What checks can a very small business put in place when the same person records, pays and reconciles?

What splitting the work is supposed to protect you from

Segregation of duties is defined as an internal control principle that divides key responsibilities among different individuals in order to reduce the risk of error or fraud. (jurisdiction: not stated in the document; general accounting-concept article published by US-based AccountingTools, Inc., entity_scope: businesses generally)

“Segregation of duties is an internal control principle that divides key responsibilities among different individuals to reduce the risk of error or fraud.”

The article states that no single person should control authorization, recordkeeping and custody of assets for the same transaction — these are the three functions segregation of duties separates. (jurisdiction: not stated in the document; general accounting-concept article published by US-based AccountingTools, Inc., entity_scope: businesses generally; applied per transaction, conditions: for the same transaction)

“No single person should control authorization, recordkeeping, and custody of assets for the same transaction.”

Separating these responsibilities creates checks and balances within processes and limits the ability to conceal mistakes or misappropriation. (jurisdiction: not stated in the document; general accounting-concept article published by US-based AccountingTools, Inc., entity_scope: businesses generally)

“This separation creates checks and balances within processes. It limits the ability to conceal mistakes or misappropriation.”

Separating invoice entry from payment authorization is said to stop one person from creating a fake invoice and approving it for payment themselves — the specific exposure the separation addresses. (jurisdiction: not stated in the document; general accounting-concept article published by US-based AccountingTools, Inc., entity_scope: businesses generally; illustrative example)

“This separation ensures that someone cannot create a fake invoice and approve it for payment themselves.”

Required authority: authoritative professional or accounting standard. Highest achieved: high quality professional secondary reference.

Segregation of duties: the definition and the three functions it keeps apart

See Segregation of duties is defined as an internal control principle that divides key responsibilities among different individuals in order to reduce the risk of error or fraud.

See The article states that no single person should control authorization, recordkeeping and custody of assets for the same transaction — these are the three functions segregation of duties separates.

Segregation of duties is more difficult to accomplish in a smaller organization, because there are too few people to effectively shift tasks to different people. (jurisdiction: not stated in the document; general accounting-concept article published by US-based AccountingTools, Inc., entity_scope: smaller organizations)

“The segregation of duties is more difficult to accomplish in a smaller organization, where there are too few people to effectively shift tasks to different people.”

"Segregation of duties" and "separation of duties" are names for the same concept. (jurisdiction: not stated in the document; general accounting-concept article published by US-based AccountingTools, Inc., entity_scope: terminology)

“The segregation of duties is also known as the separation of duties”

Partly established. Established: the recognised definition of segregation of duties in accounting (S01); the functions segregation of duties separates (S02). Missing: the concept of a compensating control where separation cannot be achieved.

Required authority: authoritative professional or accounting standard. Highest achieved: high quality professional secondary reference.

What one person recording, paying and reconciling exposes you to

The report defines occupational fraud as the use of one's occupation for personal enrichment through the deliberate misuse or misapplication of the employing organization's resources or assets — i.e. the study's subject is deliberate conduct, distinct from error. (jurisdiction: Global (ACFE report covering 2,402 cases from 143 countries and territories), entity_scope: terminology used across the study's victim organizations of all types and sizes, conditions: definition used for case eligibility in the survey)

“Occupational fraud: The use of one’s occupation for personal enrichment through the deliberate misuse or misapplication of the employing organization’s resources or assets”

The report defines a billing scheme as a fraudulent disbursement scheme in which a person causes their employer to issue a payment by submitting invoices for fictitious goods or services, inflated invoices, or invoices for personal purchases. (jurisdiction: Global (ACFE report covering 2,402 cases from 143 countries and territories), entity_scope: terminology used across the study's victim organizations of all types and sizes, conditions: examples given with 'e.g.', not an exhaustive list)

“Billing scheme: A fraudulent disbursement scheme in which a person causes their employer to issue a payment by submitting invoices for fictitious goods or services, inflated invoices, or invoices for personal purchases (e.g., employee creates a shell company and bills employer for services not actually rendered; employee purchases personal items and submits an invoice to employer for payment)”

The report defines check or payment tampering as a fraudulent disbursement scheme in which a person steals their employer's funds by intercepting, forging or altering a check or electronic payment drawn on one of the organization's bank accounts. (jurisdiction: Global (ACFE report covering 2,402 cases from 143 countries and territories), entity_scope: terminology used across the study's victim organizations of all types and sizes, conditions: examples given with 'e.g.', not an exhaustive list)

