Most installment business owners in Pakistan are not short of staff. They are short of staff they can leave alone.
So the owner sits at the counter six days a week, takes every payment personally, and the business grows exactly as far as one person's attention reaches. The usual explanation is trust. The real problem is structure: in a paper-based or single-login shop, there is no difference between letting someone work and letting someone do anything. Delegation and exposure are the same act.
They do not have to be. Separating them is mostly a matter of deciding, once, who can see what — and making every action leave a trace.
The four places money actually leaks
Theft in a small retail business is rarely dramatic. It is small, procedural, and it lives in these four gaps.
1. The unrecorded collection. A customer pays PKR 5,000 in cash; the receipt is written but the entry never reaches the book, or reaches it as PKR 3,000. This is the most common and hardest to detect, because the customer is satisfied and the only evidence is a receipt they are carrying home in their pocket.
2. The edited history. An entry is changed after the fact to cover a shortfall, or a payment recorded yesterday is quietly removed today. In a register this is a scratch-out; in a system without a trail it is a two-second edit that leaves no footprint at all.
3. The unauthorised concession. A staff member drops the advance, extends the tenure, or waives a late payment to close a sale — sometimes for a commission, sometimes just to be liked. No cash is stolen. The loss arrives three months later as a default and never gets attributed to the decision that created it.
4. The exported customer list. Phone numbers, addresses and CNICs walking out of the door when someone leaves, usually to a competitor. Owners rarely count this as theft until it has happened.
Notice that only the first is theft of cash. The other three are failures of authority and record-keeping, which is why hiring more honest people does not fix them.
Decide what each role can see
The principle is narrow and old: give each person exactly the access their job requires, and no more. Written down for an installment shop, it usually looks like this.
| Role | Should be able to | Should not be able to |
|---|---|---|
| Counter / sales staff | Record payments, look up accounts, create plans within set limits, print receipts | Change plan terms, edit or delete past payments, see overall profit, export customer lists |
| Recovery staff | See due and overdue accounts, log contacts and promises, record collections | Create new sales, alter plan terms, change customer records |
| Manager | Everything above, plus approve exceptions and view reports | Alter audit records, change other users' permissions |
| Owner | Everything, including permissions and the audit trail | — |
Counter staff should not see shop-level profit. Not because it is secret, but because margin visibility is what makes discounting feel harmless. A salesperson who knows the markup will give it away.
Nobody except the owner should change plan terms after creation. The advance and tenure are your risk policy. If they can be edited at the counter, you do not have a policy — you have a suggestion.
Make corrections visible instead of impossible
The instinct when tightening a shop is to lock everything down. It backfires. Staff who cannot fix a genuine mistake will work around the system — a side note, a cash drawer adjustment, a WhatsApp message to the owner — and your records drift from reality anyway.
The better rule: mistakes are correctable, and corrections are permanent records.
A payment entered twice should be reversible by the person who made it, with the reversal showing as its own dated entry rather than making the original disappear. Nothing is hidden, nothing is undoable, and the staff member is not punished for honesty. Markaz Flow handles corrections this way — a discarded payment stays visible as a transparent reversal rather than vanishing from the account — precisely because deletions are what make a ledger untrustworthy.
The same logic covers everything else. Every record of consequence should carry who did it and when, and that trail should not be editable by the people whose work it describes. An immutable audit log is not about suspecting your staff; it is what allows you to stop watching them.
The weekly ten-minute review
A permission structure with no review is decoration. One short, predictable session a week is enough, and it should be predictable — staff behaving well under observation is the entire point.
Each week, look at four things:
- Payment reversals and corrections. A few are normal. A pattern around one person or one shift is the signal.
- Plans created outside policy. Advances below your floor, tenures beyond your maximum. Ask about each one.
- Collections recorded late. Cash taken Monday and entered Thursday is the window in which money goes missing. Entry should be same-day, every day.
- Accounts that moved into arrears this week. Who sold them, and under what terms?
Then do the one thing that makes the review work: mention what you looked at. Not accusingly — just so everyone knows the review happens.
Have the conversation before you switch it on
Introducing roles and audit logging badly reads as an accusation, and good staff resent it. Introduced properly, it is genuinely in their interest, and that framing is true rather than a trick.
Say it directly. When every payment carries the name of who recorded it, a staff member can never be blamed for someone else's shortfall. When the till does not reconcile, the record shows what happened instead of leaving suspicion to settle on whoever was nearest. Clear boundaries also mean nobody has to carry a decision above their pay — the system says what the advance floor is, so the awkward negotiation with a pushy customer is not theirs to lose.
Shops that explain it this way find staff ask for the trail when something goes wrong.
The point is not control, it is capacity
Every hour the owner spends personally taking payments is an hour not spent on buying, pricing, supplier terms or opening a second branch. The structure above exists so that the business can run when you are not in it.
That is the actual return: not fraud prevented, but a business whose ceiling is no longer the owner's attention span.
Markaz Flow supports this with custom roles and permissions plus an audit log of system activity, so delegation does not have to mean exposure — see how it fits together or start free. If you are still running the shop on a register or a spreadsheet, start with why spreadsheets and bahi-khata leak money.