The Fraud Risk Every Growing Business Carries in Both Directions
For two years, the manager of a Glasgow bakery logged sixty-eight thousand pounds in voided transactions, more than sixty times what the person in that same role logged during an entire prior year. Nobody caught it through a routine audit. A colleague noticed the pattern and flagged it. Senior leadership sent employees in to pose as customers, and watched two of their own purchases get voided in front of them before they finally confronted her.
Table of Contents
Two Stories, One Root Cause
That bakery case is a story about a business getting robbed. Now put it next to a different case documented in the same reporting: a Missouri restaurant owner walked away with almost fourteen million dollars by falsifying commercial loan applications and pandemic relief filings over several years, a scheme that eventually cost lenders and government programs more than eight million dollars, until investigators cross-checked his loan documents against his actual financial records.
According to a recent article in Fraud Magazine, published by the Association of Certified Fraud Examiners, both cases point to the same underlying condition. Businesses with fewer than 100 employees post the highest median fraud loss of any organization size category the ACFE tracks. And the article's real subject is not just that these businesses get victimized. It is that the same businesses, under the same structural conditions, sometimes become the ones misrepresenting the numbers.
In Salt Lake City, an employee named Timothy Sean Edgar spent three years quietly diverting $1.7 million from his employer. He did not need to break in anywhere. He used his own employee credentials to access the company's vendor portal, then routed payments to himself through a sales channel he had fraudulently opened on an online marketplace. Federal prosecutors later noted that Edgar had built a strong relationship with his employer, and that relationship was exactly what gave him the access and the room to operate for as long as he did.
In Philadelphia, the owner of an electrical contracting firm took the opposite role. Donald Dougherty pleaded guilty to filing a false tax return and stealing from his own employees' benefit funds, after submitting business deductions that were really personal expenses. He owed the IRS more than ninety-two thousand dollars. His own accountant was separately charged with tax fraud.
Two very different businesses. Two very different outcomes. But the article's own analysis points to the same three conditions behind both: limited segregation of duties, excessive trust, and inadequate oversight. Whether that combination produces a victim or a perpetrator often comes down to which direction the pressure happens to point, not which business is more careful.
When Trust Replaces Verification
The bakery case is worth returning to, because it shows what closing the gap actually looks like in practice. Nobody discovered the fraud through a scheduled review. A financial director who had never met the manager personally bought a small purchase and watched it get voided from the register. That is verification, applied after two years of trust running unchecked.
Growing businesses lean on trust more than large corporations do, out of necessity rather than choice. A long-serving employee gets broader access over time, the way Edgar did. A financial process runs through one person because it always has, the way it did at the bakery before anyone looked closely. Revenue comes from the front office. Cash flow is protected in the back office. When that protection has not kept pace with growth, trust becomes the only control in place, and trust alone rarely catches what a second set of eyes would have caught years earlier.
The Owner Is Not Exempt
A procurement employee at Auckland Council accepted bribes from an external supplier, leaked confidential tender information, and manipulated procurement documents to help that supplier win a contract worth roughly one hundred and forty thousand dollars. The scheme worked because it exploited a trusted relationship and slipped past routine procurement controls. It was a whistleblower report from another employee, not an audit, that finally uncovered it.
That case involves an employee. The Missouri restaurant owner's case involves the person at the top. Both point to the same governance gap: when one person controls the decisions and the paperwork that describes those decisions, there is often no one positioned to ask a hard question before it becomes a legal one. A few conditions show up consistently in businesses exposed to this risk from either direction:
One person controls both financial reporting and the relationships with lenders or investors
Business deductions or expense classifications are never reviewed by anyone outside the owner
Loan or grant applications go out without a second reviewer checking the underlying numbers
Vendor portal access and payment routing are controlled by a single employee with no periodic review
Tender or procurement decisions rest with one person with no independent check on outcomes
No external party ever reviews financial statements before they reach a lender or investor
None of these facts alone means anything improper is happening. Together, they describe the exact structural gap behind every case in this article, regardless of whether the business ended up as the target or the source of the fraud.
