Internal controls require regular reviews by a person not involved in originating or recording the transaction.
Boring and time consuming? yes.
Monthly reviews for the small business should include:
Bank account reconciliations, including e-payments
Debit and credit card reviews (these appear to be the most frequent means of employee theft)
Account receivable reconciliation (beginning + charges - collections = ending)
Payroll (every pay period and month end)
Inventory inputs and outputs
Others depending on the business model.
Not enough time? Somebody has to make time.