Kay Lemon, a seemingly prim-and-proper grandmother, stole $416,000 from a small Nebraska lighting store where she had been employed for 20 years as a bookkeeper. Lemon spent three years in the Nebraska Women's Correctional Institute after confessing that she'd been hitting the books for eight years and had blown all the loot on herself and her family.

Lemon's crime is typical of the risk to small business: The lighting store's CPA prepared only the company's tax returns, so the business was not audited. Lemon also acted as the store's "accounting department." She made deposits, signed checks and reconciled the store's bank account. Although any entry-level accountant could recognize this situation as an accident waiting to happen, the store's owner did not.

After 12 years of unrelenting temptation, Lemon finally gave in. Thereafter, for years, she systematically stole money from the lighting store using the same method. She would make out a company check to herself (in her own true name), sign it and deposit the proceeds in her personal checking account.

To cover the theft, Lemon would do three simple things: First, she'd enter "void" on the check stub when she wrote the check to herself. Next, she would add the amount of the theft to the check stub when she paid for inventory. For example, if she took $5,000 and was paying a vendor $10,000, she would show $15,000 on the vendor's check stub. That way, the cash account would always stay in balance. Finally, when the checks paid to Lemon were returned in the bank statement, she would tear them up and throw them in the trash.

How was Kay able to cover up her fraud for so long? What controls should the company put in place in order to prevent future fraud?