When One Employee Controls the Money: Lessons From a $3 Million Embezzlement

Small business owners face a difficult reality when it comes to internal controls.

You may know that financial responsibilities should be divided among several employees. But what if you only have five, ten or twenty people?

You still have payroll to process, bills to pay, deposits to make and financial statements to prepare. So one trusted employee gradually ends up handling much of it.

That's exactly where risk can develop.

A federal case involving two Anaheim companies provides a powerful example.

More Than $3 Million Disappeared

Rosalba Meza worked for Anaheim-based Trilogy Plumbing and related company Matrix Management for years, eventually serving as their financial controller. According to federal prosecutors, her responsibilities included banking, bookkeeping and preparation of financial statements. She also had authorized access to company bank accounts.

Between 2017 and 2019, Meza transferred approximately $3.07 million from company accounts into accounts she controlled. She then used her knowledge of the companies' accounting software to falsify records, including recording unauthorized transfers as legitimate business expenses.

Eventually, the consequences became difficult to hide. In February 2019, Meza told company executives they didn't have enough money to meet payroll obligations. Months later, when the businesses faced IRS enforcement action over unpaid payroll taxes, she claimed those taxes hadn't been paid because the money had instead been used to pay employees.

The scheme eventually unraveled, and Meza was fired in January 2020. She later pleaded guilty to wire fraud and filing a false tax return and was sentenced to 63 months in federal prison.

But for business owners, the most important part of this story isn't the sentence.

It's the control environment that allowed the fraud to happen.

The Problem Isn't Having a Trusted Employee

Small businesses depend on trusted employees. That's unavoidable. The problem occurs when trust becomes a substitute for independent oversight.

Consider the amount of financial influence concentrated in this position:

• Access to company bank accounts

• Bookkeeping responsibilities

• Preparation of financial statements

• Ability to make electronic payments

• Knowledge of the accounting system

The same individual who handled significant parts of the financial process also had the knowledge necessary to manipulate the records that management relied upon. That's an important distinction.

A business owner could review a financial report and believe everything looked perfectly normal. But if the person committing the fraud can also manipulate the information appearing in that report, reviewing the report alone may not provide meaningful oversight.

"But I Don't Have Enough Employees to Separate Everything"

This is where textbook advice often becomes unrealistic for small businesses. A company with 12 employees probably isn't going to hire three additional accounting employees simply to create perfect segregation of duties.

Fortunately, that's not the only solution.

When responsibilities can't be completely separated, business owners can introduce compensating controls.

For example:

Review bank activity independently. The owner should have direct access to bank accounts and periodically review transactions independently of the employee responsible for bookkeeping.

Review canceled checks and electronic payments. Don't review only accounting-system reports. Occasionally examine the underlying transactions.

Reconcile information from different sources. Compare accounting records with bank statements, invoices, payroll reports and supporting documentation.

Verify payroll-tax payments. Don't simply assume payroll taxes were paid because the accounting records say they were. Independently confirm significant tax payments when appropriate.

Require supporting documentation. Payments should have invoices, receipts, approvals or other documentation that explains why company money was spent.

Periodically change who reviews the activity An outside CPA, bookkeeper, fraud examiner or another qualified person can occasionally perform an independent review.

None of these controls requires a large internal audit department. They require visibility.

The Owner Doesn't Need to Become the Bookkeeper

This point is important. Fraud prevention doesn't mean the business owner has to personally process every invoice, reconcile every account or approve every $50 purchase. That's neither practical nor a good use of the owner's time.

Instead, the owner needs enough independent information to recognize when something doesn't make sense. If your controller tells you there's not enough money to make payroll, you should have some way to independently determine why.

If payroll taxes haven't been paid, someone other than the person responsible for making those payments should eventually know. If hundreds of thousands of dollars are leaving company accounts, there should be another set of eyes capable of seeing it.

That's oversight.

Ask Yourself One Question

Here's a simple exercise for any business owner:

If the person responsible for your accounting wanted to steal from your company, what independent information would allow you to discover it?

If the answer is: "I would see it in the reports they give me,"

you may have a blind spot. The better answer is that you have access to information they don't exclusively control. Bank records.

Supporting documentation.

Independent reconciliations.

Outside review.

Verification.

Because sometimes fraud doesn't make the numbers look obviously wrong.

Sometimes the person committing the fraud makes sure the numbers look exactly right.

Protect What You've Built

Internal controls aren't about distrusting good employees. They're about designing a business so that no employee — regardless of how trusted — has to operate without appropriate oversight.

That's especially important in small businesses, where limited staffing often requires employees to wear several hats.

If you're unsure whether your current financial processes leave your business unnecessarily exposed, Blevins Associates Consulting can help identify those vulnerabilities and recommend practical controls appropriate for the size and structure of your organization.

A confidential initial conversation is complimentary.

Trust is not an internal control.