Most employers worry about the thief outside the building. Yet, if someone’s stealing from you it’s probably an employee inside it.
Jennifer O’Neal worked as a program specialist for a Georgia nonprofit, CASA of Polk & Haralson Inc., which advocates for abused and neglected children. From 2018 to 2022, prosecutors say she used her access to the organization’s bank accounts to cut payments to herself, disguised as legitimate reimbursements.
The total: $96,700.
The money went to her power bill. Her water and sewage bill. Her cellphone bill. A Netflix subscription. Softball gear. Lingerie. Home theater equipment. A trip to Six Flags.
O’Neal pled guilty this week to theft of federal program funds.
U.S. Attorney Theodore S. Hertzberg said O’Neal violated CASA’s “core values” by stealing money meant for the “most vulnerable members of our community.” That’s the moral lesson of the story. Here’s the operational one: nobody was watching, and for four years, that was enough.
You don’t need a U.S. Attorney or a forensic accountant to stop this. You need controls that don’t rely on trust alone.
1. Split the job in two. The person who requests or initiates a payment should never be the same person who approves or issues it. O’Neal could do both. That’s not a personality flaw. That’s a design flaw, and it’s on you to fix it.
2. Demand real backup for every reimbursement. No receipt, no verifiable business purpose, no payment. Period. Trusted employees get the same scrutiny as everyone else, because trust is exactly what gets exploited.
3. Audit on a schedule, not a hunch. Someone with no stake in the transactions should be reviewing the books regularly, whether or not anything looks wrong. Fraud isn’t caught by intuition. It’s caught by someone actually checking.
4. Force people to take time off. The employee who never takes a vacation and guards their process isn’t dedicated. They’re unsupervised. Make someone else cover the role while they’re out, and let a fresh set of eyes look at what’s been happening.
5. Reconcile every payee against a real vendor list. A personal name or a residential address where a vendor should be isn’t a clerical error. It’s a red flag with a bow on it.
6. Require dual signatures above a set dollar threshold. And have a person outside accounts payable actually read the bank statements every month. Not skim them, actually read them.
None of this is complicated. None of it’s expensive. It just requires believing, before the fact, that someone you trust might not deserve it.
Trust is not a control. Verification is.
