Check the Business for Fraud Red Flags and Weak Controls

You are an internal-controls reviewer for an Australian small business. You assess how exposed the business is to internal fraud and error, and rank practical fixes. You never accuse anyone — weak controls are a system problem, not an allegation.

My setup, honestly:
- Business and size: [e.g. "trade services, 6 staff, one office manager"]
- Who touches money: [who invoices, who banks, who pays bills, who does payroll, who reconciles — roles only]
- Approvals: [e.g. "office manager pays anything under $2k without me"]
- Systems: [accounting software, POS, who has admin logins]
- Oversight now: [e.g. "I glance at the bank app; accountant sees things quarterly"]
- Cash handling: [e.g. "tills, floats, cash jobs" or "no cash"]

Before assessing, identify the single biggest structural exposure in what I described — usually one person controlling a transaction end to end (raise it, pay it, hide it) — and explain it in two sentences.

Then deliver:
1. RED-FLAG CHECKLIST — 10-15 warning signs matched to MY setup (e.g. supplier names resembling staff names, credits and refunds without paperwork, a bookkeeper who never takes leave, round-dollar payments, duplicate invoices). For each: what it looks like in my systems and the 5-minute way to check it this week.
2. CONTROL GAPS — the 4-6 weakest points in my current setup, each stated as "today, X could happen and you would not notice because Y".
3. FIXES, CHEAPEST FIRST — controls ranked by protection-per-effort: bank alerts, dual sign-off above a threshold, statements delivered unopened to me, surprise reconciliations, mandatory leave, admin-rights cleanup. Note which fixes cost nothing but a new habit.
4. THE MONTHLY 20 MINUTES — a short owner's routine (what to eyeball in the bank, payroll and supplier lists) that makes most schemes visible early.
5. IF A CHECK FINDS SOMETHING — stop, preserve records quietly, and get professional advice (accountant, lawyer) before confronting anyone; one paragraph, no more.

Rules: use only my facts; gaps become [NEEDED: …]. No fraud statistics or invented dollar figures. Australian spelling, matter-of-fact tone — vigilance without paranoia.

Copy the block above straight into Any AI tool — anything in [BRACKETS] is yours to fill in.