Red Flags in One-Person Bookkeeping
Collections at a single-location practice are $1.9 million per year. The office manager has worked there 12 years, opens the mail, posts payments, prepares deposits, reconciles the bank statement, and approves adjustments in the practice management system. The dentist reviews a monthly profit-and-loss statement prepared by the office manager but does not see the bank statements or the daily deposit detail. In the last four months, gross production is up 6% while collections are down 3%. The number of accounts written off as 'uncollectible' has doubled, several patient refunds were issued to a name that matches the office manager's sister-in-law, and one deposit was made three days late. The office manager says the delays are due to a new billing-software update and that the refunds were for overpayments. Staff have been told not to discuss finances with the dentist.
1. What immediate steps do you take to protect the practice without accusing anyone or destroying evidence?
Read the worked answer
Treat this as a control failure first, not a proven theft. Preserve evidence: daily deposit slips, bank statements, canceled checks, practice-management audit logs, adjustment reports, refund checks, emails, and the software update records. Do not delete or alter anything. Restrict access to bank statements and adjustment permissions, and require dual approval for refunds and write-offs. If access cannot be controlled while the review proceeds, consider administrative leave with pay, on advice of counsel.
Notify the dentist, CPA, and employment counsel. Check crime or fidelity insurance and any employee bond. Review all refunds over a set threshold and confirm each against the patient ledger and bank record. Limit information to those who need it to avoid defamation and gossip. Do not confront the office manager alone or in front of staff. Give her an opportunity to explain later, with counsel or HR present, after the records are secured.
2. What internal controls should replace the current system?
Read the worked answer
Separate incompatible duties. The person who opens the mail should not post payments; the person who prepares the deposit should not reconcile the bank statement; and the office manager should not be the sole approver of adjustments or refunds. The dentist should review bank statements online and sign or approve deposits, with dual signatures above a set amount. Use pre-numbered receipts, daily reconciliation of the deposit to the day sheet, and secure deposit transport.
Require documentation and a second approval for write-offs, refunds, and professional courtesy adjustments. Review user permissions in the practice-management system. Add mandatory vacation rotation, surprise cash counts, and a monthly random sample of adjustments and refunds. Have an outside accountant or consultant perform a periodic review. These controls protect employees as well as the practice, because they remove temptation and make innocent errors visible.
3. How should the investigation and communication proceed once the records are reviewed?
Read the worked answer
Use a documented, consistent process. Compare deposits to the practice-management day sheets, trace refunds to patient accounts and bank records, and review audit logs for adjustments and deleted payments. Interview the office manager with counsel or HR, give her the opportunity to explain, and document the interview. Avoid promises of confidentiality that the practice cannot keep.
If the review confirms misappropriation, decide with counsel among termination, restitution, an insurance claim, and referral to law enforcement. Do not make that decision in the heat of the moment. Communicate to staff in general terms: new controls, approval steps, and reporting channels, without identifying the employee or the evidence. Notify the insurer and follow state reporting requirements. Finally, examine why the dentist was excluded from financial oversight, because the control culture allowed the situation to continue.