If the same person can set up a vendor and pay it, money and access meet in one chair. Separating the two is one of the cheapest controls there is.
This week on Instagram I'm sharing three questions from the first Field Note, the ones worth asking on a Monday morning. (How do you know?) The first is the blunt one: who can move money out of the company, alone? Most owners can answer it in a few seconds. It's whoever has the bank login and the right to approve. Usually one name, sometimes two.
There's a quieter version of that question that gets asked far less often. Who can add a vendor?
In most accounting systems, a vendor is just a record. A name, an address, a tax ID, and somewhere near the bottom, bank details. Whoever can create or edit that record decides where money is allowed to go. Whoever approves payments decides when it goes. When one person can do both, the system will cheerfully let them set up a new payee on Tuesday and pay it on Wednesday, and nothing about either step will look unusual.
I want to be careful, because I'm not describing dishonest bookkeepers. Over the years, most of the trouble I saw in vendor files came from plain mistakes. A duplicate record that got paid twice. Bank details changed on the strength of an email nobody verified. A contractor from three years back, still active, with an account number nobody had looked at since. I saw versions of this more than once at the bank. The deliberate cases exist too, and they tend to travel the same road. But set fraud aside and the point still holds. A vendor list that only one person touches is a vendor list nobody else is checking.
Money and access
shouldn't meet in the same chair.
A company of fifteen people doesn't need a vendor department, and I'd talk you out of building one. You need the two keys held by different hands. When that isn't possible, you need a second look that happens on a schedule rather than when someone gets a bad feeling.
Split the jobs where you can. The office manager sets up vendors and the bookkeeper pays them, and neither has permission to do the other's part in the system. Most accounting software allows this, and it's usually an afternoon's work.
Where you can't split them, review the changes. Once a month the owner pulls a report of every vendor added or edited, with the date and the user who did it. It takes about as long as a cup of coffee. Ask about anything you don't recognize, and initial the report so there's a record you looked.
The monthly report is where I'd ask most owners to start. Reviewing vendor changes means looking at where money is allowed to go before any of it gets there. Once a year, deactivate anyone you haven't paid in, say, eighteen months. Every dormant record is one more place for a typo, or a stranger's account number, to sit unnoticed.
So, this week: who in your company can add a vendor, and who can pay one? If it turns out to be the same name, you're in very large company, and it's one of the easier things to fix.
Want to know how your controls hold up? Start a conversation