The Money Leaving Your Company That Nobody Reports

Every mistake that costs a customer money gets reported, usually the next morning. Every mistake that costs you money gets reported by nobody. That is the whole case for internal controls in a company your size: a small number of checks aimed at the errors that have no natural reporter.

A control is not an accusation

The word sounds like distrust, and owners who know everyone in the building hear it as an accusation against people who have never given them a reason.

That is not what a control is. It carries no opinion about anyone’s character. It answers one question: if something went wrong here, how long could it run before anybody found out?

For some problems the answer is a day. A large payment that should not have gone out sits on the bank statement and someone sees it. For others the answer is years. A sliver of margin leaking through discounts nobody approved can run indefinitely, because nobody is looking at that level.

Three ways money leaves without a decision

Money going out that should not. Someone takes it, routes it, or pays themselves for something that did not happen. This is the one owners picture, and it is rarely the largest of the three.

Money that never comes in. Work done and not billed, billed and not collected, discounts granted by people with no authority to grant them, a price list nobody enforces. There is no villain, and this is often the largest of the three.

Money going out twice, or late. The same invoice paid by two people, early-payment discounts missed, penalties on filings nobody owned, a subscription still running for a service the company stopped using. That last kind is the subject of invisible burn: the spending nobody re-checks.

Only the first is a crime. All three come out of your earnings, and a buyer prices them the same way.

The errors that announce themselves get fixed

Here is why your sense of where the risk sits is probably wrong, and wrong in a predictable direction.

Mistakes that generate a complaint get fixed, because they announce themselves. Mistakes that quietly benefit the other side are silent by design. A customer who is overcharged calls. A customer who is undercharged pays the invoice and says nothing. A vendor who is shorted chases you. A vendor who is paid twice cashes both checks.

So controls are not a general suspicion of your staff. They are a short list of deliberate checks pointed at exactly the places where nobody else will raise a hand.

Where it hides

Someone who has decided to take money from a company puts it just below the level of review the company actually applies. If the owner reads the profit and loss but never the balance sheet, it sits on the balance sheet. If the owner reads the balance sheet, it moves into an expense account nobody opens, or runs through a vendor that looks like every other vendor.

A control does not make that impossible. What it does is make concealment harder, shrink the number of places nobody is watching, and, most of all, shorten how long it can run. Caught in month two, it is an unpleasant quarter. Caught in year four, it is restated financials and a very difficult conversation with a buyer.

A change nobody questioned

Illustrative. Derek owns a commercial landscaping company with about ninety employees. His office manager handled vendor setup, entered the bills, and released the weekly payment run, because it was efficient and she was trustworthy, which she was.

One spring, an email that looked like it came from the company’s largest mulch and stone supplier asked to update their bank details. She updated them and kept paying. Six weeks later the real supplier called about three unpaid invoices. The money had gone to someone else’s account.

Nothing about it involved anyone at Derek’s company doing anything wrong. It worked because one person could change a vendor’s bank details and pay that vendor without anyone else seeing either step. The fix cost nothing: any change to a vendor’s payment details now requires a call to a known number at the vendor and a second person’s sign-off before the next payment run.

The smallest version that works

Separating duties sounds like something that needs a finance department. It does not. It needs one rule: the same person never authorizes a payment, executes it, and records it.

In a company of a dozen people, that can be the owner, a bookkeeper, and an office manager, with the bank reconciliation done by someone who cannot initiate payments. Add two more checks that cost almost nothing: someone other than the person who maintains the vendor list approves new vendors and changes to bank details, and someone other than the person who runs payroll reviews the register before it goes out.

Then make sure access matches today’s staff. Who can move money, who can change a vendor’s account, and who still has a login to the accounting system, the bank, or email after they left. And whether your backups have ever been restored, rather than merely run.

What weak controls cost at sale

A buyer does not read your controls looking for theft. They read them to decide how much of what you have told them they can accept on your word.

Controls that hold up mean your numbers can be tested and will survive it. Controls that do not mean a quality-of-earnings team arrives, finds the same ambiguity you have been living with comfortably, and cannot sign off on it. The result is a wider escrow, a longer diligence, and more of your price pushed into payments that arrive later. What your financial statements have to be before a buyer will believe them covers the reporting side of the same question.

The money is already leaving. Controls decide whether you find out while you still own the company.

---

This is what we do. Prism Edge designs controls that fit how your company actually runs, aimed at the errors that have no natural reporter, and makes sure your financial statements will survive a buyer’s testing. Most of the fixes cost very little. Finding the leak during diligence costs a great deal.

The full chapter on internal controls, including an invoice error that ran in both directions for two years, is in Enhancing Your Business Value, free to download here.