One small slip. What could possibly go wrong?

A couple of weeks ago, my partner accidentally used our business debit card for two personal purchases.

We have a very simple practice in our business. The business account is used only for business purposes. We do not use the business card for personal purchases.

Most of our business payments are made through internet banking.

I noticed the two personal transactions and realised that my partner had used the wrong card. They were for small amounts, and we simply needed to record them differently in our accounts.

It did not seem significant at the time.

Then, on Friday night, I checked the business bank account. I was reviewing how much we had spent on business expenses during the month.

The account balance was lower than I expected.

Because this account does not have hundreds of transactions, I generally know what is happening. I looked further and found two substantial card transactions made on the Gold Coast the previous day.

We were in Brisbane. The transactions were not ours.

We contacted the bank the following morning and advised that we had not made the transactions. The physical card had not been lost and the PIN had never been shared. The bank cancelled the card and commenced an investigation.

We do not yet know how the card was compromised or how the transactions were authorised. We also do not know whether the two small purchases made earlier had anything to do with what followed. The timing makes us wonder, but timing alone does not establish the cause.

We will know more when the bank completes its investigation.

However, the experience has made me think about systems and controls.

Our first control was simple. Do not use the business card unless it is needed for a business expense.

That process had worked for years. Then, on one occasion, we deviated from it.

We cannot yet say that using the card caused what happened next. But it reminded us that one departure from an established process can create an exposure we had not considered.

Because we rarely used the card, we had not investigated whether transaction alerts could be set up. We had not considered whether the card could remain locked and be unlocked only when needed.

We assumed that keeping the card secure and not using it would be enough.

We also relied, without really thinking about it, on the bank’s systems to identify unusual activity. Two substantial transactions were made using a card that had barely been used, but we received no alert or request to confirm them.

The control that detected the problem was my knowledge of the account and my regular review of it.

When something goes wrong, there may be several systems and processes involved. There are our own controls, the bank’s controls, the payment system and the merchant’s processes. If one control does not prevent the problem, another should detect it or limit the consequences.

But we cannot hand over complete responsibility for what happens in our business to an external party.

We need to understand what controls are available to us and decide which ones we need. We also need several layers of control because no single process can protect us from every risk.

The lesson goes well beyond bank accounts.

What are the important areas of your business that need regular checking?

Which risks are you assuming someone else is monitoring?

What alerts or limits could help you identify a problem earlier?

And which of your long-standing processes have not been reviewed simply because nothing has gone wrong before?

A process that has worked for years can still contain a weakness. Sometimes it takes one small slip to expose it.

© 2024–2026 Towards Growth. All rights reserved.

Towards Growth is a strategic business advisory and mentoring practice.

The ideas, insights and client stories we share come from our own work and practical experience, with AI used for editorial support.

The Revenue-to-Value Model™ is a proprietary framework of Towards Growth.