Stopping staff from diverting the firm's fee income
How an accounting firm stops its own people diverting client fee payments, and spots gaps hidden behind write-offs, credit notes and missing receipts.
By Achekam · · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
It is an uncomfortable subject for a firm that spends its days testing other organisations' controls. But accounting practices are not immune to fraud by their own people, and fee income is the obvious target. A trusted bookkeeper asks a small client to pay "into this account this month". A manager bills a client less than the work was worth and collects the difference privately. A credit note quietly cancels an invoice the client has in fact paid, to someone.
These schemes are usually small at first and rarely dramatic. They succeed because one person handles the client, the invoice, the payment and the follow-up, and nobody else looks closely. The fix is not suspicion of everyone; it is a handful of controls that make diversion hard to do and quick to notice.
Occupational fraud, and why controls matter
The ACFE, the professional body for fraud examiners, defines occupational fraud as fraud committed by a person against the organisation for which they work. Its 2026 Report to the Nations states that the presence of anti-fraud controls is associated with lower fraud losses and quicker detection. The ACFE publishes the report, with its findings on how frauds are committed and caught, on its Report to the Nations page.
For a firm, the lesson is that controls are not about catching a particular person. They change the odds for everyone, and they protect honest staff from suspicion when something does go wrong.
Separate receiving from recording
AccountingTools advises that employees who receive cash or cheques from customers should not be the ones who record those transactions in the accounting system. It also states that no single person should control authorisation, record keeping and custody of assets for the same transaction.
In a firm, apply that to fee income:
| Task | Who should not also do it |
|---|---|
| Agreeing fees and approving the invoice | The person who records the receipt |
| Receiving client payments or giving out bank details | The person who issues credit notes or write-offs |
| Recording receipts against invoices | The person who sends statements to clients |
| Writing off time or debts | The person who did the work or manages the client |
Small firms cannot always split every task between different people. Where one person must do two of them, add a review by a partner of what that person did, every month, as a substitute.
Warning signs in behaviour
The ACFE's 2026 report lists the behavioural red flags associated with the highest median losses. They are excessive pressure from within the organisation, past legal problems, being unusually close with a vendor or customer, refusal to take vacations, and a "wheeler-dealer" attitude.
None of these proves anything about an individual, and most people showing them are honest. But two are worth building into firm policy because they are easy to act on. A person who never takes leave means nobody else ever sees their clients' affairs, so require leave and have someone else handle the work while they are away. A person unusually close to particular clients may be the only one those clients ever deal with, so rotate contact or add a second point of contact.
Controls Achekam gives the firm
Several of the controls a firm needs sit in the way its billing works in Achekam.
- One receivables ledger. A firm's client invoices, receipts, credit notes and statements of account are kept in a receivables ledger on the server. Nobody keeps a private list of what is owed.
- A second issuer and approved time. Client billing controls can require a second issuer above a set amount, and approval of time before it is billed.
- Approved write-downs. In the WIP Register a partner, manager or administrator can write unbilled time up, down or off with a reason, and bill it into a client invoice so the same hours cannot be billed twice. Write-downs above the firm's threshold, 10% by default, and every write-off wait for approval by another partner. Billing a client less and collecting the rest privately needs a write-down someone else has to approve.
- Payments recorded from evidence. A firm can e-mail an invoice with a pay link through a gateway it has configured with its own keys, such as PayFast, Ozow, Peach Payments, Stripe, Paystack, Flutterwave, M-Pesa or Pesapal, or by EFT. Payment is recorded only from the gateway's verified notification, a status query, or a person's capture. Clients who pay through the link pay the firm, not an individual.
Reviewing the record and the statements
Two further checks catch what slips past the controls.
The record governance log. Record Governance keeps a log of changes to governed records showing who did what, when and with what result, which can be filtered and checked for an unbroken chain. It needs the AUDIT_LOG_VIEW permission, and it covers records under record governance rather than every screen. A partner who filters it for credit notes, write-offs and payments captured by hand each month sees the actions most often used to cover a diversion.
Statements to clients. A statement of account can be downloaded as a PDF or e-mailed from the receivables ledger. Statements sent regularly to every client, by someone other than the person who manages the client, are one of the strongest detection controls a firm has. A client who paid an employee will query a statement that still shows the invoice as owed.
A monthly check a partner can run
Once a month, a partner who does not handle the clients concerned should:
- Scan the month's credit notes, and ask about any that cancel an invoice in full.
- Review WIP write-offs and large write-downs, and the reasons given.
- Look at payments captured by a person rather than by a gateway notification, and match a sample to bank statements.
- Compare clients' unpaid balances with how long each has been outstanding, and ask why any regular payer has stopped.
- Confirm statements went to all clients, and follow up any client queries personally.
In a small firm this is short work, and it is exactly the review a fraud depends on nobody doing.
Put the controls in place
Agree who receives, who records and who reviews, switch on the billing controls the firm needs, and diarise the monthly check. For the billing settings themselves, see client billing controls, and for reading the change log, the record governance log.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
