Frequently Asked Questions
How would I know whether my small business really needs a formal risk and controls structure?
- Three questions settle it:
- 1. Could one trusted employee move money or override a decision for months, unnoticed?
- 2. If no one has independently assessed the company's risk in the last 12 months, what problems could jeopardize your business or cost you money later?
- 3. Would a lender or acquirer call the controls normal — or a red flag?
- Only 14% of businesses with fewer than 100 employees have a formal fraud risk assessment. Yet, when occupational fraud strikes a small organization, the median loss is $126,000 (ACFE). Hesitating on any of these means you need one.
Is it true that small businesses have less risk compared to larger ones, so are less likely to need formal controls structures?
No — the exact opposite is true. Fraud eats a larger share of annual revenue at small businesses than at large ones, even when the dollar loss per incident is smaller. Furthermore, due to advances in technology and globalization, smaller company size does not reduce exposure to today's critical risks.
Where would I begin if my business does not already have any risk and controls framework in place?
Start with a risk assessment that covers all aspects of your business that considers: what could go wrong, how would you know, who can stop it, and what should be continued or increased. After that a plan specific and right-sized can be presented for building a framework specific to your business without committing to services you do not want or need.
I think I know the risks in my business pretty well, why would I need additional review and analysis of my business?
Knowing your operations isn't the same as independently verifying them — no one audits their own blind spot from inside it. Worth naming directly: when fraud hits a small business, losses tied to owners and executives run seven times higher than losses tied to employees. Proximity isn't protection.
My small business already outsources internal controls work, so what more would I need for risk and controls coverage?
The firm doing your testing may be very competent, but also has a built-in conflict — a commercial incentive to extend scope or soften findings. In addition, there needs to be a thorough and independent check of that firm’s work. A Fractional CAE does not do testing; it reviews the testing, subjects it to expert challenge, and reports the result directly to you or your board. Outsourced testing without independent review is testing without real assurance, and the current approach typically does not cover the entire organization, still leaving it vulnerable to risk.
Where will my business find the extra capacity to deal with the additional administration (and cost) related to management of risks and controls?
This is precisely what a fractional engagement scoped to what you actually need solves for. It is not a new department, is not full-time, does not lead to more work than is necessary because there is no sales pressure. A full-time Chief Audit Executive costs about $220,000 before benefits, which is many multiples more than any fractional engagement, while still providing critical oversight and sophisticated guidance that truly helps the business. A comparatively small fractional investment could save your business that 5% of annual revenue typically lost to fraud when good controls are absent.
What is the most common misconception about small businesses?
That small companies could never afford consistent access to the best business experts who would be invested in their business - that business governance like this could not be scaled down for small companies.
Risk doesn't discriminate by size — 43% of cyberattacks target small businesses (Accenture), and fraud eats a larger share of revenue at small companies than large ones (ACFE). The median small business has a cash buffer of just 27 days, and every buffer day lost measurably raises the odds of closing within the year (JPMorgan Chase Institute).
How can FractionalCAE support small businesses with boards?
The founder of FractionalCAE has broad board education and experience across multiple organizations, including a decade on Audit Committees. FractionalCAE can help enhance board structure and operation to align them best practices for the board and business - serving as a bridge connecting critical points. This is especially critical ahead of a raise, sale, or other liquidity event, and helps close diligence gaps before they become findings.