You cannot watch everyone — but you can stop one person signing everything
Internal fraud is a quiet tax on Nigerian SMEs. You do not need a compliance department — you need proof, second eyes, and a rule that WhatsApp is not an audit trail.
- Split submit, approve, and pay — even with six people.
- Ghost payroll and duplicate expenses hide when WhatsApp is the system of record.
- Use approvals and audit log today; integrity alerts are coming.
Femi inherited a drinks distribution route in Ikeja when his uncle retired. Within six months he noticed something odd: payroll cost was up, headcount was not, and the warehouse manager’s brother had “joined” on paper but never collected goods. He is not alone. Reports from business groups put employee-related losses in Nigerian MSMEs in the trillions of naira yearly — much of it never reported because the founder would rather fix the hole quietly than admit they were blind.
Trust your people. Do not trust a process where one person can pay themselves and erase the evidence.
The schemes that actually show up at 15 staff
Hollywood fraud is wire transfers to Cayman Islands. Lagos SME fraud is mundane: someone still on payroll after they left, a receipt photographed twice, a vendor invoice inflated with a kickback, PAYE deducted on payslips but never sent to the state, sales logged low while the personal POS collects the difference. Cash-heavy businesses — retail, hospitality, logistics — get hit hardest because the owner is not at every till.
- Ghost or zombie names on the pay run
- Fake or duplicate expense reimbursements
- Unauthorized discounts on customer invoices
- Statutory deductions shown on payslip, not remitted
- Petty cash that never reconciles to receipts
Segregation of duties on a tiny team
Big companies separate “initiate,” “approve,” and “record.” You might have six people total. That does not mean one cousin runs everything. Compensating controls mean: the person who submits an expense is not the only approver; the person who drafts payroll is not the only one who can mark it paid; the founder skim-reads bank reconciliation even if an admin does the matching.
Pending approvals in one queue — the owner sees what is stuck.
What Business Buddy gives you today
The product is not a CCTV system. It is structure plus memory.
- Pay run approval chains — multiple admins must sign before payout
- Invoice approval chains before large sends
- Employee expenses submitted in the portal, approved in Money — rejected claims stay on record with a reason
- Leave and attendance approvals tied to people records
- Audit log and workspace activity — who changed what
- Team roles: payroll read/write, finance export, module scopes so the clerk cannot silently edit salaries
- Statutory payment tracking — did PAYE and pension actually get marked paid after the run
- Bank reconciliation — unmatched lines visible instead of buried in CSV
- Payslip portal — staff can see if they were paid; harder to hide ghost names from the people who talk
A policy you can write in ten minutes
- Above your naira threshold, no transfer without a named approver in the app
- No leave or expense paid unless submitted through the portal
- New vendor bank details verified once, saved on profile — no ad-hoc account numbers
- Payroll approved by someone other than whoever entered the lines, when possible
- Monthly: owner opens statutory payments screen and bank statement — do totals match
What we are building next
Alerts for payroll rising without headcount, duplicate receipts, employees paid without attendance, and PAYE deducted but not remitted — these are on the roadmap as integrity checks, not science fiction. Automatic fraud scoring is not the goal. Early, explainable warnings are.
Until then, use what already ships: approvals, audit trail, paid marks on statutory lines, and the rule that if it is not in Business Buddy, it did not happen for finance purposes.
Run payroll with approvals and a trail — Multi-step pay run approval · expense queue · activity log