But ignoring it could be the most expensive mistake your business ever makes. Internal controls are like smoke detectors. Quiet. Unassuming. Easy to forget until the battery dies, or worse, you unplugged it because it was “too annoying”. And suddenly the room is full of smoke and it’s too late.

I say this not as your average accountant, but as a forensic expert who’s been called in after the fire by lawyers, insurance companies, or govermental agencies when the damage is done and the clean-up is ugly. When the CEO says, “We trusted them”. When the records are a mess. When fraud isn’t suspected, it’s confirmed.

“But I trust my accountant…”

I know. I hear it all the time. “He’s been with me for years”. “She’s a CPA”. “They take care of everything”. And that is where it starts.

When one person, no matter how credentialed, seasoned, or sweet, is handling your bank transfers, IRS notices, vendor payments, reconciliations, and monthly closes, that’s not efficiency. That’s exposure.

If something goes wrong, whether it’s a mistake or full-blown fraud, guess who’s still responsible? Yep! You! The IRS doesn’t care that your CPA “forgot”. They’ll come straight to you.

And ACFE Report to the Nations concludes, without lots of changes every year, that more than half of occupational frauds happen because of a lack of internal controls or someone overriding the ones in place. And while the dollar amount per incident may be smaller for small businesses, the impact as a percentage of revenue? Much worse. It hits harder, longer, and deeper.

I’ve seen it firsthand. This is how it happens

I work with business owners who are growing fast,more sales, more contracts, more employees. But behind the scenes, it’s always the same story, no one’s checking who approves payments, who receives IRS mail, or who has access to what.

Sometimes that person is on payroll. Sometimes it’s an outside accountant or bookkeeper. Either way, they have full control and zero oversight.

I’ve conducted forensic investigations where taxes hadn’t been filed in years. Where employees had ghost payroll accounts. Where vendors were fake and payments were quietly diverted.

And you know when business owners find out? When the bank account is drained. When the IRS shows up. When a whistleblower speaks up.

By that point, I’m coming in with spreadsheets and subpoenas, not strategy. And it breaks my heart every time. Because:

• If your accountant receives an IRS notice and ignores it for two years… you’re the one fined.
• If they forget to file payroll taxes… you’re still on the hook.
• If they skim cash or manipulate the books… you live with the consequences.

You might sue. You might press charges. But the money? The stress? The lost time? That’s yours to carry. Plus, some losses are indirect, including lost productivity, reputational damage and the related future loss of business. Many of these losses are never fully recovered.

Let’s fix it before it burns

Internal controls don’t have to be complicated. But they do have to exist. Start with the following simple steps:

1. Separate duties. No one person should handle the full financial cycle. One enters, one approves, one reconciles.
2. Require dual approvals. Especially for wire transfers, payroll, and any high-dollar payments.
3. Use your own email. IRS, Treasury, payroll portals, never let someone else be your sole point of contact.
4. Have your own logins. To everything. Always.
5. Review reports monthly. You don’t have to do the math, but you do need to read the story the numbers are telling.
6. Ask questions. Even the awkward ones. Especially when things feel “too smooth”.

This isn’t about paranoia. It’s about protecting what you’ve worked so hard to build. If your business is growing, but your internal controls are still stuck in survival mode, it’s time to change that. Because growth doesn’t just create opportunity, it exposes weakness.

And when the smoke starts, you don’t want to find out your detector was never working.

Let’s fix that before there’s a fire.