Expense Fraud in Small Business: Controls That Actually Catch It

The controls that actually catch expense problems in a small business are detective, not preventive: duplicate matching across every intake channel, a monthly read of the register rather than of individual claims, and a random sample of the small stuff nobody would otherwise look at. Preventive controls - thresholds, card limits, approval steps - are worth having, but they were never going to catch the three things that actually happen.

It is worth being precise about scale here, because the topic invites overstatement. Most small Canadian businesses will never encounter deliberate, organised expense fraud. What they will encounter, routinely, is the same three patterns: an expense that reaches the books twice, kilometres that are higher than the trip supports, and personal spend sitting in a business category. Some of that is deliberate. A great deal of it is not. The useful thing about the controls below is that they do not require you to know which is which, and they work either way.

The 60-second version

• Three patterns cover most of it: duplicate submission, inflated mileage, and personal spend miscoded as business.
• Duplicates usually come from two intake channels, not dishonesty. Card plus reimbursement, or photo plus forwarded email.
• Trust is the absence of a control, not a control. Small teams need detection because they cannot fully separate duties.
• Personal spend in a corporation carries double exposure. Denied deduction under s. 18(1)(a), plus possible shareholder benefit under s. 15(1) [1][2].
• Sample the small claims randomly. Unpredictability, not coverage, is what makes a sample work.
• Review patterns monthly, claims individually only above a threshold. The pattern view is where the findings are.

How do duplicate expense claims happen, and how do you catch them?

Duplicates are the most common finding in any small business expense review, and most of them are honest. The classic mechanism is two intake paths for the same purchase: an employee pays with the company card, the charge lands on the statement, and the employee also submits the receipt for reimbursement. Both get recorded. Nobody lied, and the company paid twice.

The second mechanism is multiple submission formats. A receipt photographed at the till and the same vendor's confirmation email forwarded a day later produce two records that do not look alike to a human reading them a week apart.

Deliberate duplication looks exactly the same in the data, which is convenient: one control covers both. Match across every channel on the combination of vendor, amount, and date, with tolerance for near-matches, because a genuine duplicate often differs slightly - a tip added later, a date recorded as the transaction date in one record and the posting date in the other.

Doing this by eye does not scale past a few dozen claims a month. MapleExpense scores incoming receipts against existing ones on vendor, amount, and date, groups the likely duplicates, and puts them in a review queue with the reasons for the match shown, so a person decides whether to merge or dismiss rather than hunting for candidates. The decision stays human; the search does not need to be.

The preventive half of this is worth one sentence in the policy: a purchase paid on a company card is never also submitted as a reimbursement claim. Most duplicate pairs disappear once that rule exists and people know it. The broader question of what cards do to your control structure is covered in corporate cards and spend controls.

How do you detect inflated mileage claims?

Mileage is the softest number in any expense system because it is the only one with no receipt behind it. The claimant asserts a distance and the company pays a rate. There is nothing to verify against unless you create something.

CRA expects a logbook recording, for each business trip, the date, destination, purpose, and kilometres driven [5]. That record exists for tax reasons, but it also happens to be exactly what you need to check a claim, because it names the endpoints. Three checks follow from it.

Route plausibility. Measure the stated origin and destination and compare to the claim. Small differences mean nothing - people detour, park badly, take the long way around construction. A claim that is consistently well above the route distance is a conversation.

Trend by person. Compare each claimant's monthly kilometres against their own history. Fraud and error both tend to appear as a step change rather than a drift, and a step change with no corresponding change in territory or workload is the single most informative signal in the whole area.

Reconciliation to the vehicle. Total claimed business kilometres for the year against odometer readings, taken at the start and end and available from service records. This one is slow and you should do it annually, not monthly, but it is the only check that bounds the total rather than testing individual trips.

The related trap is the commute. Travel between home and a regular place of work is personal, not business, and it is the most frequently miscoded distance in small companies - usually in good faith. MapleExpense records trips with route, purpose, and an explicit business-versus-personal flag on each one, which at minimum forces the question to be answered at the time rather than assumed at year end. Our guide to mileage logs and CRA vehicle records sets out what the logbook has to contain.

