7 Signs of Employee Theft That Show Up in Your Books First

7 Signs of Employee Theft That Show Up in Your Books First

Nobody gets robbed by a stranger. They get robbed by the person who has been there six years, who never complains, and who handles the one part of the business the owner never learned.

That is the uncomfortable shape of small business fraud. It requires trust to work, which means it happens to owners who extended trust reasonably. The signs of employee theft in accounting records are rarely dramatic. They are small, boring inconsistencies that persist.

Here are seven that surface in the books before anyone suspects a person, plus what to do when you see one.

1. Vendors Nobody in the Building Can Identify

Pull your vendor list and read it out loud to your operations lead. If either of you cannot describe what a vendor does, that is a question worth answering the same day.

The pattern to watch: a vendor with a PO box or a residential address, invoices in round numbers, amounts just under whatever approval threshold you set, and a name adjacent to a real supplier. Not "Acme Supply" but "Acme Supply Co LLC."

This is worth checking quarterly regardless of suspicion. Vendor lists accumulate clutter on their own, and a clean list makes an added one obvious.

2. One Person Refuses to Take Time Off

The most cited red flag in the fraud literature is also the easiest to misread as dedication.

Ongoing schemes need maintenance. Someone has to reclassify the entry, delay the reconciliation, and intercept the statement. Two consecutive weeks away breaks that, which is why mandatory vacation is a control rather than a benefit.

The related version is a bookkeeper who will not share the bank login, insists on being the only one who talks to the bank, or handles a system change personally rather than letting anyone else in. Reluctance to hand off is not proof of anything. It is a reason to make the handoff routine.

3. Reconciliations That Are Always Late by the Same Few Days

A month-end close that lands on the fourth business day one month and the eleventh the next is a workload problem. A close that is consistently three days late, every month, with a small unexplained variance that gets plugged, is a different signal.

Consistency is the tell. Real operational chaos is chaotic. A pattern that repeats precisely usually means someone is managing it.

Ask to see the bank statement directly from the bank, not the copy in your accounting system. If those two ever disagree, stop and get outside help before you say anything to anyone internally.

4. Voids, Refunds, and Discounts Clustered on One Person

In any business that touches cash or card payments, look at voids and refunds by employee and by shift, not just in total.

Total refund rates look fine when one person's rate is six times everyone else's. Break it down by employee and the distribution answers the question in about a minute.

The same logic applies to customer discounts, credit memos, and price overrides. Legitimate reasons exist for all of them. What does not have a legitimate explanation is one person accounting for most of them, month after month, with no documentation and no approver.

5. Payroll That Does Not Match the People in the Building

Ghost employees are less common than the movies suggest, but payroll manipulation is not.

The checkable version is simple. Once a year, reconcile the payroll register to your actual roster, line by line. Look for duplicate direct deposit accounts across different employees, addresses shared by unrelated people, and anyone still being paid after their last day.

Then look at overtime and expense reimbursements by person. Reimbursements are the softest target in most small businesses because approval is informal and the amounts are individually small.

6. Customer Balances Written Off Without Anyone Approving It

Lapping is the classic receivables scheme: a payment from one customer is diverted, then covered later with a payment from a different customer, and the gap is eventually closed by writing off a balance as uncollectible.

What makes it visible is the write-off itself. If anyone can clear a customer balance in your accounting system without a second signature, you have no control over the last step of the scheme.

Set a rule that no receivable gets written off without owner approval, regardless of size, and require the collection history attached. It costs you a few minutes a month.

7. The Books Are Perfect and No One Else Can Read Them

A tidy set of books maintained by one person who is the only one who understands the chart of accounts is not a strength. It is a concentration.

If your accountant asks a question and you have to forward it to the same employee every time, you cannot independently verify anything you are told. That is not an accusation about the person. It is a description of your exposure.

What Separation of Duties Looks Like in a 12-Person Company

You do not need a finance department. You need three functions to stop living in one pair of hands: authorizing a payment, executing it, and reconciling the account it came out of.

An owner who does nothing but review the bank feed weekly and approve payments above a threshold has already broken the chain. Adding an outside firm for the reconciliation breaks it further, because the reviewer is not in the same reporting line as the preparer.

That is one of the strongest arguments for an external accounting partner in a business this size. Steady Co is a Utah-based firm serving clients nationwide, founded in 2024 by accountants out of Big 4 assurance and consulting, and it lists SMB owners, real estate investors, solopreneurs, and high net worth individuals among its specialties.

Steady Co has 15 verified client reviews on Sam's List as of 2026-08-14. Each review is submitted by an individual who identifies as a client of the firm and rates it on communication, subject-matter knowledge, and overall satisfaction. Reviews reflect those individual experiences, do not represent an endorsement by Sam's List, and are not indicative of future results.

An assurance background matters here because control design is what that training is about. The trade-off is honest: an outside bookkeeping and tax engagement costs more than one internal hire doing everything, and it does not eliminate fraud risk. It removes the single point of failure, which is a different and more achievable goal.

If You Actually Suspect Something

Do not confront anyone first. Do not announce an investigation in a team meeting. Do not lock someone out of a system while the evidence is still inside it.

Preserve access to records, get your bank statements independently, and call your attorney and your accountant before you take any visible step. Most of the damage owners do to their own case happens in the first 48 hours, when the instinct to resolve it quickly overwhelms the need to document it properly.

You can compare accounting firms by specialty and verified review count in the Sam's List accountant directory.

Frequently Asked Questions

What are the most common signs of employee theft in small business accounting? Unidentifiable vendors, a bookkeeper who never takes time off or shares access, reconciliations that are consistently late with recurring small variances, voids and refunds clustered on one employee, payroll that does not match the roster, and receivable write-offs with no approval. Individually each has innocent explanations. Persisting patterns are what matter.

How can a small business prevent embezzlement without hiring a finance team? Separate the three functions of authorizing payments, executing them, and reconciling accounts. An owner reviewing the bank feed weekly and approving payments above a threshold breaks the chain, and moving reconciliation to an outside firm breaks it further. Mandatory time off and quarterly vendor list reviews cost nothing.

Should I confront an employee I suspect of stealing? Not before you talk to an attorney. Confrontation can destroy evidence, expose you to claims if you are wrong, and give someone time to alter records. Preserve access to documentation, obtain bank statements directly from the bank, and get legal and accounting advice before taking any step the employee can see.

Does business insurance cover employee theft? Standard general liability policies typically do not. Employee dishonesty or fidelity coverage, sometimes offered as a crime policy endorsement, is what usually applies, and it carries its own limits, deductibles, and reporting deadlines. Check with your broker on your actual policy rather than assuming coverage exists.

---

About the author: Kimberly Green is the cofounder of Sam's List, where business owners and high earners find vetted CPAs, financial advisors, and fractional CFOs. She's met one-on-one with 400+ financial professionals and writes from the real data behind thousands of client-advisor matches. Ask her anything about finding an accountant - she's heard it all, including the questions people are afraid to ask.