What are the signs someone is hiding theft in my bank reconciliation, and how do I check?

What should I check, step by step?

1. Get the bank statement yourself, from the bank: online banking, a statement emailed to you, or one mailed to your own address. The AICPA's examples of small-business controls start here: the owner receives the statement directly, reviews it monthly and investigates anything odd.

2. Compare the ending balance on the bank's statement with the statement ending balance on the reconciliation report. If they differ, the reconciliation was done against a different statement.
3. Check the reconciliation history is complete: one report per account per month, with no gaps. In QuickBooks Online, undoing a reconciliation permanently deletes its report and attachments and undoes every later reconciliation too, so a missing month needs an explanation.
4. Open Reconcile for each account. If QuickBooks Online says the beginning balance is off, open the Reconcile Discrepancy Report: it lists each reconciled transaction that was later changed, who changed it, what changed and when.
5. Check what that report leaves out. QuickBooks says deleted and voided transactions won't appear on it, so filter the audit log for deletes and voids in the account since the last reconciliation, and filter the register for transactions marked R that are dated after the last completed reconciliation.
6. In Xero, run the Bank Reconciliation report pack for the month. The Statement Exceptions report shows lines created by a user marking a transaction as reconciled, deleted statement lines and potential duplicates. The Bank Statement report shows each line's source: bank feed, manual import or user-created.
7. Read the outstanding items. Deposits in transit should clear within days. Old deposits that never clear, or outstanding checks carried forward month after month, are worth tracing to the bank statement.
8. Look at the cleared checks and payments on the bank's statement: payees on your approved vendor list, check numbers in sequence, signatures that follow your check-signing policy. Compare deposits with your own cash receipts log or point-of-sale totals.
9. Lock it down after review: close the period in Xero (a closed period's transactions can't be deleted or unreconciled), and in QuickBooks Online keep the primary admin role and the closing-date password with the owner, not with whoever reconciles.
10. Keep a record the bookkeeper can't rewrite: seal each deposit and payment to a Rightshold mirror ledger when it happens (the payment type with your own deposit or invoice reference and the amount in cents). At month end, compare the bank's statement with the mirror and with the books.

How does someone hide theft in a small business bank reconciliation?

Reconciling marks transactions as matched to the bank. Once that's done, the reconciled history is the evidence. QuickBooks Online lets a user unreconcile a single transaction by clicking its R status in the register, and lets the primary admin, an in-house accountant user or an accountant in QuickBooks Online Accountant undo a whole reconciliation. Xero lets the administrator role, or a standard user with bank account access, delete a whole bank statement, optionally along with the transactions reconciled to it. Xero says deleted statements can't be restored.

• Each of these has honest uses, such as fixing a duplicate or redoing a messy month. The same tools can remove a theft from view: edit a reconciled payment, delete a statement line, or reconcile to a statement with the problem lines missing.
• The ACFE's 2024 Report to the Nations found check and payment tampering in 11% of asset misappropriation cases, with a median loss of $155,000. Organizations with fewer than 100 employees had a median loss of $141,000 per case.

What do QuickBooks Online and Xero show when reconciled transactions or bank statement lines are changed?

QuickBooks Online's beginning balance should equal last reconciliation's ending balance. If a reconciled transaction is edited, deleted, voided, moved or unreconciled, the beginning balance goes off and QuickBooks won't let the next reconciliation continue until the difference is explained. The Reconcile Discrepancy Report shows who made each change and when.

• The QuickBooks Online audit log can't be turned off, records deleted transactions, and keeps events for two years.
• Xero's Bank Reconciliation report pack includes a Statement Exceptions report listing user-created, deleted and duplicate statement lines, and a Bank Statement report that shows each line's import date and source. Once a period is closed with Reconcile period, its transactions can't be deleted or unreconciled, although account codes can still be edited.

Why does a record kept outside the accounting software help catch reconciliation tampering?

Everything above lives inside an account that an admin controls, and admins can change roles, undo reconciliations and remove lock dates. The bank's own statement is outside that account, and so is a mirror ledger sealed as money moves.

• A Rightshold mirror entry records the amount, your reference, the date you give (occurred_at) and Rightshold's own seal time (sealed_at), and is hash-chained to the entries before it. There is no edit or delete route. A correction is a new adjustment entry. Anyone holding an entry id can check it free, without logging into your books.
• The mirror shows what was sealed and when. It doesn't read your bank, and it can't see a deposit nobody sealed. Its value is the three-way comparison: bank statement, mirror and books should agree, and where they don't is where to look.