“And other checks were adjusted by the exact same amount of the missing checks, so the amounts didn't match.” McCarthy said. “So it just looked weird. It looked fishy.”

Less than a half hour in, McCarthy brought the owner into a room and told him that something was off. He shut the door and said, “I know what it is. I know who it is. It’s my mother.”

He had hired her to do bookkeeping to keep her out of trouble, but she was taking money from the business to help her daughter, the owner’s sister.

Embezzlement is something that can happen to anyone because oftentimes it’s the person who no one would ever expect. Jennifer Beidel, partner at Saul Ewing LLP, said embezzlement tends to happen — and be the longest-term and most successful — when an employee has been with a company for 10, 15, 20 years.

“They’ve gained a bunch of faith from others around them, so people stop watching what they're doing,” Beidel said. Then for whatever reason, the person they had faith in begins to steal.

HVAC contractors need to have steps in place to protect their businesses from embezzlement. Setting up that kind of security, Beidel said, takes implementing four main strategies.

1. Internal Controls on Financials

FOUR EYES: A potential embezzler could be anyone, so a second set of eyes on financials is key. (Courtesy of Out of the Box Technology)

It’s always good to have a second set of eyes on financial issues within the company. That way, there isn’t only one person who has exclusive control over any financial function.

“So that means if someone regularly handles accounts receivable and someone else regularly handles accounts payable, those people could switch roles for purposes of doing a periodic audit on the other one’s work,” Beidel said.

Adding a second person in that chain, or putting a plan in place to do so, it makes it harder for someone trying to embezzle to cover up what they're doing.

The steps McCarthy took to ensure her client’s embezzling mother could embezzle no further were similar.

“We put a plan in place to restrict her access,” she said. “He needed to maintain a relationship with his mother. He didn’t want her to go to jail, so he wasn't going to report her. But he needed to put controls in place to not allow that to happen again.”

Steps like restricting the embezzler’s user access in QuickBooks, taking away the signature stamp that was floating around the office, and routing banking statements to the son’s home (instead of the office) ensured the son got copies of all the bank statements. This also ensured different sets of eyes on monthly bank reconciliations.

2. Software Solutions

Beidel said there are a number of software solutions out there that can help prevent embezzlement. The programs can vary by sophistication, but depending on the size of a business, there is probably a solution available.

“Things like having an approved list of vendors that's listed in an accounts payable program. And so to be able to write a check to anyone, they have to be approved in that program and go through an approval process,” Beidel said.

For example: A check can be set up to only print out of a certain software program. The program would allow checks to only be sent to certain set people, and if a check needs to be printed to someone outside of the set people, it has to get approved.

McCarthy shared an example of how this precaution should have worked in real life. McCarthy was hired to set up QuickBooks by Certified Public Accountant (CPA) Firm to work with an attorney client. She was told she really wouldn’t talk with the client, but would work directly to the bookkeeper. So that’s what she did: She set up the accounting system and trained the bookkeeper on how to use it. Periodically, McCarthy would help the bookkeeper clean stuff up, fix things she didn’t do right, or train her on something new. Or McCarthy would help the bookkeeper with the reconciliation process, just being that second set of eyes and being more involved in the process.

“I noticed that there were a lot of payments going out to credit card companies to pay a credit card bill,” McCarthy said.

There were no expenses associated with it. So McCarthy asked for statements of those credit cards to see what the purchases, in order that she could put together a process for the bookkeeper to start entering the purchases and reconcile the credit cards.

McCarthy said the bookkeeper responded with, “Well those are the attorney’s credit cards and she won’t give me access to them. You’ll have to work that out with the CPA at the end of the year.’”

That was reasonable to McCarthy. She relayed the information and her findings to the CPA, and that was the end of her involvement.

Come to find out, the bookkeeper was writing checks out of QuickBooks to pay her own credit card bills.

“Because I never saw a statement, and no one could reconcile a statement, there was no way to verify anything. So she ended up stealing like $600,000 to $800,000 from this attorney,” McCarthy said.

The bookkeeper went to jail. But having some simple practices in place would’ve helped.

“It’s not even actually doing the reconciliations. It's looking at the uncleared transactions that that are entered into an accounting system,” McCarthy said.

3. Hiring an Accountant

Though it can be costly, hiring an accountant to do periodic either reviews or audits of the books or of the company’s internal controls can be really helpful, Beidel said.

“The accountant can point out specific areas of risk for the particular business and suggest controls specific to those risk.”

4. If Something Seems Off, Say Something

Here is where having a good work culture at an HVAC company comes in handy.

“Having a reporting or a compliance culture where if somebody else within the organization sees something concerning, they feel comfortable raising it … you need other people to feel empowered to speak out, if they see a concern,” Beidel said.

If that call comes, it needs to be investigated and taken seriously. It often is the difference between stopping and enabling bad behavior.

“The biggest things are separation of duties and looking at bank statements and credit card statements,” McCarthy said. She also noted that having a business debit card is a really bad idea.

Beidel said, “As an overarching theme, we can't get complacent with people. Whether it's your cousin, brother, or somebody you've known for 20 years — that's when people get themselves into trouble. And nine times out of 10, when I have a client come to me with an embezzlement case, they say, ‘I just can't believe it. She went to church, she did this … How could she have been stealing?’

“Seems like it's always the people that you would never suspect. Because the reality is, if they got away with it, no one suspected it.”