New owners are exposed to employee theft because the seller was often the main control, and that control leaves at closing while the long-tenured bookkeeper with full access stays. The fix in month one is a handful of controls over money movement, plus a crime policy whose trigger, limits and conditions fit a business you do not know yet. This guide is for buyers in their first months who want to protect cash without treating loyal staff as suspects.
The short answer
- The common schemes are fake vendors, altered checks, ghost employees on payroll, skimmed receipts, padded expenses and stolen inventory.
- Add these first: take over bank administration, require two people for payments and new vendors, read the bank statements yourself and separate who pays from who records.
- Crime insurance pays the business back for employee theft, but only up to its limit and only for losses that fit its timing rules (when the theft happened or when you found it) and its conditions.
- Coverage for an employee usually ends once a manager or officer learns of that person's dishonesty, and theft before your policy began may be excluded.
- If you find something, preserve evidence, call counsel and notify the carrier promptly, before you confront anyone.
Why are new owners especially exposed?
In many owner-run businesses, the seller signed every check, knew every vendor and could tell at a glance when a number looked wrong. That informal control does not transfer. You inherit people who have had broad access for years, processes that live in someone's head, and books you are still learning to read.
- No baseline. You do not yet know what normal looks like for vendor spend, refunds, overtime or inventory shrink.
- Concentrated access. One office manager may enter bills, cut checks, reconcile the bank and run payroll.
- Distraction. The first months are full of integration work, lender reporting and new systems, which is exactly when small irregularities slip by.
- Old schemes surface. Ownership changes are also when old schemes come to light, because a new accountant or controller looks closely for the first time.
The Association of Certified Fraud Examiners (ACFE), in its 2024 Report to the Nations, links anti-fraud controls with lower losses and faster detection. It also reports that most perpetrators showed at least one behavioral red flag, such as living beyond their means or an unusually close tie to a vendor, and that tips uncovered more frauds than any other method. Theft is usually caught by controls and tips, not by luck.
What theft schemes should you look for?
| Scheme | How it works | Red flags | First check |
|---|---|---|---|
| Fake vendor billing | An employee sets up a vendor they control and pays it for nothing | Vendors with a home address or post office box, round invoice amounts, no purchase orders | Review the vendor list and every vendor added in the past two years |
| Check tampering | Checks are forged, altered or written to the employee | Missing check numbers, voided checks without copies, unusual payees | Look at check images from the bank, not the accounting system |
| Ghost employees and payroll padding | Pay for people who do not work, or extra hours and rates for real ones | Employees with no tax forms, shared bank accounts, overtime that never varies | Match the payroll register to a headcount you can see |
| Skimming and lapping | Customer payments are taken before they are recorded, then hidden by applying later payments to older invoices | Rising receivables age, customer complaints about statements, many credit memos | Send statements yourself and review credits and write-offs |
| Expense and card abuse | Personal purchases on company cards or padded reimbursements | Missing receipts, purchases on weekends, merchants unrelated to the business | Read card statements monthly |
| Inventory and equipment theft | Materials, parts or tools leave and are sold | Shrink that grows, jobs that use more materials than estimated | Count high-value inventory and tag equipment |
Treat red flags as questions, not accusations. Most have innocent explanations, and you want to keep good people who have kept the business running.
Which controls should you add in month one?
You do not need an audit department. You need a few controls over the places money leaves the business, put in place early and explained as standard practice for the new owner, not as distrust.
| Control | What it stops | Effort |
|---|---|---|
| Become the bank administrator; update signers and remove the seller's access | Unauthorized payments and changes | Low |
| Two-person approval for payments above a set amount and for any new vendor or bank detail change | Fake vendors, payment fraud | Low to medium |
| Read bank and card statements yourself each month, directly from the bank | Most schemes, eventually | Low |
| Separate duties: the person who pays bills does not reconcile the bank or add vendors | Concealment | Medium in a small office |
| Ask the bank about check and payment filtering services | Altered checks and unexpected debits | Low |
| Review the payroll register against people you can see | Ghost employees and padded hours | Low |
| Require everyone with financial duties to take a full week off each year | Schemes that need daily tending | Low |
| Give staff a way to report concerns, including anonymously | Schemes others notice first | Low |
Where one person must wear several hats, compensate with your own monthly review. The same controls that stop internal theft also help against outside fraud aimed at new owners; see funds transfer fraud and new owners and cyber risk during an IT migration.
Which crime policy terms matter most to a new owner?
