Controls that stop fraud

Most effective anti-fraud controls are neither expensive nor sophisticated. They are simple disciplines, applied consistently, that remove the opportunity corner of the fraud triangle.

Segregation of duties

No single person should control a transaction from start to finish. The person who sets up a new supplier should not be the person who approves invoices for it. The person who prepares a payment run should not be the only person who can release it. The person who handles cash should not also reconcile the account it goes into. Segregation means a fraud needs either collusion or an override to succeed, and both are far easier to detect than a lone insider acting quietly within their own remit. In small teams where full segregation is impossible, compensating checks, such as an owner or manager independently reviewing bank activity, fill the gap.

Four-eyes checks on payments

Every payment above a sensible threshold, and every payment with anything unusual about it, should be seen and approved by a second person before it leaves the account. The second pair of eyes is checking substance, not just clicking approve: does this supplier exist, does the amount match the invoice, does the invoice match an order, are these the bank details we hold. A four-eyes check that has become a rubber stamp is not a control.

Verifying bank detail changes

The single control that defeats most mandate fraud: any request to change bank account details, for a supplier, a customer refund, or an employee's salary, is verified by phone with the requester on a number you already hold from your own records. Never use a number, email address, or link supplied in the request itself, because if the request is fraudulent, everything in it belongs to the fraudster. Make the call, confirm the change, and record that you did.

Supporting disciplines

• Keep supplier master data tidy: close dormant accounts and restrict who can edit records
• Reconcile bank accounts, payroll, and supplier statements regularly, with independent review
• Check that goods and services were actually received before invoices are paid
• Review system access when people change roles or leave

None of this requires suspicion of colleagues. Good controls protect honest staff too, because when something goes wrong, the process shows who did what and clears those who did their jobs properly.