“Check or payment tampering scheme: A fraudulent disbursement scheme in which a person steals their employer’s funds by intercepting, forging, or altering a check or electronic payment drawn on one of the organization’s bank accounts (e.g., employee steals blank company checks and makes them out to themself or an accomplice; employee re-routes an outgoing electronic payment to a vendor to be deposited into their own bank account)”

Forcing or altering account reconciliations was a concealment method reported in 7% of the study's cases. (jurisdiction: Global (ACFE report covering 2,402 cases from 143 countries and territories), entity_scope: victim organizations in the study, all types and sizes, conditions: based on 2,402 cases investigated January 2024–September 2025; multiple concealment methods could be selected per case)

“Forced or altered account reconciliations 7%”

Partly established. Established: the deliberate misappropriation exposures created by combining recording, payment and reconciliation in one person (S04). Missing: the undetected error exposures created by combining recording, payment and reconciliation in one person.

Required authority: authoritative professional or accounting standard. Highest achieved: high quality professional secondary reference.

What the fraud and control evidence says about small businesses that cannot separate duties

The ACFE's fraud prevention checklist asks organizations to test whether strong anti-fraud controls are in place and operating effectively, naming among such controls (the list is stated as 'including') proper separation of duties, use of authorizations, physical safeguards, job rotations and mandatory vacations. (jurisdiction: Global (ACFE report covering 2,402 cases from 143 countries and territories), entity_scope: organizations generally, as addressed by the ACFE's self-test checklist, conditions: checklist is a self-test tool, not a requirement; list is introduced as 'including the following', i.e. open)

“6. Are strong anti-fraud controls in place and operating effectively, including the following? ☐ Proper separation of duties ☐ Use of authorizations ☐ Physical safeguards ☐ Job rotations ☐ Mandatory vacations”

All 18 anti-fraud controls the study examined were associated with reduced median losses and faster detection, with management review, proactive data monitoring and analysis, a code of conduct and surprise audits associated with the largest reductions in both measures. (jurisdiction: Global (ACFE report covering 2,402 cases from 143 countries and territories), entity_scope: victim organizations in the study, all types and sizes, conditions: association only, comparing organizations with and without each control; limited to the 18 controls studied)

“As shown in Figures 28 and 29, all 18 controls were associated with reduced median losses and faster detection. Among these, four controls—management review, proactive data monitoring and analysis, a code of conduct, and surprise audits—were associated with the largest reductions in both measures.”

The report states that small businesses often lack the resources to prioritize large investments of time or money in an anti-fraud program, and that as a result their implementation rate of anti-fraud controls is dramatically lower than at larger organizations. (jurisdiction: Global (ACFE report covering 2,402 cases from 143 countries and territories), entity_scope: small businesses (the study's comparison uses victim organizations with fewer than 100 employees), conditions: hedged: 'often do not have the resources')

“Small businesses often do not have the resources to prioritize large investments of time or money in their anti-fraud program. As a result, the implementation rate of anti-fraud controls in these organizations is dramatically lower than in their larger counterparts.”

Respondents cited lack of internal controls as the primary weakness in one-third of cases, override of existing internal controls in 19% and lack of management review in 18%; together these three accounted for 70% of the study's frauds. (jurisdiction: Global (ACFE report covering 2,402 cases from 143 countries and territories), entity_scope: victim organizations in the study, all types and sizes, conditions: respondents reported the single primary internal control weakness)

“As shown in Figure 37, one-third of cases occurred due to the victim organization lacking internal controls, with another 19% resulting from an override of existing internal controls. The next most common weakness cited was a lack of management review (18%). Collectively, these three weaknesses accounted for 70% of all frauds in our study.”

Partly established. Established: the residual risk that guidance says remains (S23, S24). Missing: the compensating controls authoritative small-entity internal-control guidance identifies where duties cannot be separated; the role that guidance assigns to owner involvement; the exposures that guidance attributes to one person recording, paying and reconciling, distinguishing misappropriation from undetected error; which measures answer each of those exposures; whether that guidance treats absence or rotation of those duties as surfacing concealment; the evidence it expects a performed control to leave of what was examined; the evidence it expects a performed control to leave of what would have looked wrong; the evidence it expects a performed control to leave that it was done.

Required authority: authoritative professional or accounting standard. Highest achieved: high quality professional secondary reference.

The checks the owner has to perform personally

Having a second person verify and authorize payments helps (not guarantees) detection of unusual transactions and prevention of fraud, and the article calls it a critical control for reducing the risk of fictitious vendor schemes. (jurisdiction: not stated in the document; general accounting-concept article published by US-based AccountingTools, Inc., entity_scope: businesses generally; illustrative example, conditions: hedged: "helps detect")

“A second person verifying and authorizing payments helps detect unusual transactions and prevent fraud. This is a critical control in reducing the risk of fictitious vendor schemes.”

