Can a small business have separation of duties with only two people?

Yes, partially. The core split is between recording transactions and moving money: whoever keeps the books should not also be a signer who can send payments alone, and whoever pays bills should not reconcile the bank account unchecked. With two people plus the owner, you can cover the highest-risk combinations even though full separation is impossible.

What fraud schemes hit small businesses most often?

Billing schemes (fake or inflated vendor invoices paid to an insider), payroll schemes (ghost employees or padded hours), skimming (cash taken before it is recorded), and check or payment tampering. Small businesses are disproportionately hit because one trusted person often controls the entire money path with no independent review of the bank statement.

What should an owner check monthly if they outsource the books?

Open the unedited bank and credit-card statements yourself, scan every payee and amount, and question anything unfamiliar. Review the payroll register for names and headcount. Compare the reconciliation report's ending balance to the actual statement. Ask for the list of new vendors added. This takes about ten minutes and defeats most schemes, which rely on nobody looking.

Should the bookkeeper have access to move money?

Ideally no. The cleanest arrangement gives the bookkeeper view-only bank access for reconciliation and lets the owner or a second person release payments. Where the bookkeeper does initiate payments for efficiency, require a second approval above a dollar threshold and keep the owner as the only person who can add payees or change bank details.

Internal controls for a five-person business

Textbook internal control assumes a staff large enough that no one person touches a transaction end to end. A five-person business does not have that staff, and pretending otherwise produces control checklists nobody follows. But the underlying goal — make theft hard to commit and quick to surface — is achievable at any size. It takes three design moves: split the money path across at least two people, put dollar thresholds on approvals, and guarantee that someone who did not process the transactions looks at the raw bank statement every month.

The stakes are not theoretical. Occupational-fraud studies consistently find that small organizations suffer disproportionate median losses, precisely because one trusted person controls everything and no one reviews the bank account. Most small-business fraud is not sophisticated; it survives on the absence of a second pair of eyes.

Separation of duties when there are two of you

The principle scales down to one rule: the person who records transactions should not be able to move money alone, and the person who moves money should not control the record of it.

With an owner plus one bookkeeper (employee or outside), the workable split:

Function	Bookkeeper	Owner
Record transactions, categorize, post entries	Yes	—
Reconcile bank and card accounts	Yes	Reviews the reconciliation
Approve and release payments	Prepares only	Approves and releases
Add new vendors or change payment details	Requests	Approves
Open bank statements (unedited, from the bank)	—	Yes, monthly
Run payroll	Prepares	Reviews register, approves

With a second employee — an office manager, say — push payment release to one person and reconciliation review to the other, so no single non-owner both pays and reconciles. The specific assignment matters less than the invariant: no one person can create a payee, pay it, and hide it.

Approval thresholds

Thresholds keep control cheap. Not every payment needs the owner; every large or unusual one does. A typical scheme for a five-person business:

Under a routine threshold (say $250): the bookkeeper pays recurring, pre-approved vendors without sign-off.
Between the routine threshold and a review threshold (say $250–$2,000): owner approves in a weekly batch.
Above the review threshold, or any new vendor at any amount: owner approves individually, before payment.
Any change to a vendor's bank details or remittance address: owner verifies by calling a known number — not one supplied in the change request.

Pick numbers that fit your spend, write them into the bookkeeping engagement letter or the employee's role description, and hold the line. Thresholds that get waived under time pressure are decoration.

Bank-access hygiene

Bank access is where design meets reality. The hygiene list:

Give the bookkeeper view-only online banking credentials for reconciliation. Most business banking platforms support tiered user roles; use them rather than sharing the owner's login.
Never share credentials. Shared logins destroy the audit trail — you cannot tell who did what.
Keep payee creation and bank-detail changes as owner-only rights where the platform allows it.
Turn on transaction alerts to the owner's phone for payments above your review threshold.
Use dual control (initiate/release) for wires and large transfers if the bank offers it.
Remove access the day a person leaves — part of the offboarding list in backup and data security.

The fraud patterns small businesses actually suffer

Knowing the standard schemes tells you what each control is for.

The common small-business schemes, how they work, and what catches them:

Scheme	How it works	What catches it
Billing scheme	Insider creates a fake vendor, or inflates real invoices, and pays themselves	Owner approval of new vendors; scanning statement payees monthly
Payroll ghost	A fabricated or departed employee stays on payroll; insider takes the pay	Owner reviews the payroll register names against known staff each run
Payroll padding	Inflated hours, rates, or bonuses slipped into a run	Owner compares total payroll to headcount and prior periods
Skimming	Cash taken before it is ever recorded; the books look clean	Prenumbered receipts, deposit-to-sales comparison, margin trend review
Payment tampering	Altered payees, forged signatures, or diverted electronic payments	Bank-side dual control; owner opens unedited statements
Expense-report abuse	Personal spending disguised as business expense	Receipt requirement above a threshold; card statements reviewed line by line

Two observations. Skimming never appears in the ledger, so ledger review cannot catch it — only physical controls and analytics (does cash deposited track recorded sales?) do. And every other scheme in the table dies on contact with one habit: the owner reading the actual bank statement.

The ten-minute monthly owner check

This is the control that pays for all the others. Once a month, the owner — not the bookkeeper — does the following:

Open the bank and credit-card statements directly from the bank (paper or the owner's own login), so no one can filter them first.
Scan every payee and amount. Question anything unfamiliar. Fraudsters rely on this scan never happening.
Compare the reconciliation report's ending balance to the statement's ending balance. They must match exactly; reconciliation discipline is covered in bank-feed hygiene.
Review the payroll register: every name known, headcount right, totals in line with last month.
Ask for the month's list of new vendors and any vendor bank-detail changes.
Glance at the financials for anything that moved oddly — margins sliding, an expense line doubling.

Ten minutes, honestly. A bookkeeper who resists this review is itself a red flag; a good one will build the packet for you, as described in monthly client communication.

What this does not protect against

Honest limits. Owner-side fraud — the owner running personal spending through the business — is beyond any internal control, though it creates real problems at tax time and real exposure for the bookkeeper who papers over it (see client red flags). Collusion between the two people you split duties across defeats the split; periodic review by an outside accountant is the backstop, one more reason the year-end relationship in working with the tax accountant matters. And controls cannot fix records that were never kept — the record-keeping baseline in IRS Publication 583 is the floor under everything here.

For payroll specifically, the employer obligations in Publication 15 mean payroll fraud usually compounds into tax-deposit problems, and wage-and-hour exposure under the Department of Labor's Wage and Hour Division rules can ride along with it. Payroll deserves the owner's monthly attention even when everything else is delegated.

Getting started this month

Do not attempt a control framework. Do four things:

Change bank access so the bookkeeper is view-only, or so payments above a threshold need a second approval.
Write down two thresholds — routine and review — and tell everyone involved.
Put the ten-minute owner check on the calendar for the day statements arrive.
Make new-vendor approval and vendor bank-detail verification owner-only, effective today.

That is a real control environment for a five-person business. Everything beyond it is refinement.