The roofing company employee was moonlighting. Not only that, but most of the shingles on his side jobs came from the company warehouse. His brazenness — he backed up his truck and loaded it when he thought no one was watching —got him caught and fired.

Small companies — those with fewer than 100 employees —are particularly vulnerable to internal theft, either of cash (i.e., embezzlement) or materials.

According to a 2004 report by the Association of Certified Fraud Examiners in Austin, Texas, the median cost of fraud to a small business was $98,000. A typical business organization loses 6% of its annual revenue to occupational fraud, which the ACFE defines as activity ranging from embezzlement to theft of office supplies.

Lack of Controls The reason that small businesses are so vulnerable, experts say, is because few financial controls exist. “The smaller you are, the more likely this is to happen,” ACFE research director John Gill says.

Not only that, but “small companies lose a much bigger percentage of their revenues and profits than big companies,” says Gary Zeune, an accountant, fraud expert, and founder of The Pros & The Cons (www.thepros, a Web site dealing with employee fraud and abuse. “Typically the only control [owners] have in place is blind trust,” Zeune says.

Small companies, Gill says, are particularly “vulnerable to cash theft,” which “can be someone on the staff or it can be a professional bookkeeper.” Thieves typically take the form of employees (or outsourced providers of accounting services) who write themselves checks or pay bills improperly, i.e., disbursing your company's funds to friends or shell companies via bogus invoices. In the absence of oversight — that is, someone to check and cross-check — temptation abounds.

Preventive Steps According to the ACFE, the most cost-effective way to deal with fraud is to prevent it. To do that:

Use employment background checks of prospective hires. Include a driving record search, consumer bankruptcy record search, county criminal record search, employment verification, employment credit report, and education verification. The cost? Typically $100 to $150 per employee. “Sometimes you'll pick up amazing things; people fired for fraud who didn't put that down on their application. Or long lists of arrests,” says Gregory Bangs, vice president and global product manager for crime at Chubb Group of Insurance Companies in Warren, N.J.

Make sure the employee who writes or deposits checks does not balance the bank statements. “If someone in the company prepares payroll, have an outside bookkeeper reconcile the bank statements and review that every month,” Gill advises. Similarly, if you use an outside bookkeeper, have an employee check that person's work.

The business owner should open the bank statements. This ensures that payees are bona fide and that there are no forged signatures. According to Zeune, one of the easiest, no-cost controls is to have bank statements sent to your home. “All you have to do is rip it open and take a few minutes to go through every check,” he says. “That will eliminate 98% of all thefts out of checking accounts.”

Review and approve every check that goes out, as well as all company credit card transactions. Require countersignatures on all checks, and avoid signing blank ones.

Make a practice of doing something unpredictable. Call the companies or individuals listed on expense forms or ask your bookkeeper to pull invoices so you can match them to company checks. This lets the sales and office staffs know that attention is being paid.

Match materials expenses against job specifications and invoices. Pay particular attention to increases in the amount of materials wasted on jobs. If a 5% waste factor on siding jobs is suddenly coming in at 10% or 15% for no obvious reason, that mean someone is helping themselves to your materials.

Crime Insurance A final line of defense is crime insurance. This is a policy that safeguards your company against loss from embezzlement and other white-collar crime. Bangs says that such policies are “blanket” — meaning “if anybody steals from that employer, [the employer] is covered.” Rates are determined by the type and size of the business, its loss experience, and “the quality of their internal control procedures that could detect and mitigate fraud,” as well as the degree of liability and the size of the deductible. That said, Bangs estimates small companies would pay anywhere from $1,500 to $5,000 annually to put such a policy in place.