Fraud theory and the cost of fraud

Lesson 1 described what forensic accountants do. This lesson asks why people commit fraud, how frauds are classified, and how much they cost. These questions are not academic. A theory of why fraud happens tells an organization where to put its controls, and a classification of schemes tells an investigator which records to examine first. Cost estimates explain why boards fund fraud prevention, and they give investigators a sense of what is typical, so that unusual patterns stand out.

Fraud has a legal meaning that differs in detail between jurisdictions, but the common core is dishonest deception that causes, or risks causing, a loss to another person or a gain to the deceiver. In Canada, fraud under the Criminal Code requires a dishonest act (deceit, falsehood or other fraudulent means) and deprivation, which includes putting someone's economic interests at risk. In the United States, fraud is defined in many federal and state statutes, such as the mail and wire fraud statutes, and in the common law tort of fraud, which requires a knowingly false representation of a material fact, reliance and damage. For forensic accountants, the practical point is that fraud involves intent, and intent is proved by evidence of what people knew and did, not by numbers alone.

The fraud triangle

The most widely taught model of why people commit fraud comes from the American criminologist Donald Cressey, who interviewed people imprisoned for embezzlement in the 1940s and 1950s. He concluded that trusted persons violate trust when three conditions come together. First, they have a financial problem they feel they cannot share, which later writers broadened to pressure or incentive. Second, they see an opportunity to solve the problem secretly by violating the trust placed in them. Third, they are able to rationalize the conduct in a way that preserves their view of themselves as honest people, for example by thinking that they are only borrowing the money, that the company owes them, or that everyone does it.

The triangle is useful because each side suggests a response. Organizations can do little about employees' personal pressures, though employee assistance programs and fair compensation help. They can do a great deal about opportunity, through segregation of duties, approval limits, reconciliations, surprise audits and data analytics. They can influence rationalization through culture: clear codes of conduct, leaders who model integrity, and consistent consequences when misconduct is found. Auditing standards in both countries use the triangle directly: the auditor's risk assessment considers incentives and pressures, opportunities and attitudes or rationalizations, as ACCT-331 discussed.

The triangle also has limits. Cressey's model described individual employees who embezzled; it fits less well with frauds planned from the start, with collusion among several people, or with executives who manipulate financial statements to meet targets. Critics also note that rationalization is hard to observe before the fact, and that the model can encourage a focus on bad individuals rather than on the conditions an organization creates.

Extensions: the fraud diamond, the fraud scale and MICE

Several extensions address these limits. The fraud diamond, proposed by David Wolfe and Dana Hermanson in 2004, adds capability: the personal traits and position that allow someone to exploit an opportunity. A person who understands the payables system, has authority to override a control, can lie convincingly and handles stress well is more capable of committing and concealing a fraud than someone with the same opportunity but less skill or nerve. The diamond explains why many large frauds are committed by long-serving, trusted, competent employees and executives.

The fraud scale, associated with Steve Albrecht and colleagues in the 1980s, replaces rationalization with personal integrity and presents the three factors as weights on a balance: high pressure and opportunity with low integrity tip the scale toward fraud. The MICE model describes motivations: money, ideology, coercion and ego. It is often used for corruption and insider threats, where a person may act out of belief, because they are being pressured or blackmailed, or for the satisfaction of beating the system, not only for money. Each model is a lens, not a law; investigators use them to generate hypotheses about who might have acted and why, and then test the hypotheses against evidence.

In the Saltmarsh Industrial Supply Ltd. matter, the hotline reports point to two very different patterns. The vendor allegation, if true, looks like a classic triangle case: an employee with access to the vendor master and to payment approval, perhaps under financial pressure, using a shell company. The revenue allegation looks like an incentive case at a senior level: fourth-quarter sales pushed out with side letters, perhaps to meet a bonus target or a bank covenant. The models suggest different questions: who could create a vendor and approve its invoices, and who benefits if fourth-quarter revenue is higher.

The fraud tree

The Association of Certified Fraud Examiners (ACFE) classifies occupational fraud, meaning fraud committed by people against the organizations that employ them, into three main categories, often drawn as a tree. Corruption covers conflicts of interest, bribery, illegal gratuities and economic extortion. Asset misappropriation covers theft of cash and other assets, including skimming, cash larceny, fraudulent disbursements such as billing, payroll, expense reimbursement and cheque tampering schemes, and the misuse or theft of inventory and other assets. Financial statement fraud covers intentional misstatement of financial statements, usually to overstate performance or position, but sometimes to understate it, for example to reduce taxes or depress the price in a buyout.

The categories overlap. A purchasing manager who takes kickbacks from a supplier is committing corruption, but the company's loss shows up as inflated purchase prices, which looks like a billing problem. A sales executive who inflates revenue to earn a bonus is committing financial statement fraud that also misappropriates assets, the bonus. The tree is mainly a way to organize thinking and data: each branch has typical red flags, typical records to examine and typical controls, and lessons 3 to 7 of this course work through them.

How much fraud costs

The best-known source of data on occupational fraud is the ACFE's report to the nations, published every two years from cases reported by certified fraud examiners. The edition released on May 12, 2026, Occupational Fraud 2026, analysed 2,402 cases from 143 countries. Its headline findings, as reported at release, include the following.

