In a company of five, the owner sees everything. At twenty, they do not, and the transition is rarely marked by a decision — it is noticed afterwards, usually because something went wrong.
Separate who approves from who pays
The single most valuable control. The person who authorises a purchase should not be the person who executes the payment, and neither should be the only person who reconciles the account.
Where headcount makes full separation impossible, compensate with visibility: the owner reviews the bank statement personally, every month, line by line. It takes twenty minutes and it is the most effective fraud deterrent available to a small company.
Put a number on authority
Write down who can commit the company to what. Up to a stated amount, a manager decides. Above it, a second signature. Above that, the owner.
The thresholds matter less than their existence. Without them, either everything reaches the owner — which defeats the point of hiring managers — or nothing does, which is worse.
Reconcile on a schedule, not on suspicion
Bank, cash, inventory, receivables. Monthly, by someone who did not record the transactions, with a signature and a date.
Most errors are just errors. Reconciliation finds them while they are cheap, and its deterrent value comes precisely from being routine rather than triggered.
Control the master data
Who can add a supplier, change bank details, or alter a price? This is the gap that payment fraud walks through, almost always by way of an emailed request to update account details.
Require a second person to confirm any bank detail change, by a channel other than the one the request arrived on. A phone call to a known number prevents more loss than any amount of policy.
None of this needs software. It needs four decisions, written down, and an owner who keeps doing the monthly review after the novelty wears off.