Cash, credit and payments are  great places to get basic controls in place. Build up what you are auditing, with the most critical areas first and develop the full audit scope over time.

#1 Get the AS-IS Visible 
First look at what is currently done, by whom and get those processes written down - even get your employees to write it down - its a great learning opportunity and will save you consulting time if you have something to work from. (We can also provide templates so your processes can be documented in a standardized way).

#2 Decide the To-Be
Then seek expertise from several sources - your accountants/auditors AND us! For each process there will be multiple auditable areas - some of these will rely on non-system policies (eg. what customers can get the Gold Price List? ) but the decisions made outside any system are often recorded IN your systems - so look at what guidelines or policies employees need to make the right decisions and then lets establish the best method for tracking this adherence to policy. 

Some measures you implement will allow you to stop or prevent fraudulent activity, however many organisations - in particular small organisations rely on few people to do many activities. This is where you will need to implement Detective measures using Alerts/Notifications, Reports and even random audits of transactions.

#3 Publicise Publicise Publicise
Many organisations are keen to track and monitor KPIs and readily report on these at management/board levels - however you need to get your audit measures here also so you can say "hey look, sales are up this month..... AND we know we aren't losing money through the back door too...!"
Then take those measures down to each level in the organisation and share them.

•  Supplier Credits:  20 created by Sarah this month, split by reason code and who approved them. Then for each reason code.... set actions - phone the supplier and talk to them about oversupplying, find out why employees haven't correctly included prices on purchase orders....
•  Stock write offs/ons: by week, location, value and product type. 
•  Bank account changes for suppliers or if you still post cheques, Postal Address Changes.

The more risky transactions are shared, talked about in meetings and monitored, the less likely you are to have issues with employees thinking no one is watching. 

Native Tracking in SAP Business One
​​SAP Business One on its own tracks who, what and when transactions are created or updated, when the system has been accessed and gives you tools like the Alerts and Approval Procedures to track items specific to your business. 

Licensing and Authorizations are your first line of defense, deciding who can do what is one of the critical steps in securing your organisation from fraud attempts. These Preventative measures help endorse who can do what in your organisation.

With SAP Business One we use Approvals and Alerts a lot as detective measures where you need to allow users to complete certain transactions (eg. allow discounting, create credits) but you want to know when and how often they are stepping too close to the mark. With both Approvals and Alerts we can target these to specific scenarios that are relevant to your users and your business - meaning you are are only notified when those conditions occur, as you learn more about their use of the system, the alert limits can be updated as your business changes. 

There are some simple tools all users can use within SAP Business One - whether to track mistakes or if they suspect something is up with the data they are working with.  The Change and Access logs are easy options for users to become familiar with and are normally included in Basic Navigation training. 
The Change Log This is easliy viewed via the System Menu > Tools > Change Log...

Within here you can see a simple summary of who updated the records, using Show Differences you can see what specific fields were updated and their values, then Double-Clicking an entry in the Change Log form opens a Read-Only version of the document as it was, allowing a more familiar way to view any updates.

Under the System Menu > Tools > Access Log... you have visibility of when users last logged in/off, last password changes and unsuccessful logon attempts. Double-Clicking a user allows you to see other connection information, like what add-ons were started, windows user for the session and IP addresses. You can change dates to see information for any day.

Contact Brodie at Business Evolution Group to discuss where you are currently at and let us see how we can help you develop good practice in this area.