In the payroll context, audit logs and reconciliations performed by an independent reviewer further reduce fraud risk (stated as additional measures alongside divided roles). (jurisdiction: not stated in the document; general accounting-concept article published by US-based AccountingTools, Inc., entity_scope: businesses generally; illustrative payroll example, conditions: reviewer must be independent)

“Audit logs and reconciliations by an independent reviewer further reduce the fraud risk.”

The checklist asks whether managers actively review the controls, processes, accounts or transactions under their purview for adherence to company policies and expectations. (jurisdiction: Global (ACFE report covering 2,402 cases from 143 countries and territories), entity_scope: organizations generally, as addressed by the ACFE's self-test checklist, conditions: checklist question, not a requirement)

“☐ Do managers actively review the controls, processes, accounts, or transactions under their purview for adherence to company policies and expectations?”

The report states that through internal controls and policies that actively detect misconduct — examples given being management review, account reconciliation, and surveillance and monitoring — organizations can potentially reduce the impact of fraud. (jurisdiction: Global (ACFE report covering 2,402 cases from 143 countries and territories), entity_scope: organizations generally, as addressed by the report, conditions: hedged: 'can potentially reduce'; list is introduced by 'such as', i.e. open)

“Through internal controls and policies that actively detect misconduct, such as management review, account reconciliation, and surveillance and monitoring, organizations can potentially reduce the impact of fraud.”

Not established from an authoritative source.

Required authority: authoritative professional or accounting standard. Highest achieved: high quality professional secondary reference.

What a check leaves behind to show it actually happened

See The checklist asks whether managers actively review the controls, processes, accounts or transactions under their purview for adherence to company policies and expectations.

The report defines management review as the process of management reviewing organizational controls, processes, accounts or transactions for adherence to company policies and expectations. This is a definition, not a requirement. (jurisdiction: Global (ACFE report covering 2,402 cases from 143 countries and territories), entity_scope: terminology used across the study's victim organizations of all types and sizes, conditions: definition used for survey classification)

“Management review: The process of management reviewing organizational controls, processes, accounts, or transactions for adherence to company policies and expectations”

Bills pending approval can also be viewed on the Bills page, on the Unpaid tab, under the "Approval Status" column. (jurisdiction: United States (QuickBooks US en-US help centre edition), entity_scope: Companies with a bill approval workflow enabled, platform: QuickBooks Online / QuickBooks Bill Pay, platform_edition: QuickBooks Bill Pay Elite)

“You can also view all bills pending approval on the Bills page. Go to the Bills page and on the Unpaid tab see all bills that are pending approval under the “Approval Status” column.”

Not established from an authoritative source.

Controls you can get from the bank, the card issuer and the payment platform

Chase describes Access & Security Manager as giving a user access only to the accounts and services the business customer sets. (jurisdiction: United States, entity_scope: Chase for Business business-banking customers using Chase online banking, platform: Chase for Business online banking — Access & Security Manager, platform_edition: current Chase.com Helpful Tips page, undated (site copyright 2026))

“Give access only to the accounts and services you set.”

Assigning rights starts with selecting an access level under each account, so access levels are set at the level of individual accounts. (jurisdiction: United States, entity_scope: Chase for Business business-banking customers using Chase online banking, platform: Chase for Business online banking — Access & Security Manager, platform_edition: current Chase.com Helpful Tips page, undated (site copyright 2026))

“To assign rights, start by selecting access level under each account”

Depending on the access level selected, the business can choose some, all or none of the additional services Chase offers for that user and can assign daily limits; the page does not say which services or what limit values are available. (jurisdiction: United States, entity_scope: Chase for Business business-banking customers using Chase online banking, platform: Chase for Business online banking — Access & Security Manager, platform_edition: current Chase.com Helpful Tips page, undated (site copyright 2026), conditions: the choice of additional services is based on the access level selected)

“Based on access level selected – choose some, all or none of the additional services we offer and assign daily limits”

Chase states that Authorized Users must abide by or perform any obligation imposed upon the customer, that other limitations and fees may apply, and that details are set out in the Access and Security Manager Agreement and/or Digital Services Agreement. (jurisdiction: United States, entity_scope: Chase for Business customers and their Authorized Users, platform: Chase for Business online banking — Access and Security Manager online service, platform_edition: current Chase.com Helpful Tips page, undated (site copyright 2026), conditions: terms governed by the separate Access and Security Manager Agreement and/or Digital Services Agreement)

“Authorized Users must abide by or perform any obligation imposed upon you. Other limitations and fees may apply. See the Access and Security Manager Agreement and/or Digital Services Agreement for details.”

