Five Bulletproof Controls to Stop Internal Theft Before It Bleeds Your Construction Business Dry
You’re sitting in your favorite coffee shop, checking the books on a quiet Sunday morning, when something doesn’t add up. That licensing fee from last month — wasn’t it half that amount last year? You dig deeper. Then deeper. Three hours later, you’re staring at nearly $400,000 in bogus invoices, all signed off by your most trusted project manager.
Sound like a nightmare? It happened to a contractor I know. The theft went on for two years, hidden in plain sight, orchestrated by someone who had keys to the office and keys to the owner’s trust.
Here’s the brutal truth about internal theft in construction: it’s not the sketchy temp worker or the new guy you need to worry about. It’s the employee who’s been with you for 30 years, the one who “never takes a day off,” the one you’d trust with your mother’s checkbook.
But here’s the thing — proper controls don’t just protect your money. They protect good people from bad situations and false accusations. Let me show you five bulletproof systems that’ll stop theft before it starts, no matter how trusted your team might be.
The Harsh Reality: Your Most Trusted Employee Is Your Biggest Risk
I’ve seen it time and again in my 25+ years as a construction CPA. The sweet bookkeeper who’s been balancing your books since you started the company. The project manager who’s practically family. The office manager who knows where every receipt is filed.
These aren’t bad people who set out to steal from you. They’re good people who find themselves in bad situations. Financial pressure hits — maybe it’s medical bills, maybe it’s a kid’s college tuition, maybe it’s a spouse’s gambling problem. Or worse, maybe they’re being coerced. I’ve seen cases where drug dealers literally coach employees on how to set up fake invoice systems to skim money.
One contractor’s project manager stole $380,000 through bogus licensing fees over two years. Every fake invoice looked legitimate. Every signature was perfect. The theft only came to light when the owner accidentally called the licensing agency directly about a renewal.
The point? Don’t put good people in bad positions. Proper controls protect everyone — your money, your business, and your employees’ reputations.
Red Flags That Scream “Something’s Rotten in Your Back Office”
Think of your financial controls like quality control on a job site. You wouldn’t let a crew pour concrete without checking the forms, right? Same principle applies to your back office.
Here’s what to watch for:
Missing documents that “magically disappear” when you need backup for transactions. That’s like having blueprints vanish right when the inspector shows up — it doesn’t happen by accident.
Multiple payments to the same vendor, especially credit card companies. Could be someone’s paying their personal Visa bill through your business account. I’ve seen bookkeepers rack up $50,000 in personal charges this way.
Invoice volume shooting up while your actual work stays flat. It’s like your material costs doubling but your square footage staying the same — the math doesn’t work.
Your bookkeeper who “doesn’t want to waste time” and makes lots of adjusting entries instead of entering real transactions. That’s a red flag the size of a crane boom. Legitimate businesses don’t need constant “adjustments” unless something’s being covered up.
Control #1: Segregation of Duties — Don’t Let One Person Hold All the Keys
This is construction finance 101, but I’m amazed how many contractors ignore it.
Never have the same person depositing checks AND reconciling bank accounts. That’s like letting the fox guard the henhouse. If someone can both put money in and account for where it went, they can make money disappear without a trace.
Even in a small shop, you need separation. Maybe you outsource your bookkeeping but handle deposits yourself. Maybe your spouse reconciles the accounts while your office manager pays the bills. The point is, no single person should control the entire money pipeline.
Here’s a simple rule: The person ordering materials shouldn’t be the same one paying the bills. The person writing checks shouldn’t be the one signing them (unless it’s you, the owner). The person making deposits shouldn’t be the one balancing the books.
And here’s a pro tip that costs you exactly nothing: Mail your bank statements to your home address. Just the act of opening them and glancing at the transactions sends a clear message that you’re watching. Amazing how that simple step makes people “straighten up their act.”
Control #2: The “Mandatory Vacation” Rule That Catches Thieves Red-Handed
This one’s brilliant in its simplicity. Require key employees to take 10 consecutive days off. Not scattered long weekends. Ten straight days where they can’t touch the books, can’t “check in,” can’t fix anything.