Why You Cannot See This From Inside
An AI tool can document every process you describe to it. It can produce a clean, organized policy in minutes. What it cannot do is see the control gap you did not think to mention, because you stopped noticing it years ago, the way Edgar's employer never noticed a vendor portal needed a second set of eyes on it.
The gap is never in what an owner knows about their own business. It is in what they stopped questioning because it had always worked that way. You cannot see clearly what you built and live inside every day. That is not a failure of judgment. It is a structural limitation that applies to anyone close enough to a system to stop noticing it, whether the risk runs toward the business or out of it.
Growing Business Fraud Risk: Where Governance Actually Starts
Trust but verify is not a slogan. It is a specific operational habit, and the bakery's own investigation shows what it looks like: someone outside the daily operation checking the work without assuming wrongdoing first.
Segregating who approves a vendor payment from who sends it and who reconciles it would have interrupted Edgar's diversion long before three years passed. An independent reviewer checking loan and relief paperwork before it goes out closes the exact gap behind the Missouri case. For a business worried about being defrauded, that means a second look at payment routing and vendor access. For a business that wants to avoid misrepresenting its own numbers, it means the same principle turned inward: someone other than the owner reviewing what goes into a loan application, a tax filing, or a set of financials shared with an investor. The Fraud Prevention for Business Owners post goes deeper into the specific behavioral signals that tend to surface before either version of this risk turns into a loss.
Why Outside Perspective Helps
Every case in this article shares a detail worth sitting with. Someone had access and authority for months or years before anyone from outside the daily operation looked closely enough to notice a pattern, whether that person was quietly stealing or the business itself was quietly misrepresenting its numbers to someone else. In the bakery's case, it took a mystery shopper. In Auckland's case, it took a whistleblower. Neither came from inside the system that was supposed to be watching.
An outside review through Back Office Process Improvement does not assume anyone did anything wrong. It applies a second set of eyes to a structure that has never had one, which is often all it takes to find the gap before it becomes a loss, in either direction.
Free Resource: System Leak Audit
If any of the patterns above sound familiar, from either side of the risk, the next step is not guessing where the exposure sits. The System Leak Audit walks through five categories where growing businesses commonly lose money to gaps nobody built on purpose, so you can see where your business actually stands before deciding what to fix first.
Get the System Leak Audit - See where your business stands
Frequently Asked Questions
What is growing business fraud risk?
Growing business fraud risk describes the exposure a company faces as both a potential target of fraud and, through the same structural conditions, a potential source of financial misrepresentation. Concentrated control, limited independent review, and trust that has never been verified create both kinds of risk at once.
Can a business be both a victim and a source of fraud?
Yes. Documented cases show this happening under nearly identical conditions. An employee with unreviewed vendor portal access diverted funds from his employer for three years. A business owner with no independent review of his loan applications misrepresented his own financial position to obtain nearly fourteen million dollars. The structural gap was the same in both cases.
Why does trust replace verification in growing businesses?
Trust often develops naturally as relationships with employees, vendors, and advisors mature over time. Without a deliberate habit of independent review, that trust becomes the only control in place. A bakery manager's fraud went undetected for two years until someone outside her daily routine finally checked her work directly.
Is fraud prevention only about protecting the business from outside threats?
No. A procurement employee accepting bribes and an owner falsifying loan paperwork both describe conditions inside the business, not outside threats. Effective fraud prevention accounts for both directions: controls that catch outside threats and internal theft, and an independent check on the business's own financial reporting.
How does governance reduce both kinds of fraud risk at once?
Governance built on trust but verify applies the same principle in both directions: segregating duties so no single person controls an entire financial process, and involving an outside reviewer before major financial representations go to a third party. The same structural fix that would have caught a vendor portal diversion also would have caught a falsified loan application.
Ready to See Where Your Back Office Stands?
If you are not sure whether your financial processes have the checks they need, a Process Health Check gives you a clear, written answer in two weeks, not a guess.
The Back Office Brief
Get a weekly insight connecting back office operations to profit. Delivered every week, free.
Comments