The Bookkeeper With Too Much Access

Why this matters

By value, the largest single loss exposure in a small business is not the truck, the stock or the field cash. It is the one person who records the transactions, reconciles the bank, pays the bills and touches payroll, because that person holds every function the control model exists to keep apart. The Association of Certified Fraud Examiners, whose biennial Report to the Nations is the only large dataset on occupational fraud, has consistently found that the smallest organisations suffer a higher median loss than the largest ones, and names a lack of internal controls as the most common contributing factor. Small does not mean low risk. It means concentrated risk.

It is also the hardest of these conversations to have, because the person is usually trusted, long-serving, and in a great many shops related to the owner. That is not a coincidence either: the same dataset finds that schemes run by longer-tenured people run larger and longer before detection.

What the role actually holds

Line it up against the four functions and the problem states itself. The bookkeeper records the transactions. They reconcile the bank, which is the verification step. They have custody of the payment instruments. And through a standing approval habit ("just pay it") they authorise as well.

That is all four in one pair of hands. Nothing else in a small shop comes close, and it is why this card exists separately from the control-design card that owns the general model.

The other structural feature: this role produces the reports the owner reads. A monthly profit and loss statement cannot show you a payee. A cash summary cannot show you a payroll change. The instrument an owner believes is oversight is generated by the person being overseen, from the same data they entered, which is not oversight at all.

The schemes, in roughly the order they occur

Written so you can recognise them, not so you can go looking for them. Most bookkeepers commit none of these.

The fictitious vendor. A supplier is created that does not exist, or exists only as a mailbox and a bank account. Payments go out under an ordinary-looking expense category, usually for something a service business buys constantly and never itemises, like materials or small tools. It is the most common because it needs nothing but the ability to add a vendor and approve a payment to it, and it is invisible in any categorised report, because it is a real-looking line in a real category.

The altered payee. An approved payment is redirected. The supporting paperwork is genuine, the amount is genuine, the approval is genuine, and the money goes somewhere else. This is why the bank statement's payee list, rather than the accounting system's, is the document that matters.

The unauthorised payroll change or ghost employee. A pay rate moved, an unearned bonus, extra hours added, or a person on the payroll who does not work there, often a former employee never removed. Payroll is attractive because it recurs without needing a fresh decision each time and because most owners never read the register, only the total, which moves for a dozen innocent reasons.

Personal expenses through the business. The blurriest, and the one most likely to start small and grow. A card used for groceries, a personal subscription, a family phone line. It is often the entry point rather than the scheme, because it establishes that nobody is looking.

Lapping of customer receipts. A customer's payment is taken and the following customer's payment is used to close the first one's balance, then the next to close that, and so on. It requires daily attention forever, which is exactly why a mandatory absence breaks it: the substitute opens the mail, the chain stops, and the hole appears.

The five controls a small shop can actually run

Each of these is minutes a month, not a restructure.

1. The bank statement reaches you directly and unopened, and you read the payee list. Paper to a separate address, or an online login that belongs to you and that they cannot change. You are reading names, line by line, not totals and not categories. This is the single highest-yield control in this card, and it is the one owners skip because reading a payee list feels like it should not be necessary.
2. New vendor and new employee setup takes two people, with no threshold. No amount limit, no exceptions for urgency. Every scheme above except lapping needs a new master record at some point.
3. You approve above a stated limit, and you read the full list below it. Both halves. An approval limit that is known is a limit that gets worked under, so the sub-limit population is where a patient scheme lives, and the only thing that reaches it is somebody reading the whole list with names attached.
4. One consecutive full week away, with somebody else doing the work. The substitution is the control, not the absence. This is also the answer to the cover problem you already have, which is that one person knowing how to run your money is an operational risk before it is ever a fraud risk.
5. An outside review, once a year, by someone with no relationship to the bookkeeper. Be precise about what you are buying: a tax return engagement and a compilation do not include testing internal controls, and your accountant is not quietly checking. You have to ask for it, scope it, and pay for it separately.

