How to help clients prevent employee theft

Published Friday 6 November 2026

Table of contents

• Why employee theft is a risk for Indonesian small businesses
• Common types of employee theft
• Warning signs of employee theft
• 10 steps to help clients prevent employee theft
• What to do when employee theft is discovered
• How technology helps prevent employee theft
• Strengthen your theft prevention advisory with Xero
• FAQs on preventing employee theft

Key takeaways

• Employee theft is a real risk for Indonesian small businesses, where one trusted person often handles cash, payments, and records.
• Prevention works best when internal controls, such as segregation of duties and authorisation limits, sit alongside cloud accounting with real-time visibility and audit trails.
• Each control gives clients fewer losses and cleaner records, and your practice can package these controls as a paid internal-control review.
• When theft is found, clients should secure evidence, follow a fair documented process, and take local legal advice before acting.

Why employee theft is a risk for Indonesian small businesses

Employee theft is a persistent risk for businesses of every size, and small businesses often feel it most. Understanding where the risk comes from helps you frame the conversation with clients and build a clear case for stronger controls.

In a small team, one trusted employee may take payments, record sales, bank the takings, and reconcile the accounts. Family-run and fast-growing businesses often rely on trust and informal processes, with few written policies.

Many also take a mix of cash, bank transfers, and digital payments. If no one reviews the records, a loss can go unnoticed for months.

The Association of Certified Fraud Examiners (ACFE) uses the Fraud Triangle, developed by criminologist Donald R. Cressey, to explain why employees steal. The three factors are pressure, opportunity, and rationalisation. For accountants and bookkeepers advising smaller business clients, opportunity is the factor you can most directly influence through better controls and processes.

Common types of employee theft

Theft takes many forms, and some are far harder to detect than others. Recognising the full range helps you advise clients on where their specific vulnerabilities lie.

• Cash skimming and larceny. Removing cash before or after it enters the accounting system. Common in retail and hospitality businesses with high cash volumes.
• Billing and expense fraud. Submitting fictitious invoices, inflating expense claims, or creating shell supplier accounts. This often involves collusion or exploits weak purchase order processes.
• Payroll fraud. Creating ghost employees, inflating hours, or manipulating overtime records. Particularly common where one person controls both payroll input and approval.
• Inventory theft. Taking stock, raw materials, or finished goods. Often disguised through write-offs for damaged or obsolete items.
• Time theft. Falsifying timesheets, buddy-punching, or conducting personal business during work hours. While less dramatic, the cumulative cost can add up.
• Data and intellectual property theft. Copying client lists, proprietary processes, or sensitive financial data. This risk has grown as more business information is stored digitally.

Warning signs of employee theft

Spotting the indicators early limits financial damage and gives your clients options for how to respond. The red flags fall into two categories: financial anomalies you may detect in the accounts, and behavioural changes the business owner may observe.

Watch for these financial red flags in client accounts.

• Unexplained variances against expected figures. Regular cash shortfalls, inventory counts that don't match records, or cost of goods sold that drifts without a clear reason.
• Missing or altered documentation. Gaps in receipt sequences, voided transactions that lack proper authorisation, or purchase orders that don't match delivery notes.
• Unusual journal entries or adjustments. Entries posted outside normal processes, round-number adjustments, or frequent write-offs to suspense accounts.
• Supplier account anomalies. New suppliers with PO box addresses, invoices with no valid tax registration details, or a single supplier receiving disproportionate payments.

The business owner is best placed to notice these behavioural indicators.

• Reluctance to take leave or share duties. An employee who never takes holiday and resists anyone else handling their responsibilities may be concealing irregularities.
• Lifestyle changes inconsistent with salary. New cars, expensive holidays, or other spending that doesn't align with what the role pays.
• Defensiveness about work processes. Reacting aggressively when asked routine questions about transactions, or insisting on handling specific tasks alone.
• Unusual working patterns. Consistently working late alone, arriving before everyone else, or accessing systems outside normal hours without a clear business reason.

