The last few days of the month are the riskiest for a contractor's finance team. Job cost entries are being adjusted, pay applications are going out, vendor invoices are piling up, and everyone is tired. Rushed approvals and unusual requests slip through easily, and attackers know it.
Whether you run Sage, Viewpoint, or another accounting and project system, you can build a few protections into the close process that cost little and do not slow it down.
Why month-end is a target
Attackers who impersonate vendors or executives want a payment to go out before anyone looks closely. The close creates ideal conditions: high volume, deadline pressure, and people willing to skip a step to finish on time. Insiders making honest mistakes also do more damage when work is rushed. Good controls assume both.
Control the people who can change things
Review who has posting and approval rights
Before the close begins, review who can post journal entries, approve invoices, release payments, and change vendor records. The list is often longer than anyone remembers. Remove access that no longer matches a person's job, and make sure the same person cannot both create a vendor and approve payment to that vendor.
Keep admin accounts separate
System administrators should use separate admin accounts only when doing admin work, and those accounts should require multifactor authentication. Day-to-day work belongs on a normal account.
Control the data that moves money
Vendor master changes
Treat any change to vendor bank details, remit-to addresses, or contacts as a high-risk event. Require a callback to a known phone number on file, a second person to review, and a short note in the record about how the change was verified. Never use contact details from the change request itself.
Payment release
Where possible, split payment preparation from payment release, with different people and different logins. Review a report of first-time payees and any payments to changed accounts before release. This single report catches a large share of diversion attempts.
Job cost adjustments
Large or unusual job cost reclassifications should include a reason code and a reviewer other than the preparer. This is both a fraud control and a way to catch honest errors before they distort your work-in-progress reporting.
Protect the close itself
- Lock closed periods in the accounting system so entries cannot be quietly backdated. Make reopening a period a controlled event requiring approval.
- Keep an audit trail. Confirm that logging is on and that someone reviews exceptions. A log nobody reads is only forensic evidence, not a control.
- Back up before the close and after. A snapshot taken before major adjustments lets you recover from a bad import or a damaged database.
- Watch file exports. Spreadsheets of payroll, vendor, or job data emailed around the office are a common leak path. Use shared, access-controlled locations instead.
Practical month-end checklist
- Review user access to posting, approval, and payment functions.
- Run a first-time payee and changed-bank-details report before payment release.
- Confirm callbacks were completed for every vendor change this month.
- Verify that closed periods are locked after sign-off.
- Confirm a good backup exists from before and after the close.
- Note any exceptions and follow up the next week.
Mistakes to avoid
- Skipping verification because an executive "needs it today." Real executives understand a callback.
- Sharing one login among several accounting staff to save licenses. It destroys accountability.
- Letting a temporary close helper keep access afterward.
- Assuming the software vendor handles all security. They secure their platform. You control who uses it and how.
Where Ironfield Cyber fits
Ironfield Cyber works with controllers and accounting teams to review access, set up logging and backups, and build verification steps into the close without adding friction. If you would like a second set of eyes before your next month-end, we can walk through your setup with you.