If you own a small company where you personally know and interact with everyone who works for you, it can be hard to fathom that one of those people would ever steal from you. But the fact is, embezzlement happens all the time, even at small, family-owned businesses.

Indeed, according to a 2017 study on white-collar crime by the U.S. insurance company Hiscox, the majority of embezzlement (55%) occurs at companies with fewer than 100 employees. And because these companies are small, embezzlement can impact these organizations much more severely than a similar crime would a larger company with deeper pockets. The study found that the median loss for a single incident of embezzlement for small businesses is nearly $290,000—which could prove fatal for some companies.

Given the potential damage embezzlement can cause, we’ve highlighted some of the key factors associated with small-business embezzlement from the Hiscox study, along with offering suggestions for preventing such crimes and what you should do if you suspect someone is stealing from you.

Like most other crimes, there aren’t any characteristics specific to all embezzlers. But the Hiscox study did find a few interesting commonalities among the most frequent perpetrators:

• Embezzlement takes place at all levels, but executives and those in management are the most frequent culprits.
• Women are slightly more likely to embezzle (51%) than their male counterparts.
• Embezzlers are typically in their mid- to late-40s.
• Embezzlement can occur in any department, but most incidents (37%) occur in finance or accounting.
• Embezzlers are most likely to be individuals who mostly work alone.

For those with smarts, particularly in bookkeeping and accounting, there are numerous ways to skim money. The most common method is also one of the easiest—theft of funds. Making up 34% of all cases, this typically involves the transfer of their employer’s cash or deposits into a bank account they control.

The second most popular method is check fraud, whereby an embezzler forges or alter’s checks, which accounts for 22% of cases. About 14% of incidents involve vendor invoicing and false billing. Here, the perpetrators alter or forge invoices from real vendors, or they make up fake vendor companies, invoice their employers, and route the payments to their own accounts.

Credit card fraud accounts for about 10% of cases and is most often committed by managers, who make personal purchases on company cards or issue themselves unauthorized cards. Other, less common embezzlement methods include property/merchandise theft, payroll fraud, and fraudulent loans taken out in the company’s name.

Notably, embezzlement rarely involves a single big score. Most incidents entail fairly small amounts of money being stolen over a period of several years. In fact, more than a quarter of embezzlement cases lasted for five years or longer.

To protect your company, Hiscox suggests implementing a system of checks and balances, such as having more than one staffer involved in every financial transaction. Since most embezzlers fly solo, this alone can significantly reduce your risk.

Additionally, business owners—or at least someone outside of the normal bookkeeper—should regularly review the company’s bank statements, credit card invoices, canceled checks, and other financial records. At the very least, you should do a monthly profit-and-loss review, looking for variances and checking into even small discrepancies. That’s something we often participate in with business owners who are part of our Creative Business Lawyer Strategy Plans®. Email us for more details.

Obviously, pre-employment background checks are also a good idea, especially for anyone involved with the business’ finances. But don’t let a clear background lull you into thinking they aren’t capable of stealing.

One of the biggest red flags to watch for are employees who seem to live well above their means, with lifestyles and purchases that aren’t commensurate with their salaries. Many times, the culprits can’t help but flaunt their riches, so keep an eye on employees who enjoy showing off wealth that doesn’t match their paychecks.

And though it won’t prevent embezzlement, company owners should always purchase adequate business insurance to mitigate the consequences of employee theft. Even if you catch the culprit red-handed, it’s rare for more than a fraction of the stolen funds to be recovered, and restitution—even when paid—will do your business little good if the missing funds cause your business to go bankrupt.

If you suspect embezzlement, you should immediately document everything you know about the situation, and discreetly review financial, payroll, and personnel records for supporting evidence. Only share the investigation with one or two trusted individuals, and always on a strict need-to-know basis. Make a list of potential witnesses, but don’t discuss anything outside of your small investigative team until the final stages. 

However, be very careful not to jump to conclusions and accuse someone without proof—this could irreparably  tarnish the employee’s reputation, cause serious staff conflict, and even expose the company to liability.

If you do uncover theft, contact us to discuss your legal options and also inform your insurance carrier. Even though pressing charges may not get your money back, it’s often necessary in order to send a signal to other employees that such behavior will not be tolerated—but we can always help you make that decision.

Whenever you launch a business, you should consult with us to discuss the safeguards, systems, and insurance to put in place to prevent embezzlement. And if you suspect an incident has already taken place, contact us as soon as possible for advice on how to mitigate the damage and handle the investigation in a manner that will protect your company from liability and potential blowback.

We offer a complete spectrum of legal services for businesses and can help you make the wisest choices on how to deal with your business throughout life and in the event of your death. We also offer a LIFT Start-Up Session™ or a LIFT Audit for an ongoing business, which includes a review of all the legal, financial, and tax systems you need for your business. Call us today to schedule. Or, schedule online.

Like everyone else, you’ve probably been getting a ton of emails and online notices announcing that companies are updating their privacy policies and/or website tracking tools. So, what is the GDPR?

