Internal Controls Matter More When Cash Is Everywhere

One of our dispensary clients recently caught an employee stealing. Management noticed that one employee was giving out an unusually high number of discounts. Nothing was obviously missing. The cash drawers balanced, and inventory appeared to reconcile. But the activity did not look right.

So management had a friend go into the store as a secret shopper.

The friend placed an order, paid full price in cash, and left. After the customer walked away, the employee applied a 10% discount to the transaction and pocketed the difference.

On paper, everything still worked.

The POS showed a sale at the discounted price. The correct product came out of inventory. The cash drawer contained exactly the amount the POS said it should contain.

The missing money existed only in the difference between what the customer actually paid and what the employee later told the system they had paid.

This is sometimes referred to as discount skimming, but the specific scheme is not really the point. There are countless ways employees can manipulate discounts, voids, refunds, inventory adjustments, loyalty programs, cash transactions, or other parts of a retail operation to steal money or product.

Here at Calyx we estimate that at least 50% of our clients experience theft, and that is probably an understatement. But the larger point is that cash-intensive businesses are particularly vulnerable to employee theft, and cannabis dispensaries have additional risk because they combine large amounts of cash with inventory and a high volume of individual transactions.

Internal Controls Matter, But They Have Limits

That makes internal controls and segregation of duties extremely important.

No single employee should ideally have unchecked control over every part of a transaction or accounting process. Businesses also need independent reviews, reconciliations, approvals, and other controls designed to make fraud more difficult and more likely to be discovered.

But internal controls have limitations.

One of the biggest is collusion.

Segregation of duties works because one person acts as a check on another. But what happens when those two people decide to work together?

An employee may work with another employee, a manager, a customer, a friend, or a family member to circumvent controls that would otherwise prevent theft. Two people working together can defeat controls that would be extremely effective against either person acting alone.

That is one reason it is nearly impossible to design an internal control system that completely eliminates fraud.

The better question is how you reduce the likelihood that someone will attempt it in the first place.

Get to Know the Fraud Triangle

The Fraud Triangle is a commonly used framework for understanding why people commit occupational fraud. It consists of three elements: pressure, rationalization, and opportunity.

Pressure may be financial. Someone is behind on bills, has a gambling problem, is dealing with addiction, wants a lifestyle they cannot afford, or simply wants more money.

Rationalization is how the person justifies the behavior to themselves. They may believe they are underpaid. They may tell themselves they are only borrowing the money. They may believe the company makes plenty of money and will never notice. They may even convince themselves that they deserve it.

Those two factors are extremely difficult for an employer to control.

You cannot know every financial pressure affecting every employee, and you cannot control the story someone tells themselves to justify stealing.

What management can influence is opportunity.

Internal controls and segregation of duties are important because they reduce opportunity. They make fraud more difficult to commit and more difficult to conceal.

The Perception of Detection

There is another factor that is just as important, if not more important in the real world: the perception of detection.

An employee may technically have an opportunity to steal. But there is a major difference between having an opportunity and believing you can get away with it.

If employees believe management is paying attention, reviewing unusual activity, comparing information, watching trends, and investigating things that do not make sense, the perceived risk of stealing becomes much greater.

Think about our client's employee.

The theft worked because the employee apparently believed the discount activity would not be noticed. The cash balanced. The inventory balanced. From the employee's perspective, there was probably a very low perceived risk of getting caught.

Then management noticed the pattern. They tested it. And they caught the employee.

That changes more than one employee's behavior. It changes the perception throughout the organization.

Employees do not need to believe management is watching every transaction every minute of every day. They need to believe management could discover what they are doing.

The most sophisticated internal controls in the world will not completely prevent theft. Controls can be circumvented. People can collude. Managers can participate. Systems can be manipulated.

But when employees believe irregular activity will eventually be noticed and investigated, stealing becomes considerably less attractive.

That is why good fraud prevention is not simply about creating more rules or adding more controls.

Internal controls and segregation of duties reduce opportunity.

Management oversight increases the perception of detection.

Together, they change the calculation someone makes before deciding whether stealing is worth the risk.

For cash-intensive businesses, and particularly cannabis dispensaries, that may be one of the most important internal control concepts of all.

You may never be able to make employee theft impossible.

But you can make employees believe they are very likely to get caught.

This article is intended for informational purposes only and does not constitute legal, tax, or accounting advice specific to any business.