Three patterns in these data have stayed stable over many editions. Asset misappropriation is by far the most common scheme but has the smallest typical loss. Financial statement fraud is rare but by far the most costly per case. And tips, mostly from employees, detect more frauds than any other method, ahead of internal audit, management review and external audit. Reports from summaries of the 2026 edition also show that losses grow with duration, that organizations with controls such as surprise audits and formal reporting channels tend to have lower losses and faster detection, and that most perpetrators showed at least one behavioural red flag, such as living beyond their means, financial difficulties or an unusually close relationship with a vendor or customer, before they were caught.

These data come with caveats that a forensic accountant should state whenever citing them. The cases are those investigated by CFEs who chose to respond to a survey, not a random sample of all frauds, so undetected frauds are missing by definition, and large or interesting cases may be over-represented. Losses are those known at the time of reporting. The 5 per cent of revenue figure is a median estimate by respondents, not a measured quantity, and applying it to a single organization gives an order of magnitude, not a forecast. With those caveats, 5 per cent of Saltmarsh Industrial Supply Ltd.'s 91.2 million dollars of reported revenue would be about 4.6 million a year, which helps explain why a board might spend a fraction of that on prevention and detection.

Looking at a firm's own case data

Forensic practices often keep their own statistics on closed matters, which can be more relevant to their clients than global surveys. The program below summarizes 30 invented closed matters from a forensic firm's files, using the same measures as the ACFE report.

# Summary of 30 closed occupational fraud matters in a forensic firm's files (invented data).
# Each case: (scheme category, loss in thousands of dollars, months until detection, how detected)
import statistics as st
from collections import Counter

cases = [
    ("asset misappropriation", 38, 9, "tip"), ("asset misappropriation", 112, 14, "tip"),
    ("asset misappropriation", 21, 5, "management review"), ("asset misappropriation", 64, 11, "internal audit"),
    ("asset misappropriation", 437, 46, "tip"), ("asset misappropriation", 15, 4, "account reconciliation"),
    ("asset misappropriation", 92, 18, "tip"), ("asset misappropriation", 48, 12, "by accident"),
    ("asset misappropriation", 133, 20, "internal audit"), ("asset misappropriation", 27, 7, "management review"),
    ("asset misappropriation", 205, 26, "tip"), ("asset misappropriation", 56, 10, "account reconciliation"),
    ("asset misappropriation", 74, 13, "tip"), ("asset misappropriation", 9, 3, "document examination"),
    ("asset misappropriation", 160, 24, "external audit"), ("asset misappropriation", 33, 8, "tip"),
    ("corruption", 150, 15, "tip"), ("corruption", 480, 30, "tip"), ("corruption", 95, 12, "internal audit"),
    ("corruption", 260, 22, "tip"), ("corruption", 71, 9, "management review"), ("corruption", 1200, 36, "tip"),
    ("corruption", 118, 16, "by accident"), ("corruption", 340, 19, "internal audit"),
    ("financial statement fraud", 1900, 24, "tip"), ("financial statement fraud", 850, 18, "external audit"),
    ("financial statement fraud", 3100, 30, "internal audit"), ("financial statement fraud", 640, 14, "tip"),
    ("asset misappropriation", 44, 9, "tip"), ("corruption", 210, 20, "management review"),
]
print(f"Matters: {len(cases)}   median loss: {st.median(c[1] for c in cases):,.0f}k   "
      f"median months to detection: {st.median(c[2] for c in cases):.0f}")
print(f"\n{'Category':<28}{'cases':>6}{'median loss (k)':>17}{'median months':>15}")
for cat in ("asset misappropriation", "corruption", "financial statement fraud"):
    sub = [c for c in cases if c[0] == cat]
    print(f"{cat:<28}{len(sub):>6}{st.median(c[1] for c in sub):>17,.0f}{st.median(c[2] for c in sub):>15.0f}")
print("\nHow the frauds were detected:")
for how, n in Counter(c[3] for c in cases).most_common():
    print(f"  {how:<24}{n:>3}  {n/len(cases):6.1%}")
# Longer schemes cost more: compare losses for schemes found within 12 months and after.
early = [c[1] for c in cases if c[2] <= 12]; late = [c[1] for c in cases if c[2] > 12]
print(f"\nMedian loss, detected within 12 months: {st.median(early):,.0f}k ({len(early)} cases)")
print(f"Median loss, detected after 12 months:  {st.median(late):,.0f}k ({len(late)} cases)")

Matters: 30   median loss: 115k   median months to detection: 14

Category                     cases  median loss (k)  median months
asset misappropriation          17               56             11
corruption                       9              210             19
financial statement fraud        4            1,375             21

How the frauds were detected:
  tip                      14   46.7%
  internal audit            5   16.7%
  management review         4   13.3%
  account reconciliation    2    6.7%
  by accident               2    6.7%
  external audit            2    6.7%
  document examination      1    3.3%

Median loss, detected within 12 months: 41k (12 cases)
Median loss, detected after 12 months:  235k (18 cases)

The firm's small data set shows the same shape as the global data: asset misappropriation is most common with the lowest median loss, financial statement fraud is rarest with the highest, and tips detect the most cases. The comparison of early and late detection is the most important line for prevention. The median loss for schemes found within 12 months is a small fraction of the median for schemes that ran longer, because most schemes grow over time: perpetrators who are not caught tend to take more. The Saltmarsh Industrial Supply Ltd. vendor allegation, if confirmed, would fall in the second group, since the vendor was created in March 2022.