"He has been with us for twenty years. I trust him completely." It is the most common sentence before the most expensive surprise.
In many companies, controls are not missing because of negligence. They are missing because of trust. The owner relies on a long-serving finance manager or project accountant, and adding checks feels like an insult to someone who has proven their loyalty for years.
The intention is understandable. The result is a business protected by one person's character, and nothing else.
The Pattern Behind the Surprise
Consider how these cases usually unfold. A trusted employee has handled contractor and supplier payments for years. They maintain the supplier list, review contractor invoices and progress claims, release payments below a certain limit, and reconcile the bank account. Nobody reviews their work, because they know the projects better than anyone. They rarely take leave. When they do, payments wait until they return.
When a problem is finally discovered — through an auditor, a contractor dispute, or the employee's sudden absence — it has often been running for years. And the first question the owner asks is the one that cannot be answered: how much, and since when?
Why Trust Cannot Replace Controls
Controls are not an accusation. They exist for reasons that have nothing to do with anyone's character:
- People make mistakes — even the most loyal employee can pay the same invoice twice or certify a claim for work that was never completed
- Circumstances change — financial pressure, illness, family problems, or a new conflict of interest can affect anyone over twenty years
- Access accumulates — long-serving staff collect permissions over time that nobody ever reviews or removes
- The past cannot be verified — without controls, the owner cannot confirm that everything was right, only hope that it was
One Person, One Full Cycle
The single most dangerous design in any company is one person controlling a full payment cycle: requesting, approving, paying, and recording. It does not matter how honest that person is. In that design, nobody else can see an error, and nobody can prove there was none.
The Trust-Dependence Matrix
Map every critical role on two questions: how much access does this role have to cash, contracts, systems, and data — and how much independent oversight surrounds it?
- High access, low oversight — the danger zone. Trust is the only control. This is where the largest losses come from, whether through error or intent.
- High access, high oversight — the target. Trusted people with real authority, inside a structure that protects them and the business.
- Low access, low oversight — low exposure. Acceptable for now, but review it as the role grows.
- Low access, high oversight — over-controlled. Controls cost time and money. Move them to where the risk is.
Red Flags in Trusted Roles
No single sign proves anything. But when several appear around the same role, the role needs a structure around it:
- The person rarely takes leave, and the work waits until they return
- They resist new systems, audits, or anyone else learning the process
- They are the only contact for certain contractors, suppliers, or banks
- Records in their area are incomplete, late, or kept outside the main system
- Exceptions and urgent payments are frequent, and they are usually the ones approving them
- Unusual changes in behavior or circumstances go unexplained
Controls Protect the Loyal Employee Too
This is the point most owners miss. Without controls, a trusted employee has no way to prove their work was clean. Any error, any rumor, any suspicion falls entirely on them. Clear controls protect honest people by giving them evidence: documented approvals, reviewed reconciliations, and separated duties.
The Minimum Control Set for Trusted Roles
- Segregation of duties — no single person requests, approves, pays, and records the same transaction
- Approval limits — a documented delegation of authority with clear thresholds, reviewed every year
- Quarterly access review — system and bank permissions matched to the current role, not accumulated history
- Mandatory leave and cover — every critical role is regularly performed by someone else, ideally for two consecutive weeks a year
- Independent reconciliation — bank and key accounts reconciled monthly by someone outside the payment process
- Approval of supplier master changes — new suppliers, new subcontractors, and changes to bank details require a second approval
How to Introduce Them Without Breaking Trust
- Present controls as a company standard, not a reaction to a person. Apply them to every critical role at once, including the owner's closest staff.
- Involve the trusted employee in the design. They know the process best, and involving them signals respect rather than suspicion.
- Start with the danger zone. Fix high-access, low-oversight roles first; they carry the most risk.
- Explain the protection. Tell people directly: these controls exist so that nobody's integrity ever has to be taken on faith.
The First 30 Days
- Map the danger zone. List every role with access to cash, bank accounts, payroll, contracts, or supplier data, and note who reviews each one.
- Run three quick data checks. Look for duplicate payments, recent changes to supplier bank details, and payments made just below approval limits.
- Review access. Remove system and bank permissions that no longer match the person's current role.
- Schedule leave and cover. Ensure every critical role is performed by someone else for a period this year.
- Move the reconciliation. Assign the monthly bank reconciliation to someone outside the payment process.
If You Find Something
Discovering a problem in a trusted role is emotionally difficult, and that is exactly when owners make costly mistakes. Avoid confronting the person before the facts are clear. Preserve records and system logs first. Involve an independent reviewer, and take legal advice before acting. Handled calmly and with evidence, an issue can be resolved fairly — for the company and for the employee.
Measuring It
The RASEKH™ Governance Index assesses internal control, authority, and accountability across 15 governance domains, with every score backed by evidence — showing owners exactly where the business depends on trust alone, before that dependence becomes a loss.
The Bottom Line
Loyalty deserves respect. It does not deserve to carry the full weight of protecting the business. Trust people — and build controls anyway. The best employees will welcome them. Only someone with something to hide will object.