A commercial crime policy pays the business for its own losses from theft and fraud, starting with theft by employees. Forms vary by carrier, so read these terms on your policy:
| Term | What it means | What to ask |
|---|---|---|
| Discovery or loss sustained | A discovery form covers loss discovered during the policy, even if the theft started earlier. A loss sustained form covers loss that happens during the policy. | Which form is it, and how would a theft that started before closing be handled? |
| Period to discover loss | A limited window after the policy ends to discover loss that would otherwise be covered. Its length depends on the form and can end early when new coverage starts. | How long is it, and does it coordinate with my new policy? |
| Prior theft limits | Some discovery forms set a retroactive date and exclude theft before it. A loss sustained form covers earlier losses only if conditions about prior coverage are met. | Is there a retroactive date, and what is it? |
| Known dishonesty | Coverage for an employee usually ends once an officer, manager or other designated person learns of that employee's dishonest act. | Did the seller ever catch this person in anything? Get the answer in writing. |
| Limit and deductible | The most the policy pays per loss, and what you pay first | Does the limit fit what one person could take before anyone noticed? |
| Inventory shortages | Most crime forms exclude a loss you can prove only by an inventory count or a profit and loss comparison; you need other evidence of theft first, then inventory records can support the amount | How would an inventory theft claim have to be proven? |
An employee dishonesty endorsement on a package policy often carries a small limit. If the seller stays on as a consultant with bank or system access, check the crime policy's definition of employee. The standard Insurance Services Office (ISO) crime form counts a former owner, officer or manager retained as a consultant as an employee while working for you. Other forms vary, an asset purchase into a new company can blur whether the seller is your former employee, and theft by someone who kept an ownership stake may be excluded. See insurance when the seller stays on as a consultant. The crime review for new owners covers the other insuring agreements, who counts as an employee, benefit plan bonding and social engineering.
What if you find theft that started under the seller?
- Preserve evidence quietly. Save bank records, check images, system logs and emails. Do not let the suspected person delete or change records.
- Call counsel before confronting anyone. How you investigate and how you handle the employee both carry legal risk.
- Notify the carrier promptly. Crime policies have strict notice and proof of loss conditions. Report suspected theft even before you know the amount.
- Sort out whose loss it is. Deal structure decides whether the company's policy or the purchase agreement is your main recourse for theft before closing; the crime review for new owners explains how each form handles it, and deal counsel should confirm how your agreement applies. See seller indemnity vs insurance and stock vs asset deal: who covers old claims.
- Revisit the deal numbers. A scheme can inflate expenses or hide revenue, so tell your accountant. It may affect the earnings you paid for and your lender reporting.
A hypothetical example. Four months after closing a stock purchase of a 30-person dental laboratory, the buyer starts mailing statements to the dental practices it serves. Two practices call to say they paid invoices that still show as open. The office manager of 12 years had been depositing some customer checks into an account she controlled and hiding the gap by applying later payments to older invoices, about $5,000 a month for three years, roughly $180,000 in all. The company has a stand-alone crime policy on a loss sustained form with a $100,000 employee theft limit. Crime forms usually treat a series of thefts by one person as a single occurrence, so even if every period of the scheme were covered, the limit caps the recovery at $100,000. The buyer may pursue the rest through the seller's indemnity, depending on the purchase agreement. Mailing statements directly is what brought it to light, and doing it in month one would have caught it sooner. Separating who receives payments from who records them would have made it harder to start.
Morrow can review the crime coverage you inherited against how money actually moves in your business and request quotes where it makes sense.
Keep reading
- New Owner Review: Commercial Crime and Employee Theft
- Funds Transfer Fraud: Why New Owners Are a Favorite Target
- Seller Indemnities vs Insurance: What They Are Really Worth
- Stock Deal vs Asset Deal: Whose Insurance Responds to Old Claims?
- Cyber Risk During IT and Email Migration After You Buy a Business
- All guides for new business owners
Frequently asked questions
Can I run background checks on employees I inherited?
Possibly, but checks on current employees come with legal rules, including federal rules on disclosure and consent when you use a screening company, and state or local limits. Ask employment counsel before you start, and apply any policy the same way to everyone in similar roles.
What should I do if I suspect someone but have no proof?
Do not accuse anyone yet. Quietly preserve records, pull bank statements and check images directly from the bank, and ask counsel how to look further. Tell your broker early, because crime policies set notice deadlines that can start when you first learn of facts suggesting a loss.
How do I add controls without insulting long-time staff?
Present them as standard practice for the new owner and apply them to everyone, including yourself. Explain that two-person approval protects employees from suspicion as much as it protects the business.
What crime limit should a small business carry?
There is no standard number. Estimate what one trusted person could take before anyone noticed, using your largest payment runs, deposits, payroll cycles and resellable inventory, and remember schemes often run for a long time before discovery.
The seller once caught this employee taking money but kept them on. Does that matter?
It can. Many crime forms end coverage for an employee once a manager or officer learns of a dishonest act by that person. Tell your broker and counsel, and ask the seller for details in writing.
References
- Association of Certified Fraud Examiners: Occupational Fraud 2024, A Report to the Nations
- IRMI: Need to Know, Major Changes to the ISO Commercial Crime Program
- IRMI: Crime, Getting More Out of the Policy
Just bought a business? Get your insurance reviewed.
Send Morrow the declarations pages, loss runs and key contracts you inherited. Morrow can review them against the business you bought, flag gaps and request quotes where it makes sense. Any new terms depend on carrier underwriting.
Morrow · 25 New Chardon Street, 4th Floor, Boston, MA 02114
This article is general information, not legal, tax or financial advice, and not a coverage determination. Coverage depends on the actual policy wording, carrier underwriting, your purchase agreement and your contracts. Ask your attorney and accountant about deal and legal questions.