Fraud continues to be a significant risk for businesses of all sizes, but small businesses can be particularly vulnerable. Limited personnel and resources, combined with the level of trust that often exists between small business owners and their employees, can make it difficult to implement the same level of internal controls that may exist within larger organizations.
The Association of Certified Fraud Examiners (“ACFE”) recently published its Occupational Fraud 2026: A Report to the Nations, a biennial study examining the costs and effects of occupational fraud. The 2026 report analyzed 2,402 cases of occupational fraud across 143 countries and territories, with total losses exceeding $3.4 billion.
According to the study, small businesses, defined as organizations with fewer than 100 employees, experienced a median fraud loss of $126,000. This was the highest median loss among the organization sizes included in the study. Organizations with 100–999 employees experienced a median loss of $110,000, while organizations with 1,000–9,999 employees experienced a median loss of $100,000.
While a $126,000 fraud loss would be significant for any organization, the financial impact can be particularly difficult for a small business to absorb.
Small businesses tend to operate with fewer employees, which can make it challenging to properly segregate certain responsibilities. There is also often a higher degree of trust between owners and employees. While that trust is an important part of many small businesses, it can become a risk when it takes the place of appropriate oversight and internal controls.
The ACFE’s most recent findings continue to demonstrate the importance of those controls. More than half of the occupational fraud cases included in the study resulted from either a lack of internal controls or the override of existing controls. The report also found that the presence of anti-fraud controls was associated with lower fraud losses and quicker detection.
The Cost of Delayed Detection
Even a strong system of internal controls cannot prevent every instance of fraud. As a result, businesses should also have procedures in place that can help identify fraud when it does occur.
The typical fraud included in the 2026 study lasted 12 months before it was detected. The longer a fraud continued, the greater the financial loss tended to be. Frauds detected within six months resulted in a median loss of $40,000, compared with $100,000 for frauds that continued for seven to 12 months. Frauds lasting more than five years resulted in a median loss of more than $1.1 million.
This makes timely detection an important part of an effective fraud prevention program.
One of the most effective ways fraud is detected continues to be through tips. The ACFE found that 43% of fraud cases were initially detected by a tip, nearly three times as many as the next most common detection method. More than half of those tips came from employees, while customers and vendors were also significant sources.
For small businesses, providing employees and others with a clear way to report suspected fraud or other concerns can be a relatively simple but important control.
What Can Small Businesses Do?
There is no single set of anti-fraud controls that will be appropriate for every business. Owners should consider their individual operations, areas of risk and available resources when determining which controls make sense.
Some controls small businesses may want to consider include:
- A written code of conduct and anti-fraud policy
- Management review of financial activity and transactions
- Appropriate segregation of financial responsibilities
- A mechanism for employees and others to report suspected fraud
- Fraud awareness training for employees and management
- Periodic fraud risk assessments
- Proactive data monitoring and analysis
- Surprise audits or reviews
- Job rotation or mandatory vacations for certain positions
Not all of these controls require a significant investment of time or money. For example, increasing management review, establishing clear policies and providing employees with a method to report concerns can help strengthen a business’s control environment without requiring a significant investment in additional personnel or technology.
It is also important to remember that simply having controls in place is not enough. Controls should be periodically reviewed to determine whether they are operating as intended and whether changes in the business have created new areas of risk.
For business owners who are unsure where to begin, a fraud risk assessment can help identify areas where the organization may be most susceptible to fraud and determine which controls would be most effective in addressing those risks.
Occupational fraud is unlikely to ever be completely eliminated. However, the findings of the ACFE’s 2026 report continue to show the importance of being proactive. By understanding where fraud risks exist and implementing appropriate internal controls, small businesses can put themselves in a better position to prevent fraud, identify it sooner when it does occur and reduce its potential financial impact.
How Can CTBK Help?
If you are unsure where to begin or would like assistance evaluating your organization’s fraud risks and internal controls, CTBK can help. Our team can work with you to identify potential areas of vulnerability and develop practical measures tailored to your business.
