This article will count 0.25 units (15 minutes) of unverifiable CPD. Remember to log these units under your membership profile.
Between 1 September and 16 October 2026 four people who handled the money for South African small businesses were convicted or sentenced for fraud. The group financial manager of Botselo Mills was convicted on 52 counts over R8.7 million, eighteen months after the same company's financial accountant was sentenced to 15 years for a separate R8 million scheme. A transport company's bookkeeper got ten years for R4.7 million. A Paarl bookkeeper who also acted as the owner's accountant got a further four years for returns designed to wipe out R18 million of SARS debt, after an earlier sentence for taking a client's VAT money. A Gqeberha business and its owner were sentenced for forged VAT claims.
In every case one person controlled money or filings that nobody else looked at, and it took an audit, years later, to find it. Read together, the five cases are a catalogue of the controls an SME did not have, and of what an accountant in practice can sell.
Five frauds, one pattern
The cases differ in size and sector, and the pattern underneath them does not.
Botselo Mills, the financial manager. On 16 October 2026 the former group financial manager was convicted in the Specialised Commercial Crime Court in Mahikeng on 52 counts of fraud. The charges involved more than R8.7 million in unauthorised transactions from the company's account over about five years, paid into bank accounts linked to him. The scheme was found in a 2023 audit, when payments were discovered in the payment system that nobody could account for.
Botselo Mills, the financial accountant. The same company's financial accountant was sentenced in April 2025 to 15 years for a separate scheme. Between January 2017 and July 2022 he created false authorisation forms to release funds to what looked like service providers and paid more than R8 million into six personal bank accounts. He was authorised to transact on the company's banking system.
Blom Vervoer, Eastern Cape. On 29 September 2026 a 58-year-old former bookkeeper was sentenced to ten years for stealing about R4.7 million. She administered the company's cheque and savings accounts, had unrestricted access to its banking, and moved company money to her own account over an extended period. An internal audit found it.
Paarl. On 1 September a man who acted as a company's bookkeeper and as its owner's accountant received a further four years for submitting fraudulent returns designed to eliminate R18 million in SARS debt. Two months earlier he was sentenced to three years on 55 counts of fraud for persuading a client to pay VAT money into his personal account on the promise that he would pay SARS. The court also found that the owner, as the company's representative, remained responsible for the accuracy of what was filed.
Gqeberha. On 16 October a businessman and his company were sentenced for fraud, forgery and contraventions of the Tax Administration Act over false VAT claims. Eight years, wholly suspended, and R1 245 261.58 to be repaid to SARS.
In the three theft cases the person who took the money was also the person who could authorise or release it. The court reports say nothing about who else, if anyone, reviewed those accounts. What they do record is how long each scheme ran, about five years at Botselo in both cases and an extended period at Blom Vervoer, and that each was found by an audit rather than by a routine monthly check. In the two tax cases the returns were false when they were filed, and in Paarl the court held the owner responsible for them. The sector did not matter. A mill and a haulage firm lost money the same way, and the tax cases turned on returns that stood as filed until SARS looked at them.
What all five had in common
Strip away the sector and the amounts and the five cases are the same case. In each of them one person had control over money or filings, and the court record does not show anyone else looking at what that person did with it. The Blom Vervoer bookkeeper administered the bank accounts and had unrestricted access to them. The Botselo financial manager put transactions through the company's account that nobody had authorised, and in a separate scheme at the same company the financial accountant wrote the authorisation forms himself and paid invented service providers. The Paarl bookkeeper prepared and filed the returns, and the owner answered for them in court. The Gqeberha claims were forged by the people filing them.
The second common feature is how long it took. None of these frauds was caught in the month it started. The two Botselo schemes each ran for about five years before an audit found them, and the Blom Vervoer theft ran for an extended period before an internal audit did. An audit is a detective control, and it runs once a year at best. Whatever monthly checks these businesses had in place did not stop the money leaving, and that is the gap a preventive control is built to close.
That is the practice management point. A small business cannot split the handling of money across several people the way a large company can, because it does not have the people. What it can do is bring in someone from outside who sees the bank independently of the bookkeeper and reports to the owner. That person is the accountant in practice. These five cases are the reason to offer that role to every SME client as a defined service, and to be paid for it.
