This big companies can perhaps afford to throw a lot of resources toward fraud prevention. But what about small companies? The need is just as dire, but a less expensive approach is often required. One lawyer suggests breaking the potential instances of fraud into smaller pieces: (1) the work environment, (2) control systems, and (3) fraud-specific procedures. Of course each one of these could result in a whole year's worth of IT and other re-engineering. But it can also be viewed as a way of isolating the areas within a company where the vulnerabilities are greatest.