Almost every case of theft in a martial arts school is committed by someone the owner trusted, and almost every one of them was made possible by the same three structural gaps. This is not an article about dishonest employees. It is an article about a set of controls that cost nothing, take about two hours to install, and remove the opportunity entirely — which protects your staff as much as it protects you.
Why this is a design problem, not a hiring problem
School owners tend to think about financial controls as a question of judgement: hire good people, and you will not need them. That instinct is understandable and it is exactly backwards.
Controls exist because cash handling without a second pair of eyes puts an otherwise honest person in a position where a bad month, a sick child or a gambling problem meets an unlocked drawer and no record. The control is not an accusation. It is the thing that makes it possible for you to never have to wonder, and for your front desk manager to never be suspected.
Say that out loud when you install them. “This protects you as much as me” is true, and staff who understand it stop reading the change as distrust.
The three gaps
| Gap | What it looks like in practice | What it enables |
|---|---|---|
| One person owns a transaction end to end | The same staff member enrolls the student, takes the payment, enters it in the software and reconciles the day | An enrollment that never reaches the system, with the cash retained |
| No independent record of what should have come in | The billing system is the only source of truth, and the person handling money can edit it | Deleted or discounted records that leave no trace |
| The owner never looks at the raw feed | Owner reviews a summary report prepared by the person being reported on | Anything, indefinitely |
The third gap is the serious one. A summary produced by the person handling the money is not a control, it is a courtesy. The owner needs to see at least one unfiltered feed — the bank statement, the merchant processor’s own deposit report — that no employee can edit.
The controls, in order of how much they buy you
1. Separate the person who takes money from the person who records it
This is the single highest-value control and in most small schools it feels impossible, because there are only two or three people. It is usually achievable anyway with a smaller split: the person who takes the payment does not perform the end-of-day reconciliation, and the person who reconciles does not have permission to delete or void records.
In a genuinely one-person school, the split is between you and the calendar: reconcile yesterday’s takings today, against the processor’s deposit report rather than your own notes.
2. Remove delete and void permissions from everyone who handles cash
Most school management platforms distinguish between voiding a transaction and adjusting one. Voids should require an owner login. Every platform worth using logs who did what; almost no owner has ever looked at that log. Look at it quarterly and staff will know it is looked at, which is most of the deterrent value.
3. Reconcile three numbers, not one
Each arrow is a place a discrepancy can appear, and each tells you something different. Enrollments without payments is usually a paperwork lag. Payments without deposits is a processor timing issue or something worse. Deposits without recorded payments means cash is entering the business outside the system, which is a different problem but still a problem.
4. Own the bank and processor logins yourself
Not shared. Not “the manager has it for convenience.” The owner holds the credentials to the bank account, the merchant processor and the billing platform’s administrator account. Staff get their own named logins at the permission level their job requires. Shared logins destroy every audit trail simultaneously and are the reason many suspected cases can never be resolved either way — which is its own injustice to an innocent employee.
5. Cash gets a receipt book with numbered duplicates
Card and ACH payments leave an independent trail by default. Cash does not. If your school accepts cash at all — for pro shop items, testing fees, seminar tickets — a numbered duplicate receipt book costs almost nothing and creates the missing record. Missing receipt numbers are then visible without anyone having to investigate anything.
6. Owner opens the mail and the bank statement
Both literally. The statement should arrive somewhere the owner sees it first. This is a nineteenth-century control and it still works, because it is the one step that cannot be routed around by someone inside the system.
7. Somebody outside the school looks once a year
A bookkeeper or accountant with no other role in the business, reviewing a sample of transactions end to end. Not a full audit — a sample. The point is not to catch anything; it is that the possibility of an outside sample exists.
The pro shop and the testing fee
In school after school, the two places that fall outside the billing system entirely are retail and testing fees. Both are frequently cash, both are often handled by whoever is at the desk, and neither generates an expectation of what should have been collected.
The fix for retail is inventory counts: units in, units sold, units on the shelf. The fix for testing is a roster — the list of students testing is written before the event by the instructor, and the fees expected are the roster multiplied by the fee. Compare against what was deposited. Neither takes more than a few minutes and both close a gap nobody was watching.
The controls for money going out
Incoming theft gets the attention. Outgoing loss is usually larger and almost entirely undramatic.
| Control | What it prevents |
|---|---|
| Owner signs or authorises every payment above a set threshold | Unapproved spending and vendor payments to accounts nobody recognises |
| New vendors require owner setup, not staff setup | Payments routed to an account controlled by an employee |
| Quarterly review of every recurring charge and subscription | Software nobody uses, duplicated services, and auto-renewals for equipment long since gone |
| Business cards are named, with per-card limits | Untraceable spending on a shared card and an unlimited downside |
| Payroll changes require owner approval | Rate changes and added hours entered by the person being paid |
The recurring-charge review is the one that reliably pays for itself in the first hour. Schools that have been operating for a decade routinely find several hundred dollars a month in subscriptions to platforms they abandoned, insurance riders for equipment sold years ago, and duplicate services purchased by two different staff members at different times.
What to do if you already suspect something
This journal is not a substitute for legal advice, and what follows is a sequencing note rather than a recommendation.
| Step | Why this order |
|---|---|
| Stop changing anything visible | Altering permissions or routines announces the inquiry before you have anything |
| Secure the independent records first | Bank statements and processor reports are the records an inside party cannot alter. Get copies directly from the institution. |
| Speak to an attorney and your accountant before speaking to the employee | Employment law, defamation exposure and evidence handling all constrain what you can do next, and they vary by state |
| Do not accuse anyone of anything you have not established | An accusation that turns out to be wrong is unrecoverable, both legally and for the school’s culture |
Notice that installing the controls described above is far easier before you have a reason to want them, because installing them afterwards is itself an accusation.
Frequently asked questions
What financial controls does a small martial arts school actually need?
Five give you most of the protection: the person who takes money is not the person who reconciles the day; delete and void permissions are restricted to the owner; three numbers are reconciled rather than one (enrollments recorded, payments recorded, money deposited); the owner personally holds the bank, processor and billing-platform administrator credentials; and cash transactions use a numbered duplicate receipt book. None of these require additional staff.
Can a one-person school have separation of duties?
Not between people, but it can separate in time and source. Reconcile the previous day against the merchant processor’s own deposit report rather than against your own records, so the comparison is always against a document you did not create. The control that matters most in a one-person school is that an outside bookkeeper samples transactions once a year.
Where do martial arts schools most often lose money without noticing?
Retail and testing fees, because both frequently sit outside the billing system and neither generates an expectation of what should have been collected. Retail is closed with inventory counts; testing is closed with a written roster produced before the event, multiplied by the fee and compared to the deposit. On the outgoing side, unreviewed recurring subscriptions are the most common quiet loss.
Will installing financial controls insult my staff?
It depends entirely on how they are framed. Controls remove the possibility of suspicion falling on an innocent employee, and shared logins are the reason many suspected cases can never be resolved in either direction. Introduce them as standard practice that protects everyone, install them for every role including your own, and the objection largely disappears.
What should I do first if I suspect theft at my school?
Secure the records an insider cannot alter — bank statements and merchant processor reports obtained directly from the institution — and speak to an attorney and your accountant before speaking to the employee. Employment law, evidence handling and defamation exposure vary by state. Do not change permissions or routines first: that announces the inquiry before you have established anything.
A note on scope
This article describes internal control design. It is not legal, accounting or tax advice, and the correct handling of a suspected loss depends on your state’s employment law, your insurance policy’s notification requirements and your own records. Consult an attorney and a qualified accountant before acting on a suspicion.