A worked case: one payee list

A shop with nine field staff and one bookkeeper of seven years. The owner sets up online access in his own name and reads the payee list for the first time.

The month shows 41 distinct payees. He recognises 38 of them immediately. Three he does not, which is the whole finding and it took under ten minutes:

• The first is a real supplier trading under a holding-company name he had never seen. One phone call to a number he looked up himself, not one from the file, confirms it.
• The second is a software subscription somebody in the office added without asking. Legitimate spend, and a genuine control gap of a different kind, because a recurring charge got created with no approval. Fix that as policy, not as suspicion.
• The third resolves to nothing. No website, no listing, no invoice in the file.

He pulls the history on the third rather than asking about it. Over five months there are four payments, all coded to materials, all sitting just under the shop's own approval limit. The pattern is the tell. Four payments that each land just below a threshold is not what ordinary spending does, and it means the threshold was known to whoever set the amount.

What he does next is nothing visible. He does not raise it with her, does not ask the office about the vendor, does not change any permissions. Every record he needs - the vendor master, the payment history, the coding, the audit trail on the entries - sits in a system she administers, and the first thing a tipped-off person does is tidy. So he exports the audit history, requests statements and cleared item images directly from the bank rather than from the file, and takes the four payments and the five-month window to the sequencing card, which owns the order of everything from here: bounding the loss, testing the innocent explanations as hard as the guilty one, deciding what standard of proof he needs for what action, and only then planning a conversation.

Read the controls against that case. Control 1 found it in one month once the habit existed. Control 2 would have stopped it at creation, because the vendor master record is where it began. Control 3 is precisely what the amounts were designed to evade, and the half that still reaches it is the reading of the sub-limit list. Control 4 would likely have surfaced it, since a fictitious vendor's paperwork has to be kept ahead of anyone else looking in the file.

And the innocent version, which has to be tested with the same energy. A vendor that resolves to nothing online may be a sole trader with no web presence, paid in good faith against invoices that were filed somewhere else. That is checkable without a word to anybody: the cleared item image shows who endorsed or received it. Run that check before you believe your own conclusion.

Imposing controls on someone you trust

This is the part owners get stuck on, and the reason it feels impossible is that the conversation is being framed as an accusation waiting to be denied. Three things make it ordinary.

Say the real reason out loud, which is that the controls protect them. If money goes missing and only one person could ever have touched it, that person has no defence. The payee list, the second signature on a vendor setup, the week away with somebody else at the desk - each one is a fact that clears them. Long-serving bookkeepers understand this immediately, and in practice are often the ones who have been asking for it.

Apply them to yourself first and visibly. Your own draws go through the same record. Your own card statement gets read by the bookkeeper. If the owner is exempt, the controls are a statement about the staff, and everyone will read them that way and be right.

Introduce them at a moment that is not about anybody. A new year, a software change, a new insurance policy, a loan covenant, an outside accountant's recommendation. A control that arrives the week after something went missing is an accusation whatever words accompany it. A control that arrives in January is a system.

One thing that does not work, and is worth naming because owners reach for it: skipping the conversation and quietly monitoring instead. It is the option that feels least confrontational and it is the one that ends worst, because when they find out, and they will, you have taught a long-serving employee that you suspected them for months and said nothing.

If your bonding or insurance requires controls, say so plainly, because it is both true and impersonal. An employee dishonesty policy generally conditions coverage on you having and following controls, and it also changes what a discovered loss costs you. That is its own card.

References

• Association of Certified Fraud Examiners, Report to the Nations, published biennially, for the finding that the smallest organisations carry the higher median loss and that lack of internal controls is the most commonly cited contributing factor
• AICPA, on the scope of preparation, compilation and review engagements, none of which includes testing internal control unless separately engaged
• See related: Separating Duties in a Shop With Four People, which owns the control model this card applies
• See related: Before You Accuse Anyone: The Sequence; The Employee Dishonesty Coverage Most Shops Do Not Carry