Chase states that the customer or an authorized user can approve a payment for processing through Access & Security Manager. (jurisdiction: United States, entity_scope: Chase for Business online banking customers using the Access & Security Manager service, and their authorized users, platform: Chase.com (Chase for Business online banking) — Access & Security Manager, conditions: user is signed in to Chase.com; Access and Security Manager online service is in use)

“You or an authorized user can easily approve a payment for processing.”

Chase states that after these steps the transactions are approved for payment and the user will be notified once they are processed. (jurisdiction: United States, entity_scope: Chase for Business online banking customers using Access & Security Manager, platform: Chase.com (Chase for Business online banking) — Access & Security Manager, conditions: the approval steps described on the page have been completed)

“You have now approved transactions for payment and will be notified once processed”

Chase presents alerts and notifications as a way for a customer to monitor a Chase account, and introduces a set of steps for setting them up. (jurisdiction: United States, entity_scope: Chase account holders using Chase online banking; page is filed under Chase for Business / Business Banking helpful tips, platform: Chase online banking (chase.com) / Chase Mobile app)

“It’s easy to monitor your account with alerts and notifications. Here’s how:”

A delivery method for alerts can be added or edited under "Delivery preferences", so the channel an alert is sent to is set by the customer; the page does not list which channels are offered. (jurisdiction: United States, entity_scope: Chase account holders using Chase online banking, platform: Chase online banking (chase.com) / Chase Mobile app)

“Add or edit a delivery method under "Delivery preferences"”

Chase states that delivery of alerts may be delayed for various reasons, giving an open list of examples including service outages affecting the customer's phone, wireless or internet provider, technology failures, and system capacity limitations; alert timeliness is therefore not guaranteed. (jurisdiction: United States, entity_scope: Chase account holders receiving account alerts, platform: Chase account alerts, conditions: reasons listed are examples ("including"), not an exhaustive list)

“Delivery of alerts may be delayed for various reasons, including service outages affecting your phone, wireless or internet provider; technology failures; and system capacity limitations.”

American Express describes Employee Cards as a tool for staying on top of business expenses that lets employees buy what they need within limits the business Card Member sets (limits subject to footnote 1). (jurisdiction: United States, entity_scope: US small businesses holding an American Express Business Card account, platform: American Express Business Blueprint, platform_edition: Help Center article dated January 24, 2025, effective_from: 2025-01-24, conditions: limits qualified by footnote 1 (Employee Card Spending Limits Terms and Conditions))

“Employee Cards are a helpful tool for staying on top of your business expenses, allowing employees to buy what they need within limits 1 you set.”

Amex states the Card Member will receive real-time Merchant Category Alerts when employees spend outside the Card Member's approved merchant types; examples given of merchant types include U.S. gas stations, U.S. shipping and U.S. office supply stores (an open, illustrative list). (jurisdiction: United States, entity_scope: US small-business Amex Business Card account holders with Employee Cards, platform: American Express Business Blueprint, platform_edition: Help Center article dated January 24, 2025, effective_from: 2025-01-24, conditions: requires the Card Member to have set approved merchant types; footnote 3: terms, conditions and restrictions vary by individual Card products)

“You’ll receive real-time Merchant Category Alerts if employees spend outside of your approved merchant types, such as U.S. gas stations, U.S. shipping, and U.S. office supply stores. 3”

Employee Card Spending Limits may be set up either online or by calling the number on the back of the Card. (jurisdiction: United States, entity_scope: US small-business Amex Business Card account holders enrolling Employee Cards in spending limits, platform: American Express online servicing or telephone servicing, platform_edition: Help Center article dated January 24, 2025, effective_from: 2025-01-24)

“Employee Card Spending Limits may be set up online or by calling the number on the back of your Card.”

To be appointed an Account Manager, a person must be at least 18 years old and have a U.S. mailing address and a Social Security Number. (jurisdiction: United States, entity_scope: Individuals appointed as Account Managers on US Amex Business Card accounts, effective_from: 2025-01-24)

“Account Managers must be at least 18 years old and have a U.S. Mailing Address and Social Security Number.”

The Spending Limit is not a guarantee that the Employee Card Member will be able to make purchases up to that limit. (jurisdiction: United States, entity_scope: US Amex Employee Card Members subject to a Spending Limit, effective_from: 2025-01-24)

“The Spending Limit is not a guarantee that the Employee Card Member will be able to make purchases up to that limit.”