What happens when personal spend is coded as business?

This is the pattern with real tax teeth, and it is worth separating the honest version from the deliberate one because the consequences differ.

The honest version is a mixed purchase - groceries with a client gift in the middle of the receipt, a hardware run that covered both a job and a home repair - coded whole because splitting it was tedious. The deliberate version is a personal purchase submitted as business.

Either way, the deduction fails. Section 18(1)(a) permits a deduction only for outlays made for the purpose of earning income [1], and any input tax credit claimed on the GST/HST has to be given back, since s. 169(4) conditions the credit on prescribed documentation for a genuine business acquisition [6].

In a corporation, the second layer is the one people do not see coming. If the person who benefited is a shareholder, the amount can be included in their personal income as a shareholder benefit under s. 15(1) [2] - so the same dollar is denied as a deduction to the company and taxed in the individual's hands. Where the beneficiary is an employee rather than a shareholder, the amount is generally a taxable benefit reportable under the rules in Guide T4130 instead [7]. And where a return contains a false statement made knowingly or in circumstances amounting to gross negligence, s. 163(2) provides a penalty on top [3]. Genuinely deceptive claims can also engage the general fraud offence in s. 380 of the Criminal Code [8], though that is a threshold most workplace expense issues never approach.

The practical handling for the honest version is a split at the receipt, not an argument at year end: record the business portion, put the personal portion where it belongs, and if the owner is involved, route it through the shareholder loan account deliberately - see shareholder loan accounts and personal credit card purchases. The cleanest structural fix is the one covered in keeping business and personal accounts separate, which removes most mixed purchases before they exist.

Why is a small, trusted team the hard case?

Because the standard control - separation of duties - depends on having enough people to separate. Requesting, approving, and paying should not all be held by one person, and in a company of four they often are.

Two things follow. First, trust is not a control; it is what you have when there is no control. That is not a statement about anyone's character. It is a statement about what happens when an honest person makes a mistake and nothing in the process is positioned to find it.

Second, where you cannot prevent, you detect. That is the trade a small business makes, and it is a good one: detective controls are cheaper, they do not slow anyone down, and they apply evenly to everyone including the owner, which removes the awkwardness of a control that looks aimed at a particular person. An audit trail showing who entered, changed, and approved each record - which MapleExpense keeps as a matter of course - is what turns a monthly review from an investigation into a ten-minute read.

What should a monthly review actually look at?

Not a stack of claims. A stack of claims produces the illusion of review and finds nothing, because every individual claim looks fine. The patterns are the findings.

Look at four things each month. The duplicate queue, cleared to zero. Every claim above your materiality threshold, opened properly - receipt read, purpose read. A small random sample of claims below it, chosen unpredictably; the number matters far less than the fact that no claim size is exempt from being looked at. And totals by person and by category against the prior few months, where step changes show up.

Add one annual item: the vehicle reconciliation, and a full read of the owner's own claims by whoever does your books. Owner claims are both the largest exposure and the least reviewed, and that combination is not a coincidence.

Finally, write down what the review found, even when the answer is nothing. A review with no record is indistinguishable from a review that did not happen - both to you in six months, and to anyone else who asks later. The habit of documenting the check is most of what separates a business that can explain its numbers from one that can only assert them, which is the same discipline described in preparing for a small business audit and in a month-end close checklist.

Frequently asked questions

What is the most common form of expense fraud in a small business?

Duplicate submission is the most common, and most of it is not deliberate. The same expense reaches the books twice because it was paid on a company card and also claimed on a reimbursement form, or because a receipt was submitted as a photo and again as a forwarded email. Deliberate duplication looks identical in the data, which is why the control is the same for both: match on vendor, amount, and date across all intake channels rather than reviewing claims one at a time.

How do you detect inflated mileage claims?

Compare claimed kilometres against an independent reference rather than against the claimant's own record. Three checks catch most of it: measure the stated route between the two addresses and compare it to the claim, compare a person's claimed kilometres month over month for unexplained step changes, and reconcile total claimed distance against odometer readings or vehicle service records. CRA expects a logbook recording date, destination, purpose, and kilometres for each business trip, so the underlying detail needed to run these checks should already exist.

