Budget 2026: what it means for you and your business —
In short
Most financial loss in owner-managed businesses arises not from sophisticated fraud but from weak process: no segregation of duties, unchecked payment runs, unreconciled accounts, one person with too much access and too little oversight. We review your controls and systems, identify where the exposure genuinely sits, and give you a practical, prioritised plan to close the gaps.
No segregation of duties. The same person raises the invoice, receives the payment and reconciles the bank. This is the single most common and most serious weakness in small business, and it is almost always a resourcing problem rather than a deliberate choice.
Unchecked payment runs. Supplier bank details changed with no verification. This is how invoice-redirection fraud works, and it is now the most common way UK businesses lose money.
No independent bank reconciliation. If the person who can move money is also the person who reconciles it, there is no control at all.
Excessive system access. Everyone an administrator, nothing logged.
Expenses and company cards approved by nobody, or by the person spending.
Invoice-redirection fraud — an email, apparently from a genuine supplier, notifying a change of bank details — is now the most common way UK SMEs lose significant money. It is unglamorous and devastatingly effective.
The control is simple and almost never in place: never change supplier bank details on the basis of an email. Verify by telephone, on a number you already hold — not one given in the email — and have the change approved by someone other than the person who processes the payment.
We build this into your payment workflow, so it happens by design rather than by memory.
This is the honest constraint most small businesses face, and pretending otherwise is useless.
The answer is compensating controls. The owner reviews the bank statement — the actual statement, not the summary. Payment runs are approved above a threshold. Bank feeds and automated reconciliation rules remove the opportunity to manipulate the ledger. New supplier bank details require a second person. An outsourced provider performs a function the internal person cannot then also check.
You cannot always segregate. You can almost always create visibility — and visibility alone deters most opportunistic fraud.
Because for many businesses, the annual audit was the only occasion on which anyone independent examined the numbers.
With audit thresholds having risen in April 2025, a great many companies have quietly lost that scrutiny — and most have replaced it with nothing. The saving is real; so is the new exposure. A controls review is a fraction of an audit fee and addresses the risk directly.
Verify by telephone, on a number you already hold — not one given in the email — and have the change approved by someone other than the person making the payment. This one control prevents the most common way UK businesses lose money, and almost nobody has it.
Practical, prioritised, proportionate — we know you can’t segregate duties with four staff.
Compensating controls that actually work in a small business.
Payment fraud controls built into your workflow — by design, not by memory.
Essential after leaving audit — you lost your only external check; replace it.
Chartered (ICAEW) — and our forensic team knows how the losses actually happen.
This page provides general information about the 2026/27 UK tax year and is not advice on your particular circumstances. Tax and regulatory rules change frequently. Please contact us before acting, or refraining from acting, on anything set out here. LMJ Group is a firm of Chartered Accountants regulated by the ICAEW. LMJ Group is not a registered auditor and does not provide audit services. Last reviewed: July 2026.
