When you hand over the keys: the art of oversight

I handed the operational keys to what looked like a credentialed, experienced CEO and stepped back to focus on other things. Fourteen months later, I discovered he had been embezzling from the company. The recovery took two years, cost us millions, and taught me more about oversight than any business school course ever could.

I want to be clear: delegation was the right decision. Trying to run everything yourself is how companies fail. The mistake wasn't stepping back. The mistake was stepping back without putting the mechanisms in place that would let me see clearly from a distance. I trusted a résumé and a confident presentation instead of building a system. And systems, unlike people, don't have incentives to mislead you.

The embezzlement was sophisticated enough to look normal on the surface for a long time. Expense approvals that were just large enough not to trigger obvious red flags. Invoices for services that were partly real and partly inflated. A financial reporting structure that made it easy to see the top line and hard to understand the detail. None of this required genius — just an absence of the right controls and a person willing to exploit that absence. I provided both.

“Oversight isn't distrust. It's the operating system that lets trust function at scale.”

After the recovery, I put in place structures I now consider non-negotiable for any business I'm involved in: dual authorisation for payments above a defined threshold. Monthly reconciliation that I review personally, not just receive. A direct relationship with the CFO that bypasses the CEO. Unannounced spot checks on key line items. And a clean separation between the person who approves spending and the person who processes it. These aren't expressions of distrust. They're the architecture that makes trust sustainable.

The takeaway

The cost of good oversight is minimal. The cost of no oversight, as I discovered, is existential. Build the controls before you need them. You'll never know how much damage they prevented because they'll prevent it silently. That's exactly how they're supposed to work.