Most losses inside a business are not dramatic. They are small, repeated, and committed by somebody who was trusted — which is what makes hiring and access the places where the risk is actually managed.
None of what follows is about suspicion. It is about not relying on a person's honesty as your only control.
Check before, not after
Verify identity against the document. Confirm qualifications where the role depends on them. Telephone at least two references and ask whether they would employ the person again — the pause before the answer tells you as much as the answer.
Where a role handles money, stock or customer data, a criminal record check is reasonable and common. It requires the person's consent, so ask for it as part of the process rather than doing it quietly, and say what the check is for.
Verifying what somebody told you is not an insult. Any candidate who has been employed properly before will expect it.
Design the job so trust is not the only control
The person who receives stock should not be the only person who counts it. The person who takes payments should not be the only person who reconciles them. Where separation genuinely is not possible in a small team, the owner performs the second half — daily.
This protects honest staff as much as it protects the business. An employee who handles cash alone with no reconciliation is the first suspect whenever anything is short, whether or not they did anything.
Manage access as a live list
Keys, codes, system logins, bank access, the vehicle. Who has what, written down, reviewed occasionally, and revoked the week somebody leaves.
Dormant access is the most common finding in any review of a small business — a former employee whose login still works, an alarm code nobody has changed in three years.
Contractors too
Cleaners, IT support, maintenance, temporary staff through an agency. They are frequently on the premises outside hours with fewer checks than an employee would face.
Ask the agency what vetting they do, and keep a record of who is actually attending rather than just which company was appointed.
If something does go wrong
Follow a proper process. Dismissing somebody for suspected theft without an investigation and a hearing turns a loss into a loss plus a CCMA award, however clear it seems.
Gather the evidence, take advice, and do it properly. The temptation to act immediately is strongest in exactly the situation where doing so costs the most.
General guidance, not legal advice. Background checks require consent and carry obligations under privacy law, and dismissal requires a fair process; take proper advice.