No owner likes to think their staff, suppliers or customers might steal. But losses from fraud and theft are among the most common reasons small businesses fail, and they usually come from ordinary weaknesses: one person doing everything, no records, cash left unattended. You do not need a security department. A handful of simple controls, applied consistently, deter most losses and catch the rest early.

Separate duties

The most powerful control is to make sure no single person controls a whole transaction from start to finish. The person who orders should not be the one who pays, and the person who handles cash should not be the one who records it. In a very small business this is hard, but even splitting two tasks helps. The owner can review the bank and M-Pesa statements monthly, which is a strong check on whoever keeps the books.

Control cash

Cash is the easiest asset to take. Count the till at the start and end of each shift, bank takings daily, and reconcile the cash with sales records. Daily cash-up and stock control for a small shop explains a routine, and the daily cash-up sheet records it. For small payments use an imprest; petty cash and imprest: how to control small spending shows how.

Watch mobile money

M-Pesa is convenient and also open to abuse: a till or phone used for both business and personal payments, refunds sent to the wrong number, or staff keeping customer payments. Use a till or Paybill dedicated to the business, limit who can send money and review statements. How to use M-Pesa statements to prove income and expenses and the M-Pesa till reconciliation help you check that every payment is recorded.

Protect stock

Count stock regularly and compare it with the records; differences are the first sign of theft or waste. Keep stores locked, limit access and record every movement. Rotate counters, so the person who counts is not always the person who keeps the stock. Stock valuation for small shops and the weighted average stock ledger give the records you need.

Guard against supplier fraud

Check suppliers before you pay them, and be wary of last-minute changes to bank details, which is a common scam. Confirm changes by calling a number you already hold. Compare invoices with orders and deliveries, and never pay an invoice that has not been checked. How to check a business is tax-compliant before you deal with it lists due-diligence steps, and paying overseas suppliers safely covers international payments.

Check payroll

Payroll fraud includes ghost employees, inflated overtime and unauthorised pay rises. Keep an up-to-date list of employees, have a second person approve payroll and compare it each month with the previous one. The payroll month-on-month variance report flags unusual changes, and how to run payroll for a small business in Kenya explains the process.

Control passwords and access

Use unique, strong passwords for banking, accounting software and iTax, and turn on two-step verification. Do not share logins. Remove access when someone leaves. Limit who can issue invoices or approve payments. Never give anyone your iTax password; use proper delegation if an adviser needs access.

Keep good records

Fraud thrives where records are poor. Record every sale and expense, issue receipts, number your invoices and keep supporting documents. How to keep business records for KRA sets the standard. Good records also protect you from false accusations.

Create a culture of honesty

Set clear rules, explain them, and apply them to everyone including yourself. Pay fairly, thank honest work and act on warning signs such as unexplained differences, staff who never take leave or refuse to share tasks. Provide a way for staff to report concerns.

If it happens

Stop the loss, secure the evidence and avoid confronting the person before you have the facts. Report to the police where there is a crime, and speak to a lawyer before taking disciplinary action, because dismissals must follow a fair process. Tell your bank if accounts are affected. Review how it happened and close the gap. A loss that teaches you which control was missing is worth fixing for good.

Start with three controls

If the list feels long, start with three things this month: reconcile the bank and M-Pesa statements yourself each month, count stock and cash on a surprise basis once a week and require a second approval for payments above a set amount. These cost nothing, take little time and cover the largest risks. Add others as the business grows, and review them whenever something goes wrong.