I run a small software company with ten employees. You say 46 per cent of small and medium-sized businesses have no fraud controls in place. What sort of controls are you thinking of? Jim Wilson, Manchester

All business, however small, should have an internal control system in place to prevent fraud or error. Such a system sets out the policies and procedures for processing, recording and reporting financial data and safeguarding a company’s assets. The key control in any business is to segregate duties. This can be difficult in small companies, but ask yourself the following:

Is the person responsible for preparing cheques also able to sign cheques or authorise payments or to approve suppliers' invoices?

Does the person with authority to open new purchase ledger accounts also authorise purchase invoices and have cheque signing powers?

Does the person who takes the deposits to the bank also prepare the paying-in records and open the post in which cheques may be received?

Does the person responsible for reconciling the bank account also have cheque-signing authority?

Does the person who prepares the monthly debtors’ statements also post them?

If you cannot segregate these duties, try asking other members of staff to review procedures or rotating staff around tasks. Other internal controls include:

Personnel controls. Always obtain and check employee references and introduce an effective staff supervision structure

Arithmetic and accounting controls. Compare budgets with actual results regularly and monitor cash flows. Reconcile bank accounts regularly.

Can you give us more detail on the post-Enron tightening up of internal controls? Are you referring to Sarbanes-Oxley and if so is this not a US law rather than an EU or UK law? Are there penalties for non-compliance for UK companies? I work in IT support in a medium-sized firm. Sean McEntee, Bristol

The Sarbanes-Oxley Act 2002 ("SOX") was passed in the United States with the aim of restoring investor confidence and to underwrite the integrity of financial information following the collapse of Enron. But it does have implications for UK firms. Any UK company listed on a recognised US stock exchanges must comply with SOX, as must UK subsidiaries with listed parent companies.

Many companies in the UK not covered by the Act are still adopting some of the principles of corporate governance and internal controls as best practice. But nearly 70 per cent of support staff interviewed in a recent survey conducted by IT service management firm Axios Systems and the Help Desk Institute Europe did not know about Sarbanes-Oxley.

Sarbanes-Oxley has important implications for the IT sector, as financial documentation and controls in most organisations are heavily dependent on IT systems. If IT systems are not included in the SOX audit process, it is highly likely that organisations will be unable to achieve compliance.

I read your comments about the trustee of a charity who became concerned about the activities of his charity director siphoning off money. I fear something similar is happening at the the charity where I am a trustee, but I’m no financial expert and I don’t want to give the charity a bad name. Susan Chilcott, London

Fraud within a charity is serious and has implications for the police and for professional advisers, who have a duty to report any such activity to the National Criminal Intelligence Service under the provisions of the Proceed of Crime Act. It also involves the lead regulator, for example the Charity Commission or the Housing Corporation. The trustees have an obligation to protect the assets of the charity.

The reputation of the charity can also be tarnished although the impact can be mitigated if properly handled. But any fraud will come out sooner or later, so a trustee with serious concerns about a director needs to do something to confirm or deny those suspicions.

In the first instance, speak confidentially to a friend or contact outside the charity or to a fellow trustee who is financially aware. If your concerns appear to be well-founded, you will be in a better position to decide the next steps, which should include independent legal and accountancy advice.

You mention that when you uncover fraud during an audit you can "image" computer data. What do you mean by this and how does the process work? Bill Matthews, Wiltshire

Forensic IT specialists can take an "image", a complete copy, of computer hard drives at a point in time which does not alter any of the information recorded on the computer. Switching on or off a computer which is suspected of having been used to perpetrate a fraud can irretrievably corrupt its contents for the purposes of evidence. Taking a copy – imaging - the hard drive enables investigators to analyse the data, review documents and correspondence and to recover deleted material without fear of corrupting the evidential value of that material. Computers can only be imaged by forensic IT specialists who have to follow strict guidelines.