Who can add a vendor?
If the same person can set up a vendor and pay it, money and access meet in one chair. Separating those two jobs is one of the cheapest controls a small business can have.
The vacation test.
If your bookkeeper took two weeks off tomorrow, what would stop? The answer is the most useful map of your back office you'll draw all year, and it costs nothing.