Customers on QuickBooks Bill Pay Elite or QuickBooks Online Advanced can create a bill payments (payment release) approval workflow. (jurisdiction: United States (QuickBooks US en-US help centre edition), entity_scope: QuickBooks Bill Pay Elite or QuickBooks Online Advanced customers, platform: QuickBooks Online / QuickBooks Bill Pay, platform_edition: QuickBooks Bill Pay Elite or QuickBooks Online Advanced, conditions: subscription to Bill Pay Elite or QuickBooks Online Advanced)

“QuickBooks Bill Pay Elite or QuickBooks Online Advanced customers can create a bill payments approval workflow.”

In a payment release approval workflow the approver is selected in the Do this block, and only admins can be approvers. (jurisdiction: United States (QuickBooks US en-US help centre edition), entity_scope: Approvers on a bill payments release approval workflow, platform: QuickBooks Online / QuickBooks Bill Pay, platform_edition: QuickBooks Bill Pay Elite or QuickBooks Online Advanced, conditions: approver must hold the admin role)

“In the Do this block , select the bill approver for when your set conditions are met. Note: Only admins can be approvers.”

When a bill payment is submitted for approval, a notification is sent to the approvers to review it. (jurisdiction: United States (QuickBooks US en-US help centre edition), entity_scope: Approvers on a bill payment release approval workflow, platform: QuickBooks Online / QuickBooks Bill Pay, platform_edition: QuickBooks Bill Pay Elite or QuickBooks Online Advanced)

“A notification will be sent to the approvers to review.”

Using workflows requires a subscription to either QuickBooks Bill Pay Elite or QuickBooks Online Advanced. (jurisdiction: United States (QuickBooks US en-US help centre edition), entity_scope: QuickBooks Bill Pay customers wanting to use workflows, platform: QuickBooks Online / QuickBooks Bill Pay, platform_edition: QuickBooks Bill Pay Elite or QuickBooks Online Advanced)

“You’ll need either QuickBooks Bill Pay Elite or QuickBooks Online Advanced to use workflows.”

Partly established. Established: approval before release obtainable from the bank, card issuer and payment platform (S31, S42); alerting obtainable from the bank, card issuer and payment platform (S33, S38); limits obtainable from the bank, card issuer and payment platform (S29, S37). Missing: independent statement delivery obtainable from the bank, card issuer and payment platform; what each of those controls requires to be set up.

Account-level protections providers offer, and what each requires before you can switch it on

See Chase describes Access & Security Manager as giving a user access only to the accounts and services the business customer sets.

See Assigning rights starts with selecting an access level under each account, so access levels are set at the level of individual accounts.

See Depending on the access level selected, the business can choose some, all or none of the additional services Chase offers for that user and can assign daily limits; the page does not say which services or what limit values are available.

See Chase states that Authorized Users must abide by or perform any obligation imposed upon the customer, that other limitations and fees may apply, and that details are set out in the Access and Security Manager Agreement and/or Digital Services Agreement.

See Chase states that the customer or an authorized user can approve a payment for processing through Access & Security Manager.

See Chase states that after these steps the transactions are approved for payment and the user will be notified once they are processed.

See Chase presents alerts and notifications as a way for a customer to monitor a Chase account, and introduces a set of steps for setting them up.

See A delivery method for alerts can be added or edited under "Delivery preferences", so the channel an alert is sent to is set by the customer; the page does not list which channels are offered.

See Chase states that delivery of alerts may be delayed for various reasons, giving an open list of examples including service outages affecting the customer's phone, wireless or internet provider, technology failures, and system capacity limitations; alert timeliness is therefore not guaranteed.

See American Express describes Employee Cards as a tool for staying on top of business expenses that lets employees buy what they need within limits the business Card Member sets (limits subject to footnote 1).

See Amex states the Card Member will receive real-time Merchant Category Alerts when employees spend outside the Card Member's approved merchant types; examples given of merchant types include U.S. gas stations, U.S. shipping and U.S. office supply stores (an open, illustrative list).

See Employee Card Spending Limits may be set up either online or by calling the number on the back of the Card.

See To be appointed an Account Manager, a person must be at least 18 years old and have a U.S. mailing address and a Social Security Number.

See Customers on QuickBooks Bill Pay Elite or QuickBooks Online Advanced can create a bill payments (payment release) approval workflow.

See In a payment release approval workflow the approver is selected in the Do this block, and only admins can be approvers.

See When a bill payment is submitted for approval, a notification is sent to the approvers to review it.

See Using workflows requires a subscription to either QuickBooks Bill Pay Elite or QuickBooks Online Advanced.

Partly established. Established: the account-level protection of approval before release made available to a US small business (S31, S42); the account-level protection of alerting made available to a US small business (S33, S38); the account-level protection of transaction limits made available to a US small business (S29, S37). Missing: the account-level protection of independent statement delivery banks, card issuers and payment platforms make available to a US small business; what each of those protections requires of the business before it can be put in place, such as the account type, the authorisation and the enrolment the provider makes a condition of it.