10 steps to help clients prevent employee theft

Prevention usually costs less than investigation and recovery. Each step below starts with what the client gains, then sets out the control. It ends with how your practice can deliver it in a paid internal-control review.

Packaging the steps as one review with a fixed scope and fee makes the service easier to explain and repeat across your client base.

1. Implement segregation of duties

Clients get fewer unchecked payments and faster detection, because no one person can hide an error or a theft alone.

No single person should control an entire transaction from initiation to recording to reconciliation. Even in small businesses, splitting responsibilities across two or three people creates natural checkpoints. Where headcount makes full segregation impractical, the business owner should keep approval authority over payments and review the bank statements personally.

In your internal-control review, map who handles each stage of the client's main transaction cycles and recommend where to split duties. A one-page duties map is a simple deliverable to price and revisit each year.

2. Set clear authorisation limits

Clients spend less on unapproved purchases and keep a clear record of who signed off each payment.

Every payment, purchase, and write-off above a defined threshold should need a second signature or approval. Document these limits in a written policy so there's no ambiguity. Review the thresholds annually to check they still reflect the business's transaction volumes.

Offer to draft the authorisation policy and set matching user permissions in Xero as part of the review.

3. Reconcile bank accounts monthly

Clients get cleaner records and spot missing money while it's still recent and traceable.

Regular bank reconciliation is one of the strongest detective controls available. Someone independent of the cash-handling and payment processes should perform the reconciliation and investigate every unmatched item promptly.

Where the client has no independent person for this, your practice can take on the reconciliation, or a monthly review of it, for a fixed fee.

4. Conduct surprise audits

Clients see fewer losses because staff know a check could happen at any time.

Scheduled audits have value, but unannounced spot-checks add a stronger deterrent. Rotate which areas you check: petty cash one month, inventory the next, expense claims the month after.

Build a spot-check schedule into the review scope, so your practice runs the checks on the client's behalf and reports what it finds.

5. Tighten cash-handling procedures

Clients in cash-heavy sectors such as retail and hospitality see fewer cash shortfalls and smaller till discrepancies.

Require two people to verify cash counts at shift changes. Limit who has access to cash drawers and safes. For businesses that still handle large cash volumes, make daily banking standard practice so cash doesn't build up on-site.

Include a walkthrough of the client's cash process in your review, and hand over a short written procedure staff can follow at every shift change.

6. Use technology to automate controls

Clients get faster detection with less manual checking, because their software flags discrepancies as they arise.

Cloud accounting software with automated bank feeds, digital approval workflows, and full audit trails removes many opportunities for manipulation. Automated reconciliation helps surface problems sooner than a manual month-end process.

Setting up bank feeds, user permissions, and audit trail reviews in Xero is a natural, billable part of an internal-control review.

7. Review payroll and expense processes

Clients pay only real employees and genuine claims, and their payroll records stay accurate.

Separate payroll preparation from approval. Require receipts for every expense claim above a minimal threshold. Run periodic checks comparing the payroll register to human resources (HR) records to identify ghost employees or unauthorised pay changes.

Offer the payroll register and HR records comparison as a recurring check your practice runs for the client.

8. Implement a clear reporting policy

Clients hear about problems sooner, often from the people best placed to spot them.

Encourage employees to report concerns through a confidential channel. Make it clear the business protects and values people who speak up.

As part of the review, your practice can provide a reporting policy template and recommend a simple confidential channel that suits the client's team.

9. Screen new hires for sensitive roles

Clients lower the chance of giving financial access to someone with an undisclosed history of dishonesty.

For positions involving financial responsibilities, conduct background checks, verify qualifications, and follow up on employment references. Keep checks proportionate to the level of access the role provides, and take local legal advice on what checks are permitted.

Add a hiring checklist for finance roles to your review pack, so the client applies the same checks to every candidate.

10. Review controls regularly as the business grows

Clients keep their protection in step with the business, and gaps get fixed before they lead to a loss.

Controls that work for a five-person business may be inadequate once headcount reaches 20 or 30. As transaction volumes, staff numbers, and systems change, the control environment needs to adapt.

