There is a point in a growing business where the owner quietly stops being the control system.
Under a million in revenue, you were the control. You opened the mail. You knew every customer by name. You signed the checks, and you would have noticed a payment to a vendor you had never heard of. None of it was written down and none of it needed to be, because you saw everything.
Somewhere between one and three million, that stops being true. Volume doubles. You hire. You hand off deposits, then invoicing, then the whole bookkeeping function. The business keeps running and the balance keeps growing, so it feels like nothing has changed.
What changed is that the one control you had — you, looking at everything — is gone. In most businesses this size, nothing was ever built to replace it.
What actually happens at your size
The Association of Certified Fraud Examiners publishes the largest study of occupational fraud there is. Its Occupational Fraud 2026: A Report to the Nations puts the median loss at $104,000 per case, and the median scheme runs 12 months before anyone catches it. More than half of all cases involved either a lack of internal controls or someone overriding the controls that did exist.
The detection figure is the one worth sitting with. 43% of frauds are found because somebody spoke up. Not by the bookkeeper, not by the bank, and not by the tax return. By a tip. Only about a quarter of small organizations have any formal way for that person to raise a hand, against 85% of large ones — and organizations with no reporting mechanism lost a median $150,000, half again as much.
Put those together and the picture is uncomfortable. A business your size is the most likely to be missing ordinary process, and the most likely to find out about it a year late, by accident.
None of this assumes anyone is stealing from you. In my experience the same gaps produce honest, expensive errors far more often than they produce fraud — and the errors are the ones that quietly distort every decision you make about pricing, hiring and cash.
The short version. Reconciling proves your ending balance. It does not prove the year of activity that produced it. If one person records money, holds the bank login and can release a payment, the reconciliation is telling you nothing you can rely on.
The four controls that fit a business this size
1. Keep one of the three jobs that must never sit together
You cannot separate duties across six people when you have one and a half in the office. You do not need to. You need the owner to keep one of the three — and it should be authorization.
If one person enters the bills, holds the bank login, and can release a payment, you have no control at all. That is not a comment on their character. It is the definition of the gap. Keep approval of outgoing money with yourself, and let someone else record it.
2. Read the bank statement yourself
The cheapest control in existence. Have the bank statement, or read-only bank access, come to you directly rather than through the person who keeps the books. Five minutes a month scanning for payees you do not recognize and amounts that look wrong will outperform most of what a small business calls a control.
3. Test the activity, not just the balance
A reconciliation proves one number: that your ending balance agrees to the bank. It proves nothing about the thousand transactions that produced it. Those can be duplicated, misclassified, or recorded net of fees, and the reconciliation still comes out clean.
A proof of cash tests the whole year of movement instead — opening balance, plus receipts, less disbursements, against what the bank actually shows. It is the difference between assuming your books are right and knowing it. I have written separately about what financial statements do and do not prove.
4. Write down who can do what, then check it once a year
Once a year, on paper: every bank and credit card account in the company name is on the books. Every person with access to the accounting file still works here. Every automated rule in your accounting software was set deliberately and still does what it was meant to do.
That last one catches more than people expect. A bank rule set up once during a busy season will keep applying itself silently for years.
It is not a trust problem
This is the objection I hear most, and it is worth answering directly: putting controls in place is not an accusation. Most owners hesitate because the person keeping their books has been loyal for years, and adding oversight feels like saying you no longer trust them.
It is the opposite. Sole access is the worst position you can put an honest employee in. When a number eventually looks wrong — and at some point one always does — the person who had exclusive control of the records is the only person in the building who cannot prove it was not them. Controls exist as much to clear the innocent as to catch anyone. In my experience a good bookkeeper is relieved when a second set of eyes appears, because it means the ambiguity is gone.
If you frame it that way when you introduce it, it lands as a process change rather than a personal one.
What it actually costs you to do
Less than most owners assume. The routine below is roughly half an hour a month once it is set up:
- Five minutes. Open the bank statement yourself, before anyone else has touched it, and scan the payee list for names you do not recognize.
- Ten minutes. Approve the payment run. Not the entries, the payments — the actual money leaving.
- Ten minutes. Read the proof of cash for the month and ask about anything that needed a manual adjustment to tie.
- Five minutes. Look at whatever is sitting in suspense, ask-my-accountant, or uncategorized, and get it cleared rather than carried forward.
Once a year, add the access review: who can log into the accounting file, who can log into the bank, and whether every one of them still works here.
That is the whole programme. It is not a controller-level function and it does not need new software. It needs thirty minutes and the discipline to keep doing it in a month when you are busy, which is exactly the month it matters most.
Not sure which of these you are missing?
Most owners can name the gap within about ten minutes of being asked the right questions. That is what the first call is for.
What this looks like when it goes wrong
These are the patterns that show up again and again in cleanup work, across construction, manufacturing and real estate alike:
- The same vendor payments posted three and four times over several months. Every one of those months had reconciled cleanly.
- A bank-feed rule, set once and never reviewed, booking deposits net of processing fees — so revenue was understated all year and the fees were never recorded at all.
- Company credit cards that had simply never been added to the books.
- A cash balance that tied to the penny while the activity behind it was inflated in both directions by several hundred thousand dollars.
Not one of those was caught by reconciling. Every one was caught by testing activity. And more than one of them had already produced correspondence from the IRS by the time anybody looked.
Why October is the month to do it
October is the right month for this. You still have a quarter of runway to fix a process before it becomes a year-end problem, and the corrections land in the current year instead of being restated later.
If you are in one of the 21 Wisconsin counties covered by the federal disaster postponement, your filing deadline is November 2 rather than October 15, which buys a little room — but it is filing relief, not bookkeeping relief. The rest of the calendar has not moved.
Find out what is actually in your books.
A one-hour scoping call. You describe how the work is split today and who touches what; I tell you where the gap is and what it would take to close it. No charge for the call, and no obligation afterwards.