Controls inside the accounting file, and the ones that need someone else to hold the admin role

See In a payment release approval workflow the approver is selected in the Do this block, and only admins can be approvers.

Zoho Books provides a Transaction Locking feature that helps freeze transactions for a specified period; once transactions are locked, transactions recorded before the specified lock date cannot be added, modified or deleted. (jurisdiction: United States (Zoho Books US edition help, US-EN), entity_scope: Zoho Books organizations, platform: Zoho Books, platform_edition: US edition (US-EN), current release; page lists Standard, Professional, Premium, Elite and Ultimate plans, conditions: applies to transactions recorded before the specified lock date)

“At the end of your accounting period, you may want to prevent the creation or modification of transactions that could affect your accounts. Transaction Locking in Zoho Books helps you freeze transactions for a specified period. Once transactions are locked, they cannot be added, modified, or deleted if recorded before the specified lock date.”

Locking the books in QuickBooks Online works by setting a lock date, and transactions dated on or before that date cannot be changed without approval. (jurisdiction: United States (QuickBooks Online US, en-us help article), entity_scope: QuickBooks Online company files, platform: QuickBooks Online, platform_edition: US (en-us) help article, updated 8/5/2026, conditions: boundary is a single date; the article does not say what 'approval' consists of beyond the security options it later lists)

“When you lock your books, you set a lock date. You can’t change any transactions on or before that date without approval.”

The documented procedure for reviewing accounts and locking the books has the user sign in to QuickBooks Online as a primary or company admin. (jurisdiction: United States (QuickBooks Online US, en-us help article), entity_scope: QuickBooks Online company files, platform: QuickBooks Online, platform_edition: US (en-us) help article, updated 8/5/2026, conditions: stated as a step in the documented procedure; the article does not state that other roles are barred)

“Sign in to QuickBooks Online as a primary or company admin”

Adding a user and assigning a Bill Pay role begins with signing in to QuickBooks Online as an admin, so the step is performed from an admin sign-in. (jurisdiction: United States (QuickBooks US en-US help centre edition), entity_scope: QuickBooks Online companies adding a Bill Pay user, platform: QuickBooks Online, conditions: admin sign-in)

“Sign in to QuickBooks Online as an admin.”

The Bill approver role can only approve bills and cannot pay bills or take other bill- or payment-related actions. (jurisdiction: United States (QuickBooks US en-US help centre edition), entity_scope: Users assigned the Bill approver role, platform: QuickBooks Online / QuickBooks Bill Pay, platform_edition: Bill Pay specific roles (QuickBooks Bill Pay Elite / QuickBooks Online Advanced))

“Bill approver : Users with this role can only approve bills. They can’t pay bills or take any other action related to bills or payments.”

The Bill clerk role can add bills, mark bills as paid, and add and edit vendors, but cannot approve or pay bills. (jurisdiction: United States (QuickBooks US en-US help centre edition), entity_scope: Users assigned the Bill clerk role, platform: QuickBooks Online / QuickBooks Bill Pay, platform_edition: Bill Pay specific roles (QuickBooks Bill Pay Elite / QuickBooks Online Advanced))

“Bill clerk : Users with this role can add bills, mark bills as paid, and add and edit vendors. They can't approve or pay bills.”

The Bill payer role can view and pay bills and edit vendor details, but cannot add bills or perform other bill-related actions. (jurisdiction: United States (QuickBooks US en-US help centre edition), entity_scope: Users assigned the Bill payer role, platform: QuickBooks Online / QuickBooks Bill Pay, platform_edition: Bill Pay specific roles (QuickBooks Bill Pay Elite / QuickBooks Online Advanced))

“Bill payer : Users with this role can view and pay bills, and edit vendor details. They can’t add bills or perform other bill related actions.”

Partly established. Established: the controls available inside the accounting file itself (S43, S46, S47, S49, S53, S54, S55). Missing: which of those controls depend on the administrator role being held by someone other than the person keeping the books.

What accounting platforms can lock down and restrict

See Zoho Books provides a Transaction Locking feature that helps freeze transactions for a specified period; once transactions are locked, transactions recorded before the specified lock date cannot be added, modified or deleted.

Once modules are locked, the transactions of those modules cannot be modified or deleted. (jurisdiction: United States (Zoho Books US edition help, US-EN), entity_scope: Zoho Books organizations, platform: Zoho Books, platform_edition: US edition (US-EN), current release, conditions: module locked)

“Once the modules are locked, their transactions cannot be modified or deleted.”