An annual controls review gives your practice recurring advisory work and gives the client a fixed point to update policies, permissions, and approval limits.

What to do when employee theft is discovered

Despite the best controls, theft can still occur. How your client responds matters for legal, financial, and operational reasons, and the steps overlap closely with broader fraud prevention practices. Your role is to help them work through it carefully.

The first priority is to secure evidence before the employee becomes aware of the investigation. This means preserving financial records, restricting system access where appropriate, and documenting what has been identified so far.

Advise your client to take local legal advice before confronting, suspending, or dismissing the employee. A lawyer can confirm the steps that apply to the client's situation and the employment contract in place.

Even where theft appears clear-cut, the business should follow a fair, documented internal process. Give the employee a chance to respond, keep a written record of each meeting, and apply company policies consistently.

Reporting to the police is a decision the business owner must make, but you can help them understand the options. A formal report creates a record that may matter later, and the client's lawyer can explain how it fits alongside the internal process.

To recover losses, the client should use proper legal routes, such as a written repayment agreement or a civil claim. Informal deductions from wages can create a separate legal risk, so clients should check with their lawyer first.

How technology helps prevent employee theft

Cloud accounting has changed how businesses can protect themselves. Where paper-based systems relied on manual checks, accounting software provides continuous, automated oversight.

Automated bank feeds and reconciliation mean that every transaction is matched against a bank record in near real time. Discrepancies can surface sooner, without waiting for a month-end review, which narrows the window for concealing fraudulent transactions.

Audit trails record who created, edited, or approved every transaction, and when. This makes it far harder for an employee to alter records without leaving a trace. User-level permissions restrict sensitive functions, such as creating new suppliers or processing refunds, to authorised staff.

Document capture in Xero lets clients capture bills and receipts and store them online alongside their records. Hubdoc is also included in Xero plans when it’s connected to the client’s Xero subscription. When every transaction is expected to have a digital source document, missing or altered receipts become immediately visible.

For practices advising multiple clients, Xero Partner Hub gives you one place to assess clients’ financial health. You can see which clients would benefit from support or advice from you, without logging in to each organisation individually.

Inventory management integrations connect stock records directly to the accounting system, making it harder to disguise inventory theft through manual adjustments.

Strengthen your theft prevention advisory with Xero

Strong financial controls give clients fewer losses and cleaner records, and helping them build those controls deepens your client relationships. An internal-control review turns that help into a defined advisory service your practice can repeat.

The Xero partner program gives practices the tools to deliver this work efficiently. Xero Partner Hub plus Practice Management helps you manage the jobs, time, and billing behind each review. For clients, automated bank feeds, user permissions, and audit trails make strong controls practical for even the smallest businesses.

For clients ready to put these controls in place, the first step is easy: they can get one month free when they start with Xero.

FAQs on preventing employee theft

Below are answers to frequently asked questions about preventing employee theft in the workplace.

What is the most common form of employee theft?

It depends on the business: cash skimming and larceny are a bigger risk in retail, hospitality, and other cash-intensive sectors. In office-based businesses with little cash handling, billing fraud and expense claim manipulation tend to be the main concern.

How should accountants raise theft concerns with clients?

Start with the specific anomalies you've identified, such as unexplained variances or documentation gaps, and ask the client for context before suggesting further investigation. Framing the conversation around financial health makes it easier for clients to engage constructively and take action.

Can an employer deduct stolen amounts from an employee's wages?

Clients should take local legal advice before deducting anything from an employee's pay. A written repayment agreement or a claim through the courts gives the business a clearer, defensible route to recovery.

How should a business report employee theft?

The business owner can report the matter to the local police, ideally after a lawyer has advised on what evidence to bring. Keep the police report and any internal disciplinary process documented separately, so each stands on its own record.

Why does so much employee theft go unreported?

Business owners often consider the amount too small to pursue, prefer to handle it internally, or want to avoid the disruption of an investigation. Strong controls help because they surface losses early, while there's still clear evidence to act on.