Accounting Weekly has made the ethics case before, in Ethics in accountancy and Navigating the tightrope. This is the operational case. Ethics training did not stop any of these five. A second signature on the bank profile and a sign-off on every return before it was filed would have made each of them far harder to commit and far harder to hide.
Five controls that would have surfaced each fraud
Those two are where the list starts. The five controls below need no auditor, and they are the ones that catch frauds like these within months rather than years. Each is a standing arrangement between your practice and the client, set up once and run every month.
Bank data comes from the bank, not from the bookkeeper. Set up a read-only bank feed or view-only online banking access to your practice for every client. The Blom Vervoer bookkeeper controlled the accounts and the statements. If the person who moves the money also hands you the record of the money, you are compiling their version of events.
Nobody loads and releases a payment alone. Every client above a one-person business needs two people on EFT release, and the practice checks once a quarter that the bank profile still has two. At Botselo one scheme ran on transactions nobody had authorised and the other on authorisation forms the thief wrote himself, and both ran for about five years before an audit found them.
Three-way match every month. Bank feed against the cashbook, supplier statements against the purchase ledger, payroll against the bank. Unaccounted-for payments were what the auditor at Botselo eventually spotted in 2023, five years into the financial manager's scheme. A monthly match finds them in the month they happen.
The client signs off every return before it is filed. The Paarl court held the business owner responsible for the accuracy of returns a bookkeeper had falsified. Send the client the return, the calculation and the SARS statement of account, and file only on written approval, from your own practitioner profile and never from the client's login, for the reasons Accounting Weekly set out in The password that kills your own defence. That protects the client and it protects you against the claim that you filed what you were told to.
No client money through the practice, ever. No trust account, no holding account, no collecting the VAT and paying it over. The client pays SARS from the client's own profile. If a staff member in your practice ever suggests otherwise, treat it as a red flag, because that is exactly how the Paarl scheme started.
If your client's in-house bookkeeper resists any of the five, that is information. Honest bookkeepers want two signatures and a bank feed. It takes the suspicion off them.
Sell it, do not give it away
The five controls are a product. Package them as a monthly controls review, priced separately from the compilation, with a one-page report to the owner each month saying what was matched, what was not, and what needs a decision. The owner of a mill or a haulage firm will pay for that report, because the alternative at Botselo was two schemes, more than R16 million, financial prejudice, and a business the court reports describe as crippled.
Price it on the client's payment volume, not on your hours, and put the first month's findings in front of the owner in person. Owners pay for a report that tells them each month what was matched and what was not, because the alternative, in the Botselo case, was learning from a 2023 audit what had been happening for years.
There is a second line of income in this. Once the control is in place you are the obvious person to run the client's bank profile review, the supplier onboarding check and the annual payroll audit. Each is a fixed-fee engagement and each is work an SME would otherwise never buy.
The last point is about who the bookkeeper was. The court reports do not say whether any of the five held a professional designation, and that silence is the point. An SME that hires an undesignated bookkeeper has nobody to complain to and nobody who can strike that person off. A CIBA member who steals from a client faces a disciplinary committee, a public finding and the loss of the designation, before the criminal court ever sits. When you pitch the controls review, pitch the designation with it. The owner is buying the same thing in both cases, which is someone answerable to a body with the power to end a career.
Where to start
The place to start is the client list you already have. Many SME clients fail one of two tests, whether their bank data reaches you direct from the bank and whether two people are needed to release a payment from their account. Each client who fails one of them is a controls engagement waiting to be offered, and the five cases above are the reason to offer it this month.
Join CIBA and we'll show you how to turn the controls your clients should already have into a service they pay for.
Further reading
Ethics in accountancy: a critical pillar in South Africa's fight against fraud and corruption, on the bookkeeper who defrauded TERS of R11 million and what it cost the profession
Navigating the tightrope: ethical practices and fraud prevention, on whistleblowing channels and fraud prevention in practice
The password that kills your own defence, on why filing from a client's eFiling login leaves you with no record of what you did
Compliance, risk and ethics in medical practice finances, on never letting one person receive, record, reconcile and approve
Trending
