Fraud has become one of those business risks that most owners acknowledge, but very few believe will happen to them. That mindset is becoming increasingly dangerous.
The challenge is that businesses often look for the threat in the wrong place. We tend to think about fraud in terms of the person committing it, when we should be paying just as much attention to the systems and controls that make it possible in the first place.
Every week seems to bring another headline about businesses losing money through sophisticated scams, fraudulent payments or internal misconduct. South African banks have warned that business email compromise and phishing attacks continue to rise, while artificial intelligence is making fraudulent emails, invoices and payment requests increasingly convincing. What used to be easy to spot now often looks entirely legitimate.
The reality is that most fraud doesn’t begin with a criminal mastermind. It starts with weak controls.
Over the years, we’ve worked with businesses across a range of industries, and the common thread is often the systems rather than the people. You can have good, honest people working within a business, but if the systems leave too much room for discretion, too little oversight or no meaningful checks and balances, they create opportunities for people to game them. The question business owners need to ask isn’t simply whether they trust their people. It’s whether their systems are designed to protect both the business and the people operating within them.
Business owners spend a great deal of time thinking about growth. They focus on sales, customers, hiring and expansion, yet very few dedicate the same attention to the financial leadership and systems needed to protect everything they’ve worked to create. As a business grows, the quality of its financial leadership needs to grow with it.
One of the first places to start is your finance function.
Good financial leadership isn’t just about producing monthly management accounts or ensuring VAT is submitted on time. It’s about giving decision-makers visibility into what’s happening inside the business before problems develop.
If your gross profit suddenly shifts by one or two percent, does someone investigate? If margins begin narrowing, does anyone understand why? Are management reports helping you anticipate issues, or simply explaining what happened last month?
Those questions matter because fraud rarely appears as one large transaction. It usually reveals itself through small anomalies that continue unnoticed until they become significant.
The people responsible for your finances matter just as much as the reports they produce. Businesses should regularly ask whether the individuals occupying key financial positions have the experience, qualifications and judgement needed for the responsibility they’re carrying. Strong financial leadership remains one of the best fraud prevention tools any business can invest in.
The next area to examine is control.
One of the more concerning situations we’ve encountered recently involved a finance manager who could create suppliers, capture payments and approve those same payments without any independent review. No individual, regardless of how trusted they may be, should have end-to-end control over the movement of money.
Segregation of duties isn’t red tape. It’s one of the simplest safeguards a business can introduce. The same applies to clearly documented Delegation of Authority and Conflict-of-Interest policies. These aren’t documents that should gather dust in a filing cabinet. They should shape how financial decisions are made every day.
Those controls have become even more important as social engineering attacks continue to evolve. Criminals no longer rely on poorly written emails claiming you’ve won the lottery. Today they’ll impersonate your CEO, copy your branding, reference genuine suppliers and create a convincing sense of urgency around an “immediate” payment. Under pressure, even experienced finance teams can make mistakes if there aren’t clear approval processes in place.
Another area that deserves far more attention is SARS engagements.
PAYE, VAT and other tax obligations are simply too important for business owners to lose visibility over. Even where other members of the finance team are responsible for preparing returns or facilitating payments, accountability ultimately remains with the business.
We’ve seen businesses assume returns were submitted and payments made, only to discover months later that while the paperwork had been filed, the money never reached SARS. By then, penalties, interest and unnecessary stress have already accumulated.
Business owners don’t need to complete every return themselves, but they do need to know that submissions have been made, payments have cleared and any correspondence from SARS has been dealt with promptly. Tax administration shouldn’t become something that happens somewhere in the background of the business without appropriate oversight.
Procurement is another function that’s worth reviewing regularly.
Supplier relationships naturally become comfortable over time, but comfort should never replace scrutiny. When was the last time you asked why you’re using a particular supplier? Are you still receiving value? Is pricing competitive? Have relationships become habitual rather than commercial?
Healthy procurement processes don’t slow businesses down. They create consistency, improve accountability and remove opportunities for inappropriate decision-making. Preferred supplier lists, purchase orders and regular supplier reviews all contribute to stronger governance while often improving profitability at the same time.
Ultimately, fraud prevention isn’t about creating bureaucracy. It’s about protecting value.
Businesses don’t suddenly become attractive acquisition targets because they generate revenue. They become valuable because buyers have confidence in the quality of the systems behind that revenue.
Strong controls won’t eliminate fraud entirely. Nothing will. But they make your business significantly harder to exploit, while giving management the visibility needed to identify problems early.
The businesses that emerge strongest over the next decade won’t necessarily be the ones growing the fastest. They’ll be the ones that have built organisations capable of protecting what they’ve created.
Written by Rowan de Klerk, CEO of the CFO Centre South Africa