Key points
- Separate authorizing, recording and handling cash wherever possible.
- Where you cannot, add owner review: monthly bank statements, payroll registers and new vendors.
- Verify any change to a supplier's banking details by phone using a number you already have.
Core controls
- Segregation of duties: the person who records payments should not also approve and release them.
- Payment approval: dual authorization in online banking for payments above a set amount.
- Vendor master changes: any new vendor or change in banking details requires independent verification.
- Owner review: the owner reviews bank statements, the payroll register and the AR aging every month.
- Period lock: close completed months in the accounting system.
- Access: individual logins with appropriate permissions. No shared passwords, and remove access promptly when people leave.
- Backups: regular, tested backups of accounting data and key documents.
Common fraud patterns
| Scheme | Control that stops it |
|---|---|
| Fake email from a "supplier" announcing new bank details | Call-back verification to a known number |
| Fake email from the "CEO" urgently requesting a transfer | Payment approval workflow with no exceptions |
| Ghost employees on payroll | Owner review of the payroll register |
| Fictitious vendors | Independent approval of new vendors |
Report suspected fraud to your bank immediately and to the Canadian Anti-Fraud Centre.
Official sources
Need help applying this to your business?
We work with owner-managed businesses on financing packages, workflows and accounting systems, as fixed-fee projects with clear deliverables.
Book a discovery call