Partial unlocking is not allowed for organizations that have transactions involving inventory-tracking enabled items, because creating or modifying a transaction during the unlocked period could affect other transactions falling within the locked period. (jurisdiction: United States (Zoho Books US edition help, US-EN), entity_scope: Zoho Books organizations that have transactions involving inventory-tracking enabled items, platform: Zoho Books, platform_edition: US edition (US-EN), current release)

“Partial unlocking is not allowed for organizations that have transactions involving inventory-tracking enabled items. This is because creating or modifying a transaction during the unlocked period could affect other transactions that fall within the locked period.”

See Locking the books in QuickBooks Online works by setting a lock date, and transactions dated on or before that date cannot be changed without approval.

See The documented procedure for reviewing accounts and locking the books has the user sign in to QuickBooks Online as a primary or company admin.

See Adding a user and assigning a Bill Pay role begins with signing in to QuickBooks Online as an admin, so the step is performed from an admin sign-in.

See The Bill approver role can only approve bills and cannot pay bills or take other bill- or payment-related actions.

Custom roles require at least QuickBooks Online Advanced; without that access (after a downgrade) bills that need approval can be paid without approval and the roles that remain have limited functionality. (jurisdiction: United States (QuickBooks US en-US help centre edition), entity_scope: Customers who have downgraded their QuickBooks Bill Pay plan, platform: QuickBooks Online / QuickBooks Bill Pay, platform_edition: below QuickBooks Online Advanced / after downgrade from Bill Pay Elite, conditions: downgrade context; no QuickBooks Online Advanced subscription)

“You need at least QuickBooks Online Advanced for access to custom roles. This means that bills that need to be approved can be paid without approval. Some roles will still be available, but they will have limited functionality.”

Not established from an authoritative source.

Time away, rotation and surprise checks that bring concealment to the surface

See The ACFE's fraud prevention checklist asks organizations to test whether strong anti-fraud controls are in place and operating effectively, naming among such controls (the list is stated as 'including') proper separation of duties, use of authorizations, physical safeguards, job rotations and mandatory vacations.

Job rotation/mandatory vacation was in place in 27% of cases; victim organizations with the control had a median loss of USD 65,000 against USD 128,000 where it was absent, a 49% reduction. (jurisdiction: Global (ACFE report covering 2,402 cases from 143 countries and territories), entity_scope: victim organizations in the study, all types and sizes, conditions: median losses in USD; association between control presence and loss, not a causal claim)

“Job rotation/mandatory vacation 27% $65,000 $128,000 49%”

Refusal to take vacations is one of the behavioral red flags the study tracked as displayed by perpetrators. (jurisdiction: Global (ACFE report covering 2,402 cases from 143 countries and territories), entity_scope: primary perpetrators in the study's cases, conditions: listed as one of the tracked behavioural red flags; no frequency asserted here)

“Refusal to take vacations”

Control issues and unwillingness to share duties is one of the behavioral red flags the study tracked as displayed by perpetrators. (jurisdiction: Global (ACFE report covering 2,402 cases from 143 countries and territories), entity_scope: primary perpetrators in the study's cases, conditions: listed as one of the tracked behavioural red flags; no frequency asserted here)

“Control issues, unwillingness to share duties”

Not established from an authoritative source.

Required authority: authoritative professional or accounting standard. Highest achieved: high quality professional secondary reference.

Writing the arrangement down for an outsider who asks how you control your money

Travelers states that its crime coverage offers multiple insuring agreements intended to help provide protection for exposures, among them loss from forgery or alteration, employee dishonesty, loss of money and securities, and reimbursement for claim expenses; the list is given as examples ('such as') and is not stated to be complete. (jurisdiction: United States (Travelers business insurance; page carries U.S. trademark and ©2026 The Travelers Indemnity Company notice and lists U.S. state application notices), entity_scope: Non-financial-institution commercial crime buyers addressed by this page — private companies, nonprofits and public companies, conditions: exposures listed as examples ('such as'), not an exhaustive list; described as helping to provide protection, not guaranteeing it)

“Travelers crime coverage offers multiple insuring agreements to help provide protection for exposures such as loss from forgery or alteration, employee dishonesty, loss of money and securities and reimbursement for claim expenses.”

Travelers will accept the small-business new business Application only for privately held commercial companies and nonprofit organizations that are purchasing a Commercial Crime insurance policy with a Limit of Insurance of $250,000 or less. (jurisdiction: United States (Travelers commercial crime program; page lists California, Illinois and Minnesota state application notices), entity_scope: Privately held commercial companies and nonprofit organizations, conditions: applies to the Small Business Applications new business form only, not to the Wrap+ new business application; Limit of Insurance of $250,000 or less; purchase of a Commercial Crime insurance policy)

“The new business Application will only be accepted for Privately held commercial companies and Nonprofit organizations purchasing a Commercial Crime insurance policy with a Limit of Insurance of $250,000 or less.”