Why? Because most internal theft requires daily maintenance. It’s like keeping multiple job schedules straight — if someone’s “robbing Peter to pay Paul” financially, they need to be there every day to keep the juggling act going.
I’ve seen bookkeepers who haven’t taken a real vacation in five years. They’re not dedicated — they’re scared their house of cards will collapse while they’re gone. And guess what? It usually does.
Employees who never take time off are often covering their tracks daily. Use their mandatory vacation to test your systems and spot any financial juggling acts.
Bonus: Most employee dishonesty insurance policies actually require this control. Insurance companies know what works.
Control #3: Smart Bank Account Setup and Technology
Remember the Profit First principles we talk about on the show? Separate bank accounts aren’t just for profit allocation — they’re theft detection systems.
It’s easier to spot a $3,000 theft in a $15,000 materials account than a $3,000 theft in a $300,000 general operating account. The ratios jump out at you. Your JobEx (direct job costs) accounts should show predictable patterns. When they don’t, you investigate.
Modern credit cards with real-time alerts and location tracking catch fraudulent purchases instantly. I get a text every time someone uses our company card. If my project manager is buying lunch in Miami when he’s supposed to be on a job site in Atlanta, I know about it in real-time.
Electronic transfers are more secure than checks for another reason: they eliminate the “different name on check vs. computer entry” scam. I’ve seen bookkeepers write checks to “ABC Supply” but enter them in the system as “A1 Consulting” — guess where that money really went?
Control #4: Outsource Key Functions for Fresh Eyes
Sometimes the best control is bringing in outside eyes. Hire an outside controller or CPA to review your books quarterly. Not for a full audit (those don’t catch theft unless you specifically ask for forensic accounting), but for a fresh perspective.
I’ve had contractors tell me, “Ever since we started having you look at our books every quarter, our bookkeeper’s been a lot more careful about documentation.” That’s not coincidence — that’s human nature. People behave differently when they know someone’s watching.
Even dummy security cameras work for the same reason. The mere presence of oversight changes behavior.
Control #5: Protect Everyone with Proper Documentation and Insurance
Here’s the thing about employee dishonesty: it doesn’t just hurt the business owner. It destroys teams. When money goes missing and you don’t have proper controls, every employee becomes a suspect. Good people get blamed for others’ crimes.
Proper controls protect innocent employees from false accusations. They also protect guilty employees from temptation. It’s like safety protocols on a job site — you don’t install guardrails because you think your crew wants to fall off a roof. You install them because even good people make mistakes when the safety systems aren’t there.
Employee dishonesty insurance exists, but most policies require you to have basic controls in place. No segregation of duties? No coverage. No mandatory vacations? No coverage. Insurance companies have figured out what works — follow their playbook.
The Bottom Line: Controls Protect Everyone, Not Just Your Money
Look, I get it. You didn’t start a construction company to become a forensic accountant. You started it to build things. But here’s the reality: the people who can steal from you are the ones you trust most.
That doesn’t mean you should trust nobody. It means you should set up systems that protect everybody — your money, your business, and your good employees from being put in compromising positions where theft becomes possible.
Remember: you’re not trying to catch thieves. You’re trying to prevent theft. There’s a big difference. One mindset breeds paranoia and destroys team culture. The other builds systems that protect everyone and let good people focus on doing good work.
The five controls I’ve outlined aren’t expensive or complicated. They’re just smart business practices that happen to make theft nearly impossible. And in construction, where cash flow is already tight and margins are slim, you can’t afford to let internal theft bleed your business dry.
Want to hear more real-world stories about protecting your construction business? Listen to the full episode of the Contractor Success Forum at https://contractorsuccessforum.com/ or subscribe on YouTube, Spotify, or Apple Podcasts. And if you need help setting up bulletproof financial controls for your construction company, contact us at Carpenter & Company CPAs — because protecting your business is just as important as building it.