The Employee You Trust Most Is the One You Check Least
Think about your business for a second. Who has the keys to the shop at Taman Desa? Who knows the admin password for your Maybank2E account? Who processes your supplier invoices while you chase sales? For most SME owners, that person is a long-time employee, a relative, or someone you promoted because they’ve been loyal for years.
Now here’s the uncomfortable question: if that person decided to do something wrong, would your checks catch them?
Malaysian police just answered a similar question for Malaysia Airlines — and the answer shook the aviation industry. A 39-year-old MAS pilot was arrested in Jakarta on July 28 with more than 26 kilograms of ecstasy tablets and methamphetamine in his luggage. Last week, Bukit Aman’s Narcotics Crime Investigation Department (NCID) revealed something more troubling: after interrogating the pilot for three days, investigators now know exactly how he bypassed security checks at KLIA. A pilot — someone who passes through airport security dozens of times a month — slipped through because everyone assumed he was above suspicion.
TL;DR: Your most trusted insider can bypass your controls, simply because you stopped looking. Police cracked this case by interrogating systematically and tracing how the bypass happened, not by assuming the pilot was guilty or innocent upfront. You can apply the same logic to your SME: audit how work actually happens, check the blind spots, and separate duties so no single person holds unchecked power.
“The team also learned how the suspect bypassed checks at KLIA and about the syndicate’s financial flows at home and abroad.” — Datuk Hussein Omar Khan, NCID director, via Malay Mail
What This Means
Airport security isn’t one big gate. It’s a chain of checks: X-ray machines, passport verification, boarding pass validation, spot checks. Each layer works independently. But here’s the flaw — the system was designed to stop strangers. A pilot in uniform with a familiar face wasn’t treated as a risk, because the system had a mental shortcut: pilot equals safe.
That shortcut is exactly what the pilot exploited. Police learned during interrogation that the bypass wasn’t some sophisticated hacker trick. It was likely simpler: understanding the gaps between systems, knowing which queue to choose, appearing confident, and relying on the fact that nobody questions a person in authority.
Your SME has the same shortcuts baked in. The cashier who never takes a day off. The operations manager who insists on handling every bank transfer personally. The sales director who “just handles” the big client relationship alone. These are your business’s equivalent of the pilot’s uniform — and in the ACFE’s 2024 Report to the Nations, a staggering number of fraud cases are committed by trusted insiders acting alone.
How This Applies to Malaysian SMEs
Here’s the reality check: fraud and compliance failures don’t happen because you hired a bad person. They happen because you built a system that quietly allows a good person to become a bad actor. For Malaysian SMEs, this usually shows up in three places.
First, financial control is often concentrated in one person. In many smaller companies — especially those with 10 to 30 staff — the owner hands bookkeeping, payment approvals, and bank account access to one trusted finance person. That’s efficient. It’s also a single point of failure. The ACFE’s research shows fraud schemes typically run a median of 12 months before detection, and most are caught by tip-offs, not audits. In Malaysia, where many SMEs don’t conduct regular internal audits at all, that window can stretch much longer.
Second, operations run on habit, not documentation. The KLIA case is a reminder that the pilot didn’t disable security cameras — he worked around the gaps between them. SMEs have the same gap problem. Your stock-taking process might be fine on paper, but what happens when the supervisor who signs deliveries is also friends with the lorry driver? What happens when the same person who records sales also reconciles collections at the end of the day? If you can’t explain the full chain of how money and goods move through your business — documented, not just “known by Ah Meng” — you already have a bypass route.
Third, the investigation itself is the lesson. Police didn’t just arrest the pilot and move on. They interrogated him for two days, extended it to three, and used his cooperation to map syndicate networks and financial flows both in Malaysia and abroad. For your business, when an employee misconduct surfaces, don’t just fire them quietly. Ask the hard questions: How did this happen? What control failed? What process allowed it? That’s how you turn an incident into a system upgrade.
| Where Blind Spots Hide | What “Everyone Assumes” | What You Should Verify |
|---|---|---|
| Cash handling | “She’s been here 10 years, she’d never steal.” | Surprise cash counts; two people sign off deposits. |
| Supplier payments | “He checks every invoice carefully.” | Randomly call suppliers to confirm invoices are real. |
| Banking & passwords | “Only the manager has access.” | Check login history; separate approval and execution. |
| Stock & inventory | “The lorry driver is honest.” | Cross-check dispatch notes against deliveries; rotate drivers. |
| Leaves & holidays | “If he takes leave, nothing works.” | Mandatory leave periods expose anomalies in records. |
Practical Takeaways: A Simple DIY Audit
You don’t need a forensic accountant or a compliance consultant to start. Set aside one afternoon and walk through these five things:
- Map your “one-person zones.” List every process where one person can wave something through without a second signature — payments, stock write-offs, client discounts, payroll changes. Those are your KLIA checkpoints.
- Take a real holiday. When a key staff member goes on leave, does their work stop? If yes, you’ve found a control risk. Nobody is that irreplaceable — and fraud schemes are often discovered when the perpetrator takes a break and someone else steps in.
- Ask “how would someone cheat this?” For each core process, ask yourself and one honest staff member how they’d bypass it. The answer will shock you — and it’s your next control to fix.
- Surprise audits beat scheduled checks. A scheduled stock count can be prepared for. A random one cannot. Call it a “process review” if you want to keep it low-key.
- Log everything that matters. If you’re still using manual records, digitize. Customer relationship software, accounting software, and even simple shared spreadsheets with edit history can show you who did what, when. That audit trail is your three-day interrogation — it tells you the method, even before you talk to anyone.
Trust is not a control. It’s a starting point. The pilot was trusted every time he walked through KLIA — and that’s exactly why the checks missed him.
The Bigger Picture
What makes this case significant isn’t the drugs or the arrest. It’s the institutional response. Police didn’t react by saying, “tighten security at KLIA.” They went deeper: they wanted to know how the bypass happened, so the system could be redesigned. That’s the same shift every Malaysian SME needs to make.
Aviation security has spent decades moving from “trust based on position” to “verify based on data.” Biometric gates, random screening, and behavioral detection all exist because the industry learned that credentials — a pilot’s uniform, a badge, a title — can be clean while the person behind them isn’t. Your business is moving in that direction too, whether you realise it or not. Automation tools now handle approvals, track changes, and flag anomalies without you having to confront a long-serving employee with an accusation. These aren’t big-company luxuries; they’re standard features in accounting software and project management platforms that Malaysian SMEs already use.
The long-term lesson is simpler than you think: build your business so that no single person — including you — can silently bypass your own rules. That’s not about suspicion. It’s about fairness, accountability, and making sure that when something goes wrong, you can actually find out how it happened. The pilot’s case took a three-day interrogation to uncover. Your case shouldn’t require an arrest to discover. A few small checks today will save you from asking much harder questions later.
So, where’s your blind spot? Take a look today — before something forces you to.
Ready to Streamline Your Operations?
Your business should run itself. AutoRunBiz deploys AI agents to automate your daily operations — WhatsApp orders, invoicing, customer follow-ups, and accounting. Book a free 15-min ops audit to see where automation fits your business →