Are you taking fraud seriously? How to protect your business from fraud risks

By Diccon Thornely, Partner

When people think about fraud, they often picture large organisations making headlines for the wrong reasons. The reality is that fraud can affect businesses of every size.

In fact, 43% of UK businesses experienced a cyber security breach or attack in the last year, according to the UK Government. Many of these incidents started with something as simple as a phishing email.

For small to medium-sized enterprises (SMEs), even one incident can disrupt operations, damage confidence and create significant financial pressure.

The good news is that many fraud risks can be reduced with practical controls, strong governance and a culture that encourages colleagues to speak up.

Fraud continues to evolve as criminals adapt their methods and take advantage of technology and changing business practices. Cyber criminals are increasingly using convincing emails, impersonation techniques, and social engineering tactics to influence people into making fraudulent payments or sharing sensitive information.

Government research found that phishing was involved in 88% of businesses that experienced a cyber breach, making it by far the most common technique used by criminals. A convincing email requesting an urgent payment or asking a colleague to update supplier bank details can be all it takes to compromise a business.

Fraud risk is not limited to external threats. Businesses should also consider internal risks, including deliberate misconduct, misuse of company resources, or errors caused by unclear processes.

As businesses grow, responsibilities change, new systems are introduced and financial activity increases. Controls that worked well when a business was smaller may no longer provide the same level of protection as operations become more complex.

Regularly reviewing fraud risks and financial controls is an important way to protect what you’ve built and support future growth.

A common misconception is that fraudsters only target large corporations. SMEs can be easier targets because they may have fewer formal controls, smaller finance teams, and limited resources dedicated to risk management.

Government figures estimate that around 43,000 UK businesses became victims of cyber-enabled fraud in a single year. Criminals know that many SMEs rely on trusted relationships and streamlined processes, making them attractive targets despite their size.

Fraud often succeeds because of weaknesses in everyday processes, such as:

• One person controlling the full payment process
• Supplier bank detail changes being accepted without independent verification
• Weak password management or limited cyber security awareness
• Infrequent reviews of payroll, expenses or financial transactions
• Limited oversight of online banking activity

These vulnerabilities are often created unintentionally. As businesses grow, informal processes can remain in place even when stronger controls and oversight are needed.

The financial impact of fraud is often only the beginning. Criminals stole £1.28 billion through fraud in the UK during 2025, demonstrating the scale of the threat facing businesses and individuals alike.

Businesses may also experience operational and reputational consequences, including:

• Disruption to normal activities
• Loss of customer and supplier confidence
• Damage to reputation
• Legal or regulatory costs
• Increased insurance premiums
• Reduced colleague morale
• Leadership time spent investigating and resolving issues

For many SMEs, the indirect costs of fraud can be greater than the initial financial loss. This makes prevention a key priority for business leaders.

Effective fraud prevention does not always require complex systems. Strong governance, clear responsibilities, and consistent processes can significantly reduce risk.

Where possible, no single individual should be responsible for a complete financial transaction from start to finish.

Separating responsibilities for setting up suppliers, approving invoices and authorising payments reduces opportunities for fraud and increases accountability.

Payment processes should include appropriate checks, particularly when changes are made to supplier information.

Requests to update bank details should always be independently verified using trusted contact information, rather than relying solely on email communication. Additional approval requirements for significant payments provide further protection.

Technology plays an important role in preventing fraud, but colleagues remain one of the strongest lines of defence.

Regular cyber security awareness training helps colleagues recognise phishing attempts, suspicious payment requests and other common fraud techniques. A well-informed team can stop potential threats from becoming costly incidents.

Effective oversight is essential. Regular reviews of financial reports, unusual transactions, journal entries and key performance information can help identify concerns early.

Leadership involvement ensures controls remain effective and encourages a proactive approach to risk management.

Controls and procedures matter, but culture is just as important.

Businesses that encourage transparency, accountability, and ethical behaviour create an environment where fraud is harder to hide.

Colleagues should understand:

• What constitutes fraud
• Why internal controls are important
• How concerns can be reported
• That suspected misconduct will be taken seriously
• Encouraging colleagues to raise concerns can help identify issues before they develop into more serious problems.

Responsibility for preventing and detecting fraud ultimately rests with business leaders. An external audit is not designed to identify every instance of fraud.

However, the audit process can provide valuable insight into a business’s controls and processes. Auditors assess financial reporting risks, consider fraud risks that could affect business performance and reporting, and identify areas where controls may need to be strengthened.

Auditors also bring independence and experience from working with businesses across different sectors. This helps them identify common weaknesses, challenge existing processes, and provide practical recommendations to improve governance and decision-making.

For many businesses, audit provides more than assurance. It can be an opportunity to strengthen controls, improve resilience and create confidence for future growth.

As businesses grow, their risks change. Controls that worked well when a business was smaller may no longer provide appropriate oversight as teams expand, systems develop, and responsibilities become more complex.

Regularly reviewing internal controls ensures governance keeps pace with business growth and continues to provide effective protection.

Fraud prevention should not be viewed as a one-off exercise. It should be part of a business’s ongoing approach to risk management and good governance.

• Review who can approve payments and whether responsibilities are appropriately separated
• Verify supplier bank detail changes independently
• Strengthen password and cyber security practices
• Review unusual transactions regularly
• Make sure colleagues know how to report concerns

At Sumer, we champion SMEs and help businesses and communities prosper. We believe great advice should be practical, approachable, and focused on what matters most to business leaders.

Whether you want to strengthen governance, improve reporting, manage fraud risk, or prepare for future growth, our audit team can provide independent insight and practical support to help you make confident decisions.

As your business champion, we’re here to help you build resilience, unlock opportunities, and protect what you’ve worked hard to achieve.

Fraud is a risk that every business should take seriously, regardless of size or sector. Strong governance, effective internal controls and an ethical culture can significantly reduce exposure to fraud and help businesses respond effectively if issues arise.

If you’d like a fresh perspective on your fraud risks, controls, or governance, our audit team would be happy to help. Get in touch with your local business champion.