Strengthen banking and payment controls

Keep business banking purposeful

Use business accounts appropriate to the entity and record transfers between them clearly. List every account, card, authorized user, and payment system in an access register. Review who can add payees, change bank details, or release payments. Use unique accounts and multifactor authentication where available. Remove permissions when a person or vendor no longer needs access, including access retained by a former administrator.

Verify the request before releasing funds

Require an invoice or documented purpose, evidence of receipt where relevant, and approval under a written limit. Independently verify new or changed payment instructions through a known channel. Pressure, secrecy, or a sudden unusual payment method should trigger verification. Do not let a familiar display name in an email replace the business’s approval process. Record exceptions and who authorized them.

Review after the payment, not only before it

Reconcile statements regularly and have someone review unusual payees, duplicate amounts, unexpected withdrawals, and stale outstanding items. Where one person handles all steps, the owner can review statements and supporting documents independently. Test a small sample rather than assuming a clean software dashboard proves every payment was valid. Keep the review evidence so issues can be investigated and procedures improved.

• Maintain an account and access register with named owners.
• Document payment purpose and approval before release.
• Verify bank-detail changes independently through a trusted route.
• Reconcile statements and review unusual activity promptly.