Internal Controls for Small Businesses - Part I: Vendor Management

As you may be aware from the news lately, “occupational fraud” (also referred to as “white collar crime”) can occur anytime and in any organization. Size does not matter. Fraud can occur in small businesses just as it can occur in the multibillion-dollar organizations.

According to the Association of Certified Fraud Examiners’ 2016 “Report to the Nations on Occupational Fraud and Abuse,” a typical organization loses five percent of its revenues in a given year as a result of fraud.

Over the next several months, I will provide recommendations on how to improve your organization’s internal controls to help identify and deter fraud. In this blog, I will provide some insights on vendors (you all have them) and how improving your controls over vendor selection and vendor account monitoring can help your efforts to deter fraud.

Fraud can be carried out by anyone inside (and outside) of your organization, from the owner or manager down to the part-time staff. The crazy thing about fraud is it can be carried out by even your most trusted employees and vendors. Why? Because a person’s decision to commit fraud is impacted by many factors, such as recent financial strains or excessive goal/performance expectations within the organization or by external competition. One way to carry out a fraud is to create fictitious vendor accounts or alter existing vendor account information.

Therefore, below are some factors to consider as you look at your vendor management process. These questions will help you think about ways you can strengthen your internal controls.

1) How often do you review your vendor master file? Do you know if there are fictitious vendor accounts in your accounting system? It is a great practice to have a member of management periodically review all changes made to the vendor master file to ensure they are valid and authorized.

Before you hire a vendor, request the vendor to provide you with a copy of the vendor’s W-9. Do not hire a vendor that does not complete a W-9. According to the IRS, a W-9 form can be used to show the vendor exists and the vendor has provided the correct name and Taxpayer Identification Number (TIN). The W-9 form should be kept in your files for four years for future reference in case of any questions from the vendor or the IRS.

Once the vendor is accepted you should implement a process to monitor the creation of the vendor accounts and subsequent changes to the vendor account within the accounting system. When enter the new vendor, you should ensure there are no duplicate vendor accounts in your accounting system. Determine if the vendor mailing addresses match the mailing addresses of your employees. The creation of fake vendor accounts can enable a rogue employee to create a vendor account with the employee’s mailing address. Then the rogue employee can make unauthorized payments to this fake vendor account.

2) Who has access to add, delete, or change information in your accounting system? It is highly recommended a member of management periodically review a list of individuals who have access to add, delete, or change vendors in the accounting system. Such an access review should include verifying that access is appropriate based on the individual’s role. Remove terminated employees from the accounting system on a timely basis.

3) Are there any inactive vendors in the accounting system? At least on an annual basis, management should remove vendors who are no longer used or who are blocked from the vendor master file in the accounting system. This practice will help prevent payments being sent to these inactive vendors inadvertently (or intentionally by a rogue employee).

Fraud can occur in various ways and for different reasons. It is impossible to build a bullet-proof process to prevent fraud completely. Therefore, it helps to constantly be vigilant and monitor your current processes to help identify weak spots in your internal controls.

If you have questions regarding implementing or reviewing your internal controls, please schedule a call with me at GritForce Bookkeeping here. I would love to talk with you to discuss your business processes.

Works Cited

Does Law require me to Obtain Form W-9 From My Vendors ... (n.d.). Retrieved from

Forms and Associated Taxes for Independent Contractors. (n.d.). Retrieved from

Report to the Nations on Occupational Fraud and Abuse - AWS. (n.d.). Retrieved from