What are the tax consequences of personal expenses claimed as business expenses?

A personal expense claimed as a business expense is not deductible, because section 18(1)(a) of the Income Tax Act allows a deduction only for outlays made for the purpose of earning income. Any GST/HST claimed as an input tax credit on it has to be repaid. In a corporation, if the person who benefited is a shareholder, the amount can also be included in their personal income as a shareholder benefit under section 15(1). Where a return contains a false statement made knowingly or in circumstances amounting to gross negligence, a penalty under section 163(2) can apply on top.

What is the difference between a preventive control and a detective control?

A preventive control stops something before it happens: a pre-approval threshold, a card limit, a blocked merchant category, a rule that a claim cannot be submitted without an itemised receipt attached. A detective control finds it afterward: duplicate matching, a monthly review of the expense register, a reconciliation of the card statement against submitted claims. Small businesses usually over-invest in preventive controls that slow everyone down and under-invest in detective controls, which cost less and catch the patterns prevention was never going to see.

How many expense claims should you review each month?

Review every claim above your materiality threshold, plus a small random sample of everything below it. The point of the random sample is not coverage, it is unpredictability: a claimant who knows small claims are never looked at will behave differently from one who knows any claim might be. A handful of randomly chosen small claims each month is enough to establish that, and the review should be a real one - receipt opened, purpose read - or it teaches the opposite lesson.

How do you control expenses when the team is small and everyone is trusted?

Accept that trust is not a control and build the ones that do not imply suspicion. Separate the three actions around a dollar so that requesting, approving, and paying are not all held by one person. Make the expense register visible to more than one person. Run a monthly review that looks at patterns rather than individual claims, and apply it to everyone including the owner. These controls protect honest staff as much as they deter dishonest ones, because they mean a mistake gets found and corrected rather than discovered years later and misread.

How long should records supporting expense claims be kept?

Under section 230 of the Income Tax Act, books and records with supporting documents must generally be kept for six years from the end of the last tax year to which they relate, with longer periods in some situations such as unfiled returns or an outstanding objection or appeal. That period applies to the receipts, the approval trail, and the logbooks behind a claim, not only to the ledger. Electronic images are acceptable provided they remain readable and accessible.

Sources cited in this article

1. Income Tax Act, s. 18(1)(a)
   Limits deductions to outlays made for the purpose of gaining or producing income from the business.
   https://laws-lois.justice.gc.ca/eng/acts/i-3.3/section-18.html
2. Income Tax Act, s. 15(1)
   Includes in a shareholder's income the value of a benefit conferred on them by the corporation.
   https://laws-lois.justice.gc.ca/eng/acts/i-3.3/section-15.html
3. Income Tax Act, s. 163(2)
   Penalty for false statements or omissions made knowingly or in circumstances amounting to gross negligence.
   https://laws-lois.justice.gc.ca/eng/acts/i-3.3/section-163.html
4. Income Tax Act, s. 230
   Requirement to keep books, records, and supporting documents, and the retention period.
   https://laws-lois.justice.gc.ca/eng/acts/i-3.3/section-230.html
5. CRA, Motor vehicle records
   What a business vehicle logbook must record for each trip, and the full-year and simplified logbook options.
   https://www.canada.ca/en/revenue-agency/services/tax/businesses/topics/sole-proprietorships-partnerships/business-expenses/motor-vehicle-expenses/motor-vehicle-records.html
6. Excise Tax Act, s. 169(4)
   Requires prescribed supporting information to be obtained before an input tax credit is claimed.
   https://laws-lois.justice.gc.ca/eng/acts/e-15/section-169.html
7. CRA Guide T4130, Employers' Guide - Taxable Benefits and Allowances
   When an amount paid to or on behalf of an employee becomes a taxable benefit that must be reported.
   https://www.canada.ca/en/revenue-agency/services/forms-publications/publications/t4130.html
8. Criminal Code, s. 380
   The general fraud offence, relevant where a claim involves deliberate deceit causing financial loss.
   https://laws-lois.justice.gc.ca/eng/acts/c-46/section-380.html

All sources verified 2026-09-23. Spotted a link that has moved? Email [email protected] and we will correct it.