Although businesses do this from time to time as part of routine updates, practically all of the latest notices are aimed at complying with a new European Union (EU) law known as the General Data Privacy Regulation (GDPR).

Some of you probably don’t even know what GDPR is, and for those of you who do, I’m betting only a fraction of you have made serious efforts to comply with the new law.

The good news is—you’re not alone.

Surveys have shown that up to 90% of U.S. business owners are currently not in compliance with GDPR, which went into effect on Friday, May 25th. But just because only a few people are following the law doesn’t mean it’s something you should ignore.

With the maximum fines for non-compliance as high as 4% of your annual revenue or $24.6 million (whichever is higher), doing nothing could potentially devastate your business. But before you go into panic mode, realize that a lot of the hype surrounding the law has been overblown, particularly for small US-based companies.

The GDPR’s vague language, conflicting media reports, and fear-mongering from newly minted “GDPR consultants” have all fanned the flames of anxiety. Fortunately, we’ve thoroughly researched the GDPR, and we’re going to highlight our findings here to clarify what the new law is, who it applies to, and what—if anything—you should do to comply.

The first thing you should do is stop stressing! First of all, the EU regulatory bodies charged with enforcement have made it clear that excessive fines and other penalties will be a last resort, not the norm.

That said, if your company does business within the EU—even just collecting names and addresses—then you should become familiar with GDPR and possibly take some basic actions to ensure your company is in reasonable compliance.

In a nutshell, GDPR is aimed at enhancing EU citizens’ data protection and privacy rights. While the law is primarily designed to protect people’s personal data found online, it impacts all of the ways businesses collect and store customer data.

• can easily request access to their personal data
• can easily update their own personal information to keep it accurate
• can easily request deletion of their personal data
• can easily request that their data be delivered to themselves or a third party
• can easily object to profiling or automated decision-making that might impact them

Given its vast scope, GDPR is being touted as the world’s most sweeping privacy law. At the same time, because the law just recently went into effect, it remains to be seen how it will actually work when it’s put into practice and enforced.

Whether a small US business needs to comply is based on whether or not the company stores and processes personal data from EU citizens. What’s considered personal data covers a wide range of identifiers, including:

• Names, addresses, phone numbers, and ID numbers
• Web tracking ("cookies" and other tools that record who visits your website)
• Social media posts
• Health and genetic data
• Race or ethnicity data

If you collect and use this kind of information from EU residents, your company is technically required to comply with GDPR. If you don’t store such data on EU residents and don’t plan to in the future, the law doesn’t apply to your business.

At the very least, you may want to perform a basic data audit to see how much personal information your company is storing from EU residents. If EU residents don’t make up a significant portion of your customer base, you might simply choose to delete that data and stop doing business in the EU. Or you may decide to take the risk of non-compliance.

If you decide that you want to keep working with and/or marketing to customers in the EU, the level of your company’s compliance will need to be determined on an individual basis. One simple way this can be done is to complete a risk/reward analysis that looks at the costs of compliance, the risks your business faces from non-compliance, and the potential rewards compliance might offer. If you’d like our help with such a risk/reward analysis, call us to help you weigh the pros and cons for your particular business and discuss your compliance options.

Ultimately, GDPR is not intended to stop companies from marketing or processing personal data for aboveboard business reasons—it’s aimed at stopping companies from collecting and using individual data for shady purposes, a la Cambridge Analytica.

In the end, GDPR may turn out to be much ado about nothing, or it could transform the way countries, including our own, handle the privacy rights of their citizens—only time will tell. Until then, you should call us as your Creative Business Lawyer® to set up an appointment to discuss the law’s potential impact on your business. Armed with that knowledge, if and when the GDPR does impact your business, you won’t be caught unaware.

We offer a complete spectrum of legal services for businesses and can help you make the wisest choices on how to deal with your business throughout life and in the event of your death. We also offer a LIFT Start-Up Session™ or a LIFT Audit for an ongoing business, which includes a review of all the legal, financial, and tax systems you need for your business. Schedule online today.

Civil disputes between two parties can be settled in litigation (i.e., court) or through arbitration. The two processes are quite different, so thoroughly understanding them both is essential when facing a business conflict. 

In litigation, two parties resolve their conflict in court with the assistance of a judge and/or jury. Litigation is adversarial by nature. It can also be costly, involving attorney and court fees. It can also be time-consuming, as the parties must wait for the court to hear the case before a decision can be made. It is important to note as well that litigation is public and held in a courtroom. Because judges and juries are assigned by the court the parties do not control who hears the case. 

The parties gather and submit evidence in a process called discovery which can take several months. The good news is in litigation the parties typically have a chance to appeal the ruling if necessary.

Taking on business debt can help small businesses meet expenses and finance growth. The key to making it work is knowing specifically what you will use the debt for, how it will generate a return on your debt investment and tracking, tracking, tracking.

If you need support with finding capital for your business and tracking the use of that capital, contact us -- we can help.

And, if you have not done a great job with this in the past and your debt gets too hard to manage, you may be faced with some difficult decisions.

With proper guidance, however, you can minimize the financial consequences and maximize the opportunity of taking on and managing your small business debt.