When One Person Controls Too Much, Your Business Is Exposed

You may trust the person handling your business payments. In a small company, that is often necessary. One director approves purchases, one administrator prepares transfers, and one bookkeeper keeps the records. The arrangement feels efficient because everyone is busy and the team is small.

But convenience can quietly become a serious control weakness. If one person can create a payment, approve it, move funds and edit the records without another person checking the transaction, your business may not know what happened until money, documents or customer trust have already disappeared.

A recent Malaysian court case brings this risk into focus. A preacher and former chairman of an NGO claimed trial to 34 criminal breach of trust charges involving more than RM13.8 million, as well as 17 money laundering charges involving RM1.55 million. The allegations relate to transactions between February 2023 and March 2026, and the accused pleaded not guilty. You can read the reported details in Malay Mail’s report.

TL;DR

Small businesses should not rely on trust alone when managing company funds. Separate payment preparation, approval and reconciliation, then keep a clear digital audit trail.

You do not need a large finance department to improve controls. You need defined roles, approval limits, regular reviews and records that are difficult to alter unnoticed.

What This Means

Criminal breach of trust generally concerns property entrusted to someone being dishonestly misused. In a business setting, this could involve company funds, customer deposits, project money, petty cash or assets placed under an employee’s responsibility. The court case reported by Malay Mail involves alleged CBT charges under Section 409 of the Penal Code and separate money laundering charges under Section 4(1)(b) of the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001. The potential penalties described in the report include imprisonment, whipping and fines for the CBT charges, while the AMLA provision carries imprisonment of up to 15 years and a fine based on the amount involved or RM5 million, whichever is higher. These are legal provisions and alleged offences; the accused have claimed trial and the case remains before the court. The statutory details are reported here.

The business lesson is not that every mistake is criminal. A delayed receipt, duplicated payment or weak filing system may be an administrative failure rather than deliberate wrongdoing. The lesson is that poor controls make it difficult to distinguish an honest error from intentional misuse, and they make investigations slower and more disruptive.

Good financial control means creating a process where no single person has complete control over a transaction. The person who requests a payment should not be the only person who approves it. The person who makes the bank transfer should not be the only person who checks the bank statement. The person who maintains the accounting records should not be able to silently rewrite the evidence.

Trust is valuable, but a process that checks everyone protects both the business and the people you trust.

How This Applies to Malaysian SMEs

Imagine you run a trading company with eight employees in Shah Alam. Your operations executive receives supplier invoices, prepares online banking payments and sends you a WhatsApp message asking for approval. If you approve without seeing the original invoice, purchase order and delivery confirmation, you are approving a message rather than a transaction. A stronger process links each payment to supporting documents and records who reviewed it.

For a construction or renovation business, the exposure may come from project deposits, subcontractor payments and progress claims. A site supervisor might confirm that work is complete, while an administrator prepares the payment. You should ensure the approval is based on a documented work confirmation, agreed quotation and payment milestone. If one employee can confirm the work and create the payment without review, an inflated claim or payment to an unapproved account may remain hidden.

Retailers and service businesses face a different pattern. A café, workshop, tuition centre or clinic may receive frequent smaller payments through cash, card terminals, online transfers and e-wallets. A daily sales figure may look reasonable, but without a reconciliation between the point-of-sale system, bank deposits and actual cash, repeated small discrepancies can accumulate. Assign one person to close the day, another to review exceptions, and keep explanations for refunds, voided sales and discounts.

NGOs, associations and businesses handling donations or client funds need especially clear separation between restricted funds and ordinary operating funds. Even if your company is not a charity, you may hold customer deposits for events, renovation materials or advance bookings. Record the purpose of each amount and use it only according to the agreed terms. A separate ledger or bank account can make this easier to monitor.

Many Malaysian SME owners also use family members or long-serving employees in finance roles. Familiarity can make conversations uncomfortable, but controls should be presented as standard procedure rather than suspicion. Requiring two approvals for selected payments protects the owner, the employee and the company. It also gives you better evidence when an auditor, bank, investor or business partner asks how funds are managed.

What Weak Controls Look Like

Risk area	Warning sign	Practical control
Supplier payments	Bank account changes arrive through informal messages	Verify changes using a known telephone number and record the confirmation
Online banking	One user can create and approve every transfer	Use separate maker and approver access where your bank supports it
Petty cash	Receipts are missing or reconstructed later	Set a fixed float, require receipts and reconcile on a schedule
Sales collection	Cash, terminal and accounting totals are not compared	Perform daily or scheduled reconciliation and investigate variances
Records	Spreadsheets are overwritten without history	Use controlled files with access permissions, version history and backups

The table is a control framework rather than a legal checklist. Your accountant, company secretary or lawyer can advise on requirements specific to your entity, industry and transactions.

Practical Takeaways

• Map your money flow: List how sales are collected, who prepares payments, who approves them and who reconciles the bank account.
• Separate duties: Aim for different people to request, approve, execute and review important transactions.
• Set approval limits: For example, routine purchases may have one approval while larger or unusual payments require two directors. Choose limits suitable for your business.
• Verify bank changes: Confirm new supplier details independently, especially when the request is urgent or sent from an unfamiliar account.
• Require source documents: Match invoices with purchase orders, delivery notes, contracts or service confirmations.
• Review exceptions: Check refunds, voids, duplicate invoices, round-number transfers and payments made outside normal hours.
• Reconcile regularly: Compare bank statements, accounting records, payment gateway reports and cash collections on a defined schedule.
• Limit access: Give employees only the system permissions needed for their roles and remove access when they leave.
• Keep an audit trail: Do not rely only on verbal approval or disappearing chat messages. Store the request, supporting documents, decision and payment reference.
• Take leave seriously: Rotate responsibilities or arrange an independent review when the same person has handled finance for a long period without interruption.

A Simple Seven-Day Review

1. Write down every bank account, payment platform and cash location used by the business.
2. List every person who can view, prepare, approve or release payments.
3. Identify transactions that can happen without a second person’s review.
4. Choose the three highest-risk gaps to fix first.
5. Turn verbal approvals into written approvals with attached documents.
6. Schedule a monthly management review of unusual transactions and unresolved differences.
7. Document the process so a replacement employee can follow it without depending on one person.

The Bigger Picture

Financial control is becoming a trust issue, not just an accounting issue. Customers, suppliers, employees and business partners want confidence that your company handles funds responsibly. A clean approval trail can help you answer questions quickly, reduce confusion and show that decisions were made properly.

Digital tools can support this work by recording permissions, timestamps, document versions and approval histories. However, software does not replace judgement. If everyone shares one login, approves everything automatically or ignores exceptions, a digital system can simply make weak processes faster.

The long-term goal is a business that does not depend on one person’s memory, honesty or availability. When responsibilities are documented and transactions are visible, you can take holidays with less worry, onboard staff more easily and spot irregularities earlier.

The reported case is still an allegation before the court, and the accused have claimed trial. For you as an SME owner, the appropriate response is not panic or suspicion toward your staff. It is to build reasonable controls before a problem occurs. Start with payment approvals, bank-account verification and regular reconciliation. Those three actions can give you a clearer view of where your business funds go and create a healthier standard of accountability across the company.

Ready to Streamline Your Operations?

Your business should run itself. AutoRunBiz deploys AI agents to automate your daily operations — WhatsApp orders, invoicing, customer follow-ups, and accounting. Book a free 15-min ops audit to see where automation fits your business →