THE NEWS IN BRIEF
On July 7, 2026, Hallandale Beach, Florida police arrested Sandrama Permaul, 43, and her boyfriend Oral Ollivierre, 39, both of Coral Springs, on charges of first-degree grand theft, according to reporting by Coral Springs Talk / Miami Herald’s Coral Springs News and TAPinto Coral Springs. Permaul was hired by a Hallandale Beach-based construction company in 2017 and worked her way up to office manager, becoming the sole employee responsible for paying staff, vendors, and bills. Investigators allege that beginning around 2022, she wrote unauthorized checks to herself and withdrew cash directly from two company bank accounts, and used company funds to cover her own personal utility bills. She is also accused of issuing seven checks totaling $21,490 to Ollivierre, who investigators say never worked for the company. The business owner told police the total loss came to roughly $180,278. As of July 13, both defendants remained in custody on Nebbia holds — a Florida bond condition requiring a defendant to prove that any money used to post bail did not come from the proceeds of a crime. These are accusations, and both Permaul and Ollivierre are presumed innocent unless and until proven guilty.
THE CONSULTANT’S VERDICT
Strip away the boyfriend’s checks and the personal utility bills, and what is left is the plainest control failure there is: one person held every step of the payment process — who gets paid, how much, and the physical act of writing the check or pulling the cash — with nobody standing behind her. That is not a clever fraud. It is what happens when “she’s been with us since 2017, she runs the office” quietly becomes the entire control environment.
Look at the mechanics. Permaul reportedly withdrew cash directly from two operating bank accounts. That alone tells you there was no dual-authorization requirement on cash withdrawals, no positive-pay arrangement with the bank, and no second signer on the accounts. Layer on top of that seven checks to a boyfriend who, by the company’s own records, was never an employee. A basic control — matching every check payee against an active employee or approved-vendor list before the check clears — would have flagged every single one of those seven payments on day one. Instead, by the owner’s own account, this ran long enough to reach $180,278.
The fraud triangle here is unremarkable, which is exactly the point. Opportunity was structural and accumulated slowly: a five-year tenure that gradually widened into sole responsibility for payroll, vendor payments, and bank access, with nobody ever revisiting whether that concentration of authority still made sense. Pressure is suggested by the detail that stands out most in the reporting — company funds allegedly went to pay Permaul’s own household utility bills. That is not lifestyle spending on watches or vacations; it reads as someone covering ordinary living expenses, which is often a better predictor of internal fraud than any amount of reported extravagance. Rationalization in a case like this tends to run along the lines of “I do everything around here anyway” — the quiet entitlement that builds in an employee who has, in practice, become the entire finance function of a small business.
This is not a large-company problem, and it is not unique to South Florida. It is the everyday reality of owner-managed construction and contracting firms — the exact profile of business that dominates the GCC private sector in Riyadh and Dubai as much as it does Broward County. In those firms, a single long-serving office manager or accountant is routinely handed check-signing authority, online banking credentials, and payroll all at once, precisely because years of service have earned trust. Trust is not a control. The IIA Global Internal Audit Standards are explicit that safeguarding of assets requires evaluating whether segregation of duties actually operates in practice, not whether an org chart implies it should. An owner who says “she handles all of that, I don’t need to look at it” is describing an unaudited business, not a well-run one.
Nothing in the public reporting suggests this was caught by an internal review, a bank reconciliation, or an audit finding. It surfaced because the owner eventually noticed and went to the police. For a scheme running since roughly 2022, that is years of exposure that a basic monthly reconciliation, performed by someone other than the person writing the checks, would have closed off almost immediately.
WHAT YOU SHOULD DO MONDAY MORNING
- End sole control over cash disbursements this week. No single employee should hold check-writing authority, bank withdrawal access, and payroll processing at the same time without a second person in the chain. If your business is too small to fully segregate these duties, add a mandatory second-approver step for every check and every cash withdrawal.
- Match every check and wire payee against your employee and approved-vendor master file. Any payee who is not an active employee or an approved vendor should trigger an automatic hold and a documented explanation before the payment goes out.
- Require dual authorization for any cash withdrawal from an operating account. No employee should be able to walk into a branch alone and pull cash from a business account. Talk to your bank this week about adding this control if it is not already in place.
- Run a three-to-five-year look-back on checks and cash withdrawals. Pull the underlying records for every operating account and reconcile payees against HR and vendor files. This is the single fastest way to find out whether a version of this scheme is already running in your business.
- Institute mandatory time away from the role for anyone with unilateral control over payments. A forced rotation or two-week absence, with someone else covering the function, is one of the oldest and most reliable ways this exact kind of scheme gets discovered.
DON’T WAIT FOR THE HEADLINE TO BE ABOUT YOU
This exact scheme is running right now inside companies whose owners assume their long-serving office manager or accountant would never do this — right up until they do. It rarely takes a criminal mastermind. It takes one trusted person with unchecked control over the checkbook and no one ever checking the reconciliation. If you want an honest, confidential look at whether your business would actually catch this before a police report has to, message me directly on WhatsApp for an independent internal audit or fraud-risk health check — before a fraudster finds the gap first.