Most fraud in a small business is committed over a long period, in small amounts, by someone trusted.
The pattern matters: it means it is found by routine review rather than by noticing a single event.
Where it occurs
Payments — invented suppliers, inflated invoices, payments to an account that is not the supplier's.
Payroll — hours not worked, or a person on the payroll who is not employed.
Cash and card takings — collected and not recorded, most easily where work is paid for on site.
Materials — bought on the business account and taken.
Separation of duties
The single most effective control. The person who approves a payment should not be the person who makes it, and neither should be the person who reconciles the account afterwards.
In a business too small to separate all three, the owner takes one of them. Reviewing the bank statement personally, rather than receiving a summary, covers most of the exposure at no cost.
The controls that do the work
Bank and card reconciliation every month, by someone other than whoever enters the transactions.
New suppliers added only with approval, and bank detail changes confirmed by contacting the supplier on a number already held rather than one supplied in the request. This last is the single most common route by which money is lost, and it is the cheapest to close — see vendor management.
Purchase orders for material spend, so an invoice can be checked against something ordered.
Reviewing duplicate payments, which are as often error as fraud and are worth recovering either way.
Insurance
Employee dishonesty coverage, sometimes called a fidelity bond, covers theft by staff. Standard property and liability policies generally do not.