Controls and Fraud

Segregation of duties, approvals, vendor changes and the red flags of fraud.

Reference Notes

Internal controls for a small company: segregation of duties, approvals, reconciliations

The controls that matter most in a small company are the ones that keep one person from both starting a transaction and hiding it: separate approval from payment where the team allows, have an owner review the bank statements and the payroll register, reconcile every account monthly, restrict who can add a vendor or change bank details, and keep a review step for manual journal entries. Where there are too few people to separate duties, a documented compensating control, usually owner review, is what an auditor will look for. Walkthroughs written down before somebody tests them are most of what controls documentation means.

Source: COSO framework; practiceLast revised September 2026General information, not advice

Fraud risk, red flags, the fraud triangle, kickbacks and conflicts of interest

The ACFE sorts occupational fraud into three kinds: asset misappropriation, such as fictitious vendors, payroll ghosts and skimmed receipts; corruption, such as kickbacks and a conflict of interest with a vendor that an employee has not declared; and financial statement fraud, such as revenue recorded early or liabilities left off. The auditing standard (AU-C 240) groups the risks in two, misappropriation of assets and fraudulent financial reporting. Fraud happens where pressure, opportunity and rationalization meet, and the opportunity is the part controls remove. Red flags include a bookkeeper who never takes leave, vendors with post-office-box addresses, a buyer or an approver related to a vendor, reconciliations that are always late, and a lifestyle nobody can explain.

Source: ACFE Occupational Fraud and Abuse Classification System; AICPA AU-C 240Last revised September 2026General information, not advice

Accounts payable process, approvals and vendor master control

A payable is recorded when the goods or service are received, approved by somebody other than the person who entered it, scheduled for payment on its terms, and paid from an approved run rather than one at a time. Adding a vendor or changing a vendor's bank details is the step fraud goes through, so it is restricted and verified by calling a known number. The aging is reviewed at every close for old balances that are either wrong or forgotten.

Source: PracticeLast revised September 2026General information, not advice

Study

Test Yourself

A few questions on Controls and Fraud, drawn from the notes on this page, to check what stuck.

The assistant writes these questions from the reference notes on this page each time you ask. A generated question or answer can be wrong: check it against the standard the explanation names. General information, not advice.

Read this once

How to Read These Notes

General information, not advice.

A note is about accounting in general. It is not advice about your situation and it is not an engagement. When a number matters — a filing, a covenant, a sale — put it to a person.

Each note names its source.

Read the standard it cites before you act on it. “Last revised” is the month the note was last written or corrected against that source.

A question these notes do not answer.

The assistant answers accounting questions in plain language. Ask About Controls and Fraud →

A note answers a general question. Your books answer the specific one — the first conversation is a look at them and an honest answer about whether we are the right firm.

Start a Conversation Estimate an Engagement