Travelers publishes a Social Engineering Fraud Supplemental Commercial Crime Application as a supplemental application form under its private company and nonprofit crime program. (jurisdiction: United States (Travelers Bond Forms & Applications, Crime Non-Financial Institutions), entity_scope: Private companies and nonprofit organizations, conditions: listed under 'Supplemental Application'; the page does not state when the supplement is required)

“Social Engineering Fraud Supplemental Commercial Crime Application”

Not established from an authoritative source.

What an insurer asks a small business, and the paperwork that answers it

See Travelers states that its crime coverage offers multiple insuring agreements intended to help provide protection for exposures, among them loss from forgery or alteration, employee dishonesty, loss of money and securities, and reimbursement for claim expenses; the list is given as examples ('such as') and is not stated to be complete.

See Travelers will accept the small-business new business Application only for privately held commercial companies and nonprofit organizations that are purchasing a Commercial Crime insurance policy with a Limit of Insurance of $250,000 or less.

Travelers will accept the small-business renewal business Application only for privately held commercial companies and nonprofit organizations having 250 or fewer employees, $100 million or less in assets, and $100 million or less in revenues. (jurisdiction: United States (Travelers commercial crime program; page lists California, Illinois and Minnesota state application notices), entity_scope: Privately held commercial companies and nonprofit organizations, conditions: applies to the Small Business Applications renewal form only; 250 or fewer employees; $100 million or less in assets; $100 million or less in revenues)

“The renewal business Application will only be accepted for Privately held commercial companies and Nonprofit organizations with 250 or fewer employees and $100 million or less in assets and $100 million or less in revenues.”

See Travelers publishes a Social Engineering Fraud Supplemental Commercial Crime Application as a supplemental application form under its private company and nonprofit crime program.

Not established from an authoritative source.

What these controls cannot do for you

The report states that even the most robust anti-fraud program will not prevent every attempted fraud, so an effective anti-fraud program also includes mechanisms designed to catch frauds as soon as possible after they begin. (jurisdiction: Global (ACFE report covering 2,402 cases from 143 countries and territories), entity_scope: organizations generally, as addressed by the report)

“Even the most robust anti-fraud program will not prevent every attempted fraud. Consequently, an effective anti-fraud program also includes mechanisms designed to catch frauds as soon as possible after they begin.”

The report states that even well-designed anti-fraud controls can fail, giving override, collusion, process changes and human error as causes. (jurisdiction: Global (ACFE report covering 2,402 cases from 143 countries and territories), entity_scope: organizations generally, as addressed by the report, conditions: hedged: controls 'can fail')

“Even well-designed anti-fraud controls can fail, whether due to override, collusion, process changes, or human error.”

The study's findings suggest collusion can significantly amplify fraud impact, which the report attributes in part to multiple perpetrators' increased ability to bypass anti-fraud controls when working together. (jurisdiction: Global (ACFE report covering 2,402 cases from 143 countries and territories), entity_scope: victim organizations in the study, all types and sizes, conditions: hedged: 'suggest', 'can', 'likely due in part')

“These findings suggest that collusion can significantly amplify fraud impact, likely due in part to the increased ability of multiple perpetrators to bypass anti-fraud controls when working together.”

The report states that although median losses did not vary significantly by organization size, the effect of those losses is typically more significant at smaller organizations because the losses likely represent a much larger percentage of the organization's revenue. (jurisdiction: Global (ACFE report covering 2,402 cases from 143 countries and territories), entity_scope: victim organizations grouped by employee count, including those with fewer than 100 employees, conditions: hedged: 'typically', 'likely represent')

“Although median losses did not vary significantly among different sizes of organizations, the effect that these losses have is typically more significant at smaller organizations, since those losses likely represent a much larger percentage of the organization’s revenue.”

See Chase states that delivery of alerts may be delayed for various reasons, giving an open list of examples including service outages affecting the customer's phone, wireless or internet provider, technology failures, and system capacity limitations; alert timeliness is therefore not guaranteed.

See The Spending Limit is not a guarantee that the Employee Card Member will be able to make purchases up to that limit.

Partly established. Established: the limits of compensating controls (S23, S24, S25, S36). Missing: the conditions under which the exposure justifies a structural change instead of another control.

Required authority: authoritative professional or accounting standard. Highest achieved: authoritative lender insurer or program documentation, high quality professional secondary reference.