
When a small business owner discovers internal theft, the shock is not the money. It is who took it. In nearly every case investigated, the responsible party was long-serving, well-liked and trusted with exactly the access that made the theft possible.
The Access Problem
Small businesses concentrate financial control in one person out of necessity. That person often opens the mail, enters the invoices, reconciles the accounts, handles the deposits and manages the vendor relationships. Every internal control textbook calls this a fatal separation-of-duties failure, and every small business does it anyway, because there is nobody else.
How Losses Happen
- Fictitious vendors invoicing for services never rendered
- Payroll manipulation — ghost employees, inflated hours, unapproved bonuses
- Skimming cash before it is ever recorded, which no book will reveal
- Voids, refunds and discounts issued to friends or to the employee's own cards
- Inventory shrinkage disguised as damage, spoilage or returns
- Personal expenses run through the company card, often starting very small
The Signs
The most reliable indicator is an employee who never takes a holiday and resists anyone covering their duties. Schemes usually require daily maintenance and collapse when someone else opens the mail for a week. Others: an unwillingness to hand over reconciliations, defensiveness about routine questions, an unexplained change in lifestyle, and a margin that has quietly eroded without any change in the business.
Investigating Without Detonating the Business
The instinct is to confront immediately. That is the worst available option: it destroys the evidence, triggers deletion, and frequently produces a wrongful-dismissal or defamation claim on top of the loss. The correct sequence is to quietly preserve records first, quantify the loss with a professional, take legal advice, and only then decide between civil recovery, criminal referral or a negotiated exit.
Polygraph in Loss Investigations
Specific-issue polygraph can be valuable in narrowing a small suspect pool, but employment testing is tightly restricted by law in the United States and prohibited in many circumstances. Never test an employee without legal advice on what is permitted in your jurisdiction. A firm that offers to run staff testing without raising this is a liability.
Afterwards
Every recovered case should end with the boring fix: two signatures on payments over a threshold, an owner who opens the bank statement personally, mandatory holidays, and an annual independent review. It is cheap, it is dull, and it is the only thing that stops a repeat.
Need Help With This?
- Corporate investigations & due diligence — with Dan Ribacoff
- Offices in New York City, Long Island, Westchester, Boca Raton FL and London
- Request a confidential consultation · All services
- External: IIGPI.com
Dan Ribacoff is a licensed private investigator and the founder of International Investigative Group, a certified polygraph examiner, certified firearms instructor, GIA Graduate Gemologist and the author of I, Spy: How to Be Your Own Private Investigator. He works from offices in New York, Boca Raton and London, and has appeared as a polygraph expert on American and British television.