Companies lose roughly 5% of annual revenue to fraud, a figure the Association of Certified Fraud Examiners has measured consistently across reporting cycles.1Association of Certified Fraud Examiners. Occupational Fraud 2024: A Report to the Nations For a $10 million business, that’s $500,000 gone every year. To prevent fraud in a company, you need five things working together: an ethics culture that has real teeth, financial duties split so no single person controls a transaction end to end, technology that enforces the rules automatically, a confidential channel employees actually trust, and audits that sometimes arrive without warning. Skip any one of those layers and the others weaken.
Start With Culture and Hiring
The strongest deterrent is not software. It’s what employees believe will happen if someone gets caught. When leaders visibly prioritize integrity over hitting quarterly numbers, that standard spreads. When a top performer gets a quiet pass, everyone notices that too. There is no neutral position on this.
Make expectations concrete with a written code of conduct. It should name what is off-limits: conflicts of interest, kickbacks, misuse of company resources, falsifying records. Have every employee sign an acknowledgment that they’ve read and understood it. The SEC requires exactly this kind of written acknowledgment for investment adviser codes of ethics, and the practice works well in any organization.2Securities and Exchange Commission. Investment Adviser Codes of Ethics Re-certify annually so the document doesn’t gather dust.
Enforce the code consistently, whoever is involved. The moment a senior executive gets treatment a junior employee wouldn’t, the policy becomes decorative.
Pair the code with fraud awareness training that focuses on the schemes most likely to hit your industry: billing fraud where you have large vendor networks, payroll manipulation where the workforce is distributed, expense reimbursement abuse where people travel. Employees who can spot a fake invoice or a ghost employee on the payroll are more useful than employees who sat through an hour of abstract ethics content.
Background Checks
Screen candidates before they touch sensitive systems or financial data. Criminal history, employment verification, and credit history for finance-related roles are baseline. In the securities industry, FINRA requires member firms to investigate an applicant’s character, business reputation, and qualifications before sponsoring registration, and that standard is worth borrowing outside regulated industries.3FINRA. Regulatory Notice 15-05 – SEC Approves Consolidated FINRA Rule Regarding Background Checks on Registration Applicants
If you use a third-party screening service, the Fair Credit Reporting Act requires a clear written disclosure in a standalone document that contains nothing else, plus the candidate’s written authorization before the report is pulled.4Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports Don’t bundle liability waivers or accuracy certifications into the disclosure form. Employers that violate these rules face class-action exposure.
Split Financial Duties So No One Person Controls a Transaction
Effective internal controls work on a simple principle: fraud that requires two people to collude is much harder to pull off than a solo act. Build your processes so no single person can authorize, execute, record, and review the same transaction.
Segregation of Duties
Split every financial process across at least two people. The employee who receives cash payments shouldn’t record those payments in the ledger. The person who approves vendor invoices shouldn’t be able to add new vendors to the system. When one person’s work automatically checks another’s, both errors and manipulation surface faster. Small companies tend to consolidate financial responsibilities in one or two people, which is exactly where embezzlement takes hold.
Authorization Limits and Purchase Orders
Set dollar thresholds that trigger extra approvals. A routine supply order might need one manager’s sign-off; a capital expenditure above a defined amount needs both a department head and the CFO. Approval has to happen before the commitment is made, not after the money leaves the account.
A purchase order system enforces this by documenting the approval chain up front. When an invoice arrives, accounts payable matches it against the original PO and a receiving report confirming the goods or services actually arrived. Invoices without a matching, pre-approved PO get flagged and rejected. This three-way match is one of the most reliable defenses against billing fraud, and it’s practical for mid-sized companies.
Reconciliations and the Vendor Master File
Monthly bank reconciliations should be done by someone who doesn’t handle cash, prepare deposits, or write checks. The independence is what makes the reconciliation meaningful. A reviewer with no reason to hide a discrepancy will catch unauthorized transactions, altered checks, and unrecorded withdrawals that the person handling cash never would have flagged.
Scrub the vendor master file periodically. Look for duplicate vendor names, vendors sharing a mailing address with an employee, or multiple vendors using the same tax ID. Those are classic shell company indicators. A manager outside accounts payable should own this review, so the people who created the vendor records aren’t the ones checking them.
Physical Assets and Credit Cards
Inventory belongs in secured, access-monitored storage with regular cycle counts. Check stock belongs in a locked safe accessible only to authorized signers.
Company credit cards need individual spending limits and monthly reviews by a supervisor who isn’t the cardholder.5National Credit Union Administration. Examiners Guide – Corporate Credit Cards The reviewer should verify every transaction is business-related and supported by a receipt. Personal purchases on corporate cards are among the most common low-level frauds, and they thrive wherever statements go unreviewed.
Use Technology to Enforce the Rules
Technology automates the controls people forget, skip, or override under deadline pressure. When systems enforce rules by default, you’re not relying on everyone to follow the policy manual every time.
Access Controls and Multi-Factor Authentication
Apply least privilege: employees get access only to what their role requires. A sales rep has no business in the accounts receivable ledger. A warehouse manager doesn’t need payroll records. Role-based restrictions keep people out of places where they could manipulate records unseen.
Multi-factor authentication should be mandatory for any system touching financial data. Federal banking regulators have issued interagency guidance recognizing that single-factor authentication is inadequate where risk assessments show elevated exposure.6Board of Governors of the Federal Reserve System. Authentication and Access to Financial Institution Services and Systems Interagency Guidance FINRA has mandated MFA for all active users logging into its systems.7FINRA. Multi-Factor Authentication A second verification step, whether a code from an authenticator app or a hardware token, makes unauthorized access far harder.
