Controls of one: the habits that make theft visible

Why "controls of one" isn't a contradiction

Internal controls are usually built around segregation of duties—one person approves a payment, a different person records it, a third reconciles the account—and a solo practice has exactly one person to do all three. That doesn't mean controls are impossible; it means the goal changes from separation to visibility. A control that makes every dollar's movement something you personally see and can explain, every month, does most of what segregation of duties does in a larger organization: it makes an anomaly stand out instead of disappearing into a process nobody's watching closely.

The habits that create visibility while you're solo

A handful of habits carry most of the weight. Personally open and review every bank and credit card statement rather than only seeing a summary your bookkeeper produces—look at the actual line items, not just the total. Reconcile deposits against your billing system's export monthly, the same discipline that keeps your books honest for tax purposes doing double duty as a fraud check. Keep business and personal accounts fully separate; commingling is a bookkeeping problem and a control problem at once, since a mixed account lets an unusual withdrawal blend into the noise—you commingled walks through what cleaning that up actually involves once it's happened.

Even a trusted contract biller or bookkeeper—someone you'd send a 1099-NEC once their fee crosses the $600 threshold for the year 1Ref 1Internal Revenue Service (2026).About Form 1099-NEC, Nonemployee Compensation.The $600 threshold that makes a contract biller or bookkeeper a 1099-NEC recipient, framed as a reminder they remain a reviewed vendor, not an unsupervised one.—should have every payment they process visible to you monthly, not simply reconciled by them and reported as done.

Where solo owners actually get taken

The realistic threats rarely look like a movie-plot embezzlement scheme. A fake vendor invoice for a service that sounds plausible, a check altered after it's signed, a payment-app request that looks like a patient refund but routes to an unfamiliar account, and a biller who quietly writes off real balances as uncollectible rather than chasing them are the actual patterns behind embezzlement discovered after the fact in small practices.

What makes each of these work is the same gap: nobody who could recognize the anomaly ever looked closely enough to see it. A fake vendor invoice survives because it resembles a real one and nobody checks it against an actual service rendered. A check altered after signing survives because nobody compares the cleared amount to what was written on the stub. Neither requires a sophisticated scheme—both require only that the one person capable of noticing never actually looks.

Each is defeated by the same habit: looking at the underlying detail yourself on a fixed schedule, rather than trusting a summary or a running balance that looks roughly right.

When a payer refund creates its own control gap

Overpayments and recoupments add a wrinkle particular to healthcare billing: money that has to go back to a payer, processed through whatever refund mechanism that payer publishes, on whatever timeline its contract sets. Treat every payer refund request with the same scrutiny you'd give an outgoing check—verify it against your own records before processing it, since a fraudulent recoupment request is a real, if less common, variant of the same fake-invoice problem.

These are examples of where several major payers publish their own reimbursement and refund policies, not a universal process—your specific contract controls which steps actually apply to you.

The moment you add a helper

The first time someone other than you touches money—an admin hire, a part-time bookkeeper with check-writing access—is exactly when a real control has to exist, because that's the first moment segregation of duties becomes possible at all. Dual authorization above a modest dollar threshold, a rule that the same person never both initiates and approves a transfer, and a standing habit of you personally reviewing the register rather than only the monthly summary are the basics. Prevention by design covers what to build in before the first hire starts, which is considerably cheaper than discovering a gap after.

Resist the instinct to hand over full financial access on day one just because training someone in stages feels slower. A new hire's access to accounts, checks, and vendor payments can expand gradually as trust is actually earned through a track record, rather than being granted in full because setting it up incrementally felt like an insult to someone you've just decided to trust.

If you find something real

If a review turns up something that looks like real misconduct rather than an honest error—your own or someone else's—the response matters as much as the discovery. For issues that touch federal health program billing, OIG maintains a formal self-disclosure protocol for providers who find conduct implicating fraud laws, with defined requirements for what a submission contains 6Ref 6HHS Office of Inspector General (2026).Health Care Fraud Self-Disclosure Protocol.The formal self-disclosure path for a provider who discovers conduct implicating federal health program fraud laws, as the escalation option beyond a simple internal fix.; using it, where it applies, is a materially different position than staying quiet and hoping a pattern doesn't recur.

Most of what a solo practice's monthly review turns up is a posting error, not misconduct—but treating every real finding as worth a clear-eyed look, rather than explaining it away, is the whole point of building the visibility habit in the first place.

Keep the record of the controls themselves

A reconciliation you did but didn't document is nearly as invisible as one you never did. Save the monthly reconciliation worksheet itself, not just the resulting clean balance—the same retention window that applies to your general business records applies here, generally three years and longer if a return understates income substantially 7Ref 7Internal Revenue Service (2026).Recordkeeping.The retention window for the records behind a business figure, applied to monthly reconciliation worksheets as the documentation of the control itself.. Audit-ready books and theft-resistant books turn out to be nearly the same habit: a running, dated record of what you checked and when, kept as consistently as the bookkeeping it supports.