Trust But Verify

The picture most of us carry of a practice thief — some shifty new hire skimming the till — has it backward. In case after case, the person stealing is the most trusted employee in the building: the office manager who’s been there twelve years, knows the billing system better than you do, and never misses a day. That trust isn’t a side detail. It’s the thing that makes theft possible. 

The numbers earn a harder look. The Association of Certified Fraud Examiners’ 2024 Report to the Nations puts the typical loss at 5% of annual revenue, with a median of $145,000 per case — enough to erase a small O&P practice’s margin for the year. And audits aren’t what catch it. Tips exposed 43% of the frauds in that study, more than three times any other method, and more than half of all cases traced back to internal controls that were missing or overridden by someone with the authority to do it. 

The good news: embezzlement almost always announces itself long before a forensic accountant shows up. The signs are behavioral as often as financial, and any owner willing to look with fresh eyes can catch them. Here are nine worth your attention. 

The Nine

Treat these as symptoms, not verdicts. One means little. A cluster means it’s time to ask questions. 

1. The money person who never takes a real vacation. It reads as devotion — the biller who hasn’t taken a full week off in years, answers email from the beach, insists on handling deposits personally. That same profile shows up in case after case, because uninterrupted control is what keeps a scheme hidden. The moment someone else opens the mail and reconciles the bank, the numbers stop matching the story. The fix is almost insultingly simple: a mandatory, consecutive one-week vacation for anyone who touches money, with their duties fully covered by someone else while they’re out. 

2. Copays and petty cash that never quite add up. Cash is where most schemes start, and your front desk is the door. A $30 copay pocketed and left to drift into bad debt, a $20 petty-cash shortfall nobody blinks at — trivial once, real money across a full schedule for months. Each day, compare scheduled patients against payments actually posted and deposited, and have someone who doesn’t collect the money do the reconciling. Your missing-encounter report surfaces visits with no payment attached; if it’s never been run, start there. 

3. Write-offs and adjustments that keep climbing. To make a stolen payment vanish, you first have to make the balance vanish — and the adjustment column is the easiest place to bury it. A stolen copay recast as bad debt, a friend’s balance quietly zeroed, a fabricated contractual allowance blended in with the real ones. Adjustments should track payer contracts, not personalities. Trend total adjustments as a share of gross charges monthly, run the report by user and not just by payer, and require sign-off above a set dollar threshold. One more thing for O&P: when a write-off scheme runs through Medicare or Medicaid dollars, it stops being just an HR matter and can become a False Claims Act problem — that’s a question for compliance counsel, not just a talk with HR. 

4. Vendors you don’t recognize and invoices you never see. We live on vendors — feet, knees, liners, raw materials, central fab. The setup is mundane: the same trusted person creates a vendor, approves its invoices, and releases the payment. The vendor might be fictional, real-but-padded, or a shell that shares an address with someone on staff. Review the full vendor list at least once a year and question anything unfamiliar. Watch for round-dollar invoices, sequential invoice numbers from a single vendor, and payees that look like a real supplier with one word changed. Keep check-signing — or at least dual approval above a threshold — with an owner, not the person who cuts the checks. 

5. Records that go missing right when you need them. A reconciliation that can’t happen because the deposit slip is gone, a vendor file with no invoice, a bank statement nobody’s opened in months — that’s not sloppiness, it’s a moat. Concealment needs a gap between what happened and what got recorded. Don’t let one person be the sole keeper of source documents. Route bank statements straight to an owner or outside accountant, unopened. Any request to see the paper behind a transaction should be answerable in a day, not a week. 

6. A lifestyle that suddenly outruns the paycheck. Living beyond one’s means tops the ACFE’s behavioral red-flag list in every edition — a new luxury car, a big renovation, designer purchases on a salary that hasn’t moved. Sudden financial distress runs a close second, because desperation supplies the motive that opportunity then rewards. None of this is proof, and treating it as proof is how a practice ends up with a wrongful-termination claim. It’s an invitation to verify quietly — pull the statements, rerun the reconciliations, see whether the numbers hold — not to accuse. 

7. A resume with several short, unexplained stops. Caught embezzlers are rarely prosecuted, which has a predictable effect: many just move from practice to practice, each exit vaguely explained by a reference who’ll only confirm dates. A billing or office-manager candidate with a string of short tenures at similar practices deserves more than a glance. Background and credit checks are standard advice for a reason, but the phone call that goes past confirming dates — “would you rehire this person?” — often tells you more than the paperwork. With no criminal record to surface, that reference check is frequently the only thing that catches the pattern before the hire instead of after. 

8. One person touches the money from start to finish. This is less a warning sign than the condition that makes all the others possible. When the same person posts payments, makes deposits, sets up vendors, runs payroll, and reconciles the bank, there’s no independent check on any of it, and every odd number comes with a ready explanation nobody else has the context to challenge. MGMA’s internal-controls guidance states the principle plainly: no single person should be able to create, approve, process, and conceal a transaction. Perfect separation is unrealistic in a small shop; breaking up the riskiest combinations isn’t. Whoever collects payments shouldn’t also post adjustments and reconcile the bank. Whoever creates vendors shouldn’t also approve invoices and release payment. An owner reviewing unopened bank statements and the payroll register each month closes most of the rest. 

9. Defensiveness the moment anyone looks at the books. Ask a routine question about a reconciliation and watch. Honest employees welcome it — the review protects them too. Someone hiding a scheme stalls, produces partial records, buries the answer in jargon, or takes offense that you’d ask. The same instinct shows up as resistance to new software, hostility toward an outside accountant, and refusal to cross-train. If the defensiveness has company — if it’s sitting next to other flags on this list — move quietly. Request statements directly from the bank, bring in an independent accountant, and talk to an employment attorney before you confront anyone. Someone who senses discovery can destroy evidence in an afternoon, and a botched accusation can cost a practice nearly as much as the theft. 

The Part Nobody Likes 

Trust is the whole point of a small practice — it’s why patients come back and why your team covers for each other. Controls aren’t the opposite of trust. They’re what let you keep extending it without lying awake wondering. The best owners I know don’t reconcile because they’re suspicious. They reconcile so they never have to become suspicious. 

Trust your people. Reconcile the deposit anyway.