Transaction Monitoring
Continuous monitoring tools analyze transaction patterns in real time and flag anomalies that periodic manual reviews miss: an unusually large payment to a new vendor, a transaction processed at 2 a.m., a series of purchases hovering just below the approval threshold.
Speed is the real payoff. ACFE’s 2024 data shows a typical fraud runs about 12 months before detection, and median losses climb steeply the longer a scheme goes on: $50,000 for schemes lasting under a year, rising to $250,000 for schemes running a decade or more.8Association of Certified Fraud Examiners. 2024 ACFE Report to the Nations Automated monitoring shortens that window.
Audit Logs and Cybersecurity
External attackers can manipulate financial systems as effectively as insiders. Encrypted storage, current firewall protections, and regular penetration testing by an outside firm are baseline defenses. If nobody independent has probed your systems in the past year, you’re guessing about your exposure.
Log who accessed what and when. Employees who know their actions are logged and reviewed behave differently from employees who believe nobody is watching. All changes to critical system parameters, including approval thresholds, user permissions, and vendor records, should be logged automatically and reviewed by someone outside the team that made the changes.
Give Employees a Safe Way to Report
Tips are the single most effective fraud detection method by a wide margin. ACFE’s 2024 data shows 43% of occupational fraud cases were uncovered through tips, more than three times any other detection method.1Association of Certified Fraud Examiners. Occupational Fraud 2024: A Report to the Nations More than half of those tips came from employees. An organization without a trusted reporting channel is asking its best detection asset to stay quiet.
A third-party hotline available around the clock through phone, web portal, and text removes the fear that IT will trace the report or a supervisor will recognize the caller’s voice. Internal-only channels tend to suppress information because people worry about being identified. The cost of an external hotline is modest compared with the cost of a scheme that runs unchecked for months.
Non-Retaliation Protections
A reporting channel without real retaliation protections is a suggestion box no one uses. Your non-retaliation policy should be explicit, communicated during onboarding and annual training, and backed by consequences for anyone who retaliates.
Federal law reinforces internal policies for public companies. The Sarbanes-Oxley Act prohibits companies with registered securities from retaliating against employees who report conduct they reasonably believe amounts to securities fraud, bank fraud, wire fraud, or violations of SEC rules. An employee who faces retaliation can file a complaint with OSHA within 180 days and, if successful, is entitled to reinstatement, back pay with interest, and reasonable attorney fees.9Office of the Law Revision Counsel. 18 USC 1514A – Civil Action to Protect Against Retaliation in Fraud Cases
The Dodd-Frank Act went further and created a private right of action letting whistleblowers sue their employer directly in federal court for retaliation. Successful claimants can recover double back pay with interest, reinstatement, and litigation costs.10Securities and Exchange Commission. Whistleblower Protections
The SEC Whistleblower Award
Federal law also creates a financial incentive to report. Individuals who voluntarily provide original information leading to an SEC enforcement action with sanctions over $1 million can receive awards between 10% and 30% of the money collected.11Securities and Exchange Commission. Whistleblower Program That changes the calculus for employees sitting on knowledge of a major fraud. Companies that investigate internal complaints promptly and take them seriously usually resolve problems before an employee feels the need to go directly to the SEC.
How to Handle a Report
Speed matters when a credible tip comes in. Secure electronic files, physical documents, and system access logs immediately, before anyone involved can destroy or alter records. Assign the investigation to a team with no conflict of interest. If the allegation involves a senior manager, the team should report directly to the board’s audit committee, not to the manager’s peers. Maintain confidentiality. Document what evidence was collected, who was interviewed, what was concluded, and what actions followed. A poorly documented internal investigation can make a company’s legal position worse, not better.
Audit Regularly, and Sometimes Without Warning
Scheduled audits catch problems. Surprise audits change behavior. ACFE data consistently shows unannounced reviews are among the most effective fraud-reducing controls, yet fewer than a third of organizations use them. If employees know an audit happens every December, they manage their exposure accordingly. If an audit can happen any Tuesday, the calculation shifts.
Build audit activity into the annual plan and make some of it unpredictable. Unannounced reviews of cash handling, procurement, expense reimbursements, and vendor payments send a stronger signal than a scheduled year-end review alone. External auditors bring objectivity that internal teams struggle to match, especially where personal relationships exist between reviewers and reviewed.
Public companies also carry specific obligations that private companies can borrow from. Under Sarbanes-Oxley, the CEO and CFO must personally certify the accuracy of financial reports and the effectiveness of internal controls in every annual and quarterly filing, and disclose any material weaknesses to the auditors and audit committee.12Office of the Law Revision Counsel. 15 USC 7241 – Corporate Responsibility for Financial Reports Personal certification creates personal accountability, and executives who must sign their names to internal control assessments tend to pay closer attention to whether those controls actually work. Companies with U.S.-listed securities also face the Foreign Corrupt Practices Act’s accounting provisions, which require accurate books and records and an internal accounting control system sufficient to ensure transactions are authorized, properly recorded, and reconciled against actual assets at reasonable intervals.13Office of the Law Revision Counsel. 15 USC 78m – Periodical and Other Reports
Carry Fidelity Bond Coverage as a Backstop
Even a strong prevention program can’t stop every scheme. Fidelity bonds, sometimes called employee dishonesty insurance or commercial crime policies, reimburse losses caused by employee theft and fraud. They sit behind the procedural and technological controls and limit the financial damage when prevention fails. Small businesses in particular should treat this coverage as essential, because a single dishonest employee in a trusted position can inflict losses a small company simply cannot absorb.