — and partial is worth a great deal. Split requesting and paying from approving and reconciling, hold the two bright lines (vendor creation, independent reconciliation), and use the outside bookkeeper or CPA as the independent reviewer. The goal is that no fraud can run start to finish inside one person's unchecked work.

Do we need a fraud hotline? It is the highest-yield detection measure in the data relative to cost: tips detect 43 percent of frauds, and organizations with hotlines saw smaller losses caught sooner. A small firm's first version can be a dedicated email address with a stated no-retaliation policy; the essential features are that staff know it exists and trust it will be read.

Will an annual audit or review catch fraud? It is not designed to. External audit detected only a small single-digit share of cases in the ACFE data. Audits and reviews serve other purposes; fraud detection at small-business scale comes from monthly controls — independent reconciliation, vendor review, exception reporting, and tips.

What should a bookkeeper do first if the numbers look wrong? Preserve the records and access logs, tell the owner (or follow your firm's escalation path if the owner may be involved), and bring in the CPA and counsel before anyone is confronted. Document what you found and when. Let counsel direct the investigation from there.

Sources

• Association of Certified Fraud Examiners, Occupational Fraud 2026: A Report to the Nations — case counts, median losses by organization size, scheme categories, detection methods, control effectiveness, and recovery rates (2026). https://www.acfe.com — summarized via the report's key-findings release and contemporaneous coverage, including GRF CPAs & Advisors, "Small Budgets, Big Targets," October 7, 2026, and CFO Brew's 2026 report coverage.
• Association of Certified Fraud Examiners, Occupational Fraud 2024: A Report to the Nations — scheme velocity (median loss per month by scheme type) and small-organization median loss ($141,000) in the prior edition (2024). https://www.acfe.com/-/media/files/acfe/pdfs/rttn/2024/2024-report-to-the-nations.pdf
• Association for Financial Professionals, 2025 Payments Fraud and Control Survey (April 15, 2025) — 79 percent of organizations experienced attempted or actual payments fraud in 2024; BEC cited by 63 percent; checks the most-targeted payment method at 63 percent; vendor-imposter fraud at 45 percent. https://www.financialprofessionals.org/about/learn-more/press-releases/Details/survey-79-percent-of-organizations-were-victims-of-attempted-or-actual-payments-fraud-activity-in-2024
• FBI Internet Crime Complaint Center (IC3), 2024 Internet Crime Report (April 2025), via Nacha's summary — 21,442 BEC complaints and about $2.77 billion in BEC losses in 2024; about $8.5 billion across 2022–2024; $16.6 billion in total reported losses. https://www.nacha.org/news/fbis-ic3-finds-almost-85-billion-lost-business-email-compromise-last-three-years
• BDO, "Segregation of Duties: More Than an Accounting Control" (2026) — segregation as a core preventive control; organizations with internal controls experienced materially lower losses in the ACFE 2026 data. https://www.bdo.com/insights/assurance/segregation-of-duties-more-than-an-accounting-control
• Xero, "Fraud prevention tips to share with your small business clients" (June 2026) — practitioner summary of the ACFE findings for advisors, including segregation, reconciliation cadence, and reporting channels. https://www.xero.com/us/accountant-bookkeeper-guides/fraud-prevention-tips/
• LedgerHQ public site, ledgerhq.ai (accessed October 12, 2026) — product description quoted for Tally's coding, reconciliation from the stored statement, source documents beside transactions, human control of judgment calls, firm workspace, and $20-per-client pricing with a free preview until January 1, 2027.

This article is general information for bookkeeping firms and their clients, not legal, audit, or forensic advice. Suspected fraud should be handled with the client's CPA and legal counsel.