How do you know everyone on payroll is real?
Most owners have never held the payroll register up against the people who actually show up for work. It takes an afternoon, and it answers a question you should never have to guess at.
Who still has a key?
People leave, change jobs, or share a password “just for this week,” and the access usually stays behind. Here is a quarterly access review a small firm can actually keep up with.
Who can add a vendor?
If the same person can set up a vendor and pay it, money and access meet in one chair. Separating those two jobs is one of the cheapest controls a small business can have.