THE NEWS IN BRIEF
Vermont State Police say Lisa Gaylor, 41, of Barton, Vermont, used her position as vault room supervisor at Jay Peak Resort to steal $70,790 in cash over roughly six months. According to the official VSP press release, investigators from the Bureau of Criminal Investigations opened a case on April 21, 2026 after a report of missing cash from the resort’s secure vault room, and a three-month investigation concluded that Gaylor had taken cash from the safe “in smaller increments ranging from $2,000 – $6,000 at a time” between fall 2025 and spring 2026. Gaylor was arrested on July 22, 2026 and released on a citation to appear in the Criminal Division of Vermont Superior Court in Newport on August 25, 2026, where she faces an embezzlement charge, according to reporting by the Boston Globe and WCAX. Jay Peak Resort has not publicly commented on the case. Gaylor is presumed innocent unless and until proven guilty in court.
THE CONSULTANT’S VERDICT
Strip away the ski-resort setting and this is one of the oldest control failures in the book: a single employee with unsupervised physical custody of cash, for months, with nobody independently counting what should have been there against what actually was. $70,790 is not a headline-grabbing number next to the seven- and eight-figure schemes I usually cover on this site, but it is exactly the kind of loss that internal audit exists to prevent — and exactly the kind that a five-minute control would have stopped in week one, not month six.
Look at what the alleged scheme required to run for six months. First, one person held the vault-room supervisor role with no evidence of a second custodian, a dual-signature requirement, or rotating oversight on access to the safe — a single point of control over a physical cash asset. Second, the increments allegedly taken — $2,000 to $6,000 at a time — sit comfortably under any threshold that might trigger automatic review or manager sign-off, a pattern consistent with someone who understood, whether formally trained in it or not, exactly how surprise cash counts and reconciliation thresholds work and stayed under them. Third, and most damning for the resort’s control environment: the case only opened after “a report of theft,” not because a scheduled reconciliation or surprise cash count caught a variance. In a business with meaningful daily cash volume — lift tickets, rentals, food and beverage, retail — a vault that goes six months without an independent count catching a $70,000 shortfall is not unlucky. It is a control gap that was there long before Gaylor allegedly walked through it.
The fraud triangle here is almost a textbook case precisely because it is so unremarkable. Opportunity was structural and total: sole physical access to cash with no compensating oversight. Rationalization in small-increment vault theft typically follows a predictable arc — the first $2,000 feels like it will obviously be noticed and isn’t, and each subsequent increment becomes easier to justify once the first several go unremarked. Pressure is not addressed in the public record, and a consultancy shouldn’t speculate about someone’s personal circumstances; what the mechanics show, reliably, is that incremental theft under a detection threshold is a rational response to an absent control, not evidence of criminal sophistication.
This is not a Vermont problem or a ski-industry problem. Hospitality, retail, and leisure businesses across the GCC run the same exposure at scale — hotel front-office safes, F&B outlet floats, retail cash offices in malls from Riyadh to Dubai — often with a single cash-office supervisor and a monthly, not surprise, count schedule. The IIA Global Internal Audit Standards call for internal audit to independently evaluate whether the organization’s controls over safeguarding assets are actually operating, not merely documented in a policy binder somewhere. A vault, safe, or cash office with one accountable custodian and a predictable count schedule is not a designed control — it is a gap with a job title attached.
WHAT YOU SHOULD DO MONDAY MORNING
- Map every physical cash point in the business and identify where one person has sole custody. Vaults, safes, petty cash boxes, and cash-office floats are the classic blind spots, especially in hospitality, retail, and leisure operations where cash volume is treated as routine.
- Introduce surprise cash counts, not scheduled ones. A count that happens on a known day of the month can be planned around; an unannounced count performed by someone outside the custodian’s reporting line cannot.
- Require dual custody or dual sign-off for any vault or safe holding more than a nominal float. No single employee should be able to open, remove from, and reconcile the same cash point without a second, independent person involved in at least one of those steps.
- Set a variance-investigation threshold well below what a single “in increments” scheme would need to hide. If your reconciliation tolerance lets $2,000–$6,000 variances pass without automatic escalation, you have already told a would-be thief exactly how much room they have.
- Rotate cash-handling and custodial roles periodically. Long, uninterrupted tenure in a single cash-custody role is one of the strongest known predictors of undetected internal theft — rotation forces a fresh set of eyes onto a control that otherwise runs on trust alone.
DON’T WAIT FOR THE HEADLINE TO BE ABOUT YOU
This exact scheme is running right now inside companies whose leaders assume a trusted, long-tenured employee with the keys to the safe is the last person who needs watching. It rarely announces itself. It looks like a reliable supervisor, a predictable count schedule, and a vault nobody double-checks between reconciliations. If you want an honest, independent look at whether your business would actually catch this before it reaches $70,000 — or $700,000 — message me directly on WhatsApp for a confidential internal audit or fraud-risk health check, before a fraudster finds the gap first.