Fraud, corruption and financial misconduct

Some of the most important lessons in business ethics come from collapse. Enron, once the seventh-largest company in the United States, went bankrupt in 2001 after hiding debt in off-balance-sheet partnerships. WorldCom disguised billions of dollars of ordinary expenses as capital investments. In Canada, Nortel Networks, at its peak worth more than a third of the Toronto Stock Exchange's total value, restated its results several times in the early 2000s over improper accounting before eventually going bankrupt in 2009. Germany's Wirecard announced in 2020 that €1.9 billion of cash it had reported probably did not exist. FTX, a cryptocurrency exchange, collapsed in 2022 after customer funds were diverted to an affiliated trading firm; its founder was convicted of fraud in 2023 and sentenced to 25 years. This lesson examines why fraud and corruption happen, how they are detected, the anti-corruption laws that apply to Canadian and American firms, and the controls that make misconduct harder.

The scale of occupational fraud

The Association of Certified Fraud Examiners (ACFE) studies occupational fraud, meaning fraud committed by people against the organizations that employ them. Its 2024 Report to the Nations, based on nearly 2,000 cases in over 130 countries, estimated that organizations lose about 5 % of revenue to fraud each year, that the median case lasted about a year before detection and caused a median loss of about US$145,000, and that tips were by far the most common detection method, accounting for about 43 % of cases, more than three times as many as internal audit. The ACFE classifies occupational fraud into three categories: asset misappropriation, the most common but usually least costly (such as billing schemes, expense fraud and theft of inventory); corruption (bribery, conflicts of interest and kickbacks); and financial statement fraud, the least common but most costly per case.

Why people commit fraud: the fraud triangle

Criminologist Donald Cressey, studying embezzlers in the 1950s, proposed what became known as the fraud triangle. Fraud tends to occur when three elements are present. Pressure, or incentive, is a financial or emotional need, such as personal debt, pressure to meet targets or fear of losing a job. Opportunity is the ability to commit and conceal the fraud, usually because of weak controls, poor oversight or a position of trust. Rationalization is the justification that allows a person to see the act as acceptable, such as 'I am only borrowing the money', 'the company owes me' or 'everyone does it'. Later researchers added capability, the skills, position and confidence needed to carry out a fraud, turning the triangle into a diamond.

Organizations have the most direct control over opportunity, through internal controls, segregation of duties, oversight and audit. But they also influence pressure, through targets and incentives (lesson 3), and rationalization, through culture: an organization where rules are bent at the top and employees feel mistreated makes rationalization easier. The rationalizations people use for fraud are close cousins of the moral disengagement mechanisms in lesson 3.

Financial statement fraud and earnings management

Financial statement fraud deliberately misstates results to mislead investors, lenders or regulators. Common schemes include recognizing revenue early or fictitiously, for example by recording sales that are not final or 'channel stuffing' by shipping excess goods to distributors; capitalizing expenses that should be charged immediately, as WorldCom did; understating liabilities and reserves; overstating assets such as inventory or receivables; and hiding debt off the balance sheet, as Enron did. Between legitimate accounting judgement and fraud lies a grey zone of earnings management, in which managers use the discretion that accounting standards allow, or time real decisions such as delaying maintenance, to meet targets. Earnings management may be legal, but it erodes the reliability of financial information and can be the first step on the slippery slope.

Analysts and auditors use such ratios, along with other red flags, to identify where to look more closely. Other warning signs include earnings that consistently beat forecasts by tiny margins, cash flow from operations that lags reported profits for years, frequent changes of auditors or chief financial officers, complex related-party transactions, and a domineering chief executive with a weak board.

Data analytics: Benford's law

Benford's law states that in many naturally occurring sets of numbers, such as invoice amounts or expense claims, the first digit is not uniformly distributed: about 30 % of numbers begin with 1, 18 % with 2, and fewer than 5 % with 9. The expected share for a first digit \(d\) is:

People who invent numbers tend to spread first digits more evenly or cluster amounts just below approval thresholds. Auditors compare actual first-digit frequencies with Benford's expected frequencies to flag unusual patterns for review. The program below simulates genuine invoices and a set containing fabricated amounts just below a $5,000 approval limit.

import math, random
random.seed(9)
expected = {d: math.log10(1 + 1 / d) for d in range(1, 10)}
genuine = [math.exp(random.uniform(math.log(50), math.log(50_000))) for _ in range(5000)]
fabricated = genuine[:4600] + [random.uniform(4000, 4999) for _ in range(400)]  # amounts kept under a 5,000 limit
def first_digit_shares(xs):
    counts = [0] * 10
    for x in xs:
        counts[int(str(int(x))[0])] += 1
    return {d: counts[d] / len(xs) for d in range(1, 10)}
g, f = first_digit_shares(genuine), first_digit_shares(fabricated)
print("digit  Benford  genuine  with fabricated")
for d in range(1, 10):
    print(f"  {d}     {expected[d]:5.1%}   {g[d]:5.1%}    {f[d]:5.1%}")

digit  Benford  genuine  with fabricated
  1     30.1%   28.9%    26.7%
  2     17.6%   17.9%    16.4%
  3     12.5%   12.5%    11.5%
  4      9.7%    9.4%    16.8%
  5      7.9%    8.1%     7.4%
  6      6.7%    7.1%     6.6%
  7      5.8%    6.2%     5.6%
  8      5.1%    5.2%     4.7%
  9      4.6%    4.6%     4.2%

The fabricated set shows an excess of amounts beginning with 4. Benford's law is a screening tool, not proof: it applies only to data spanning several orders of magnitude, and an unusual pattern may have an innocent explanation, such as a common price point. It directs investigators where to look.

Bribery and corruption

Corruption is the abuse of entrusted power for private gain. In business, it includes bribing public officials to win contracts, licences or favourable treatment; commercial bribery between private parties; kickbacks; and facilitation payments, small payments to speed up routine government actions. Corruption harms economies by distorting competition, inflating costs, reducing the quality of public services and undermining trust in institutions. It also exposes firms to severe penalties, debarment from public contracts, and reputational damage. Transparency International's Corruption Perceptions Index ranks countries by perceived public-sector corruption and is widely used in risk assessments.

Canada's Corruption of Foreign Public Officials Act (CFPOA), enacted in 1999 to implement the OECD Anti-Bribery Convention, prohibits giving or offering a benefit to a foreign public official to obtain or retain an advantage in business. Amendments in 2013 extended jurisdiction to conduct by Canadian citizens, permanent residents and Canadian companies anywhere in the world, raised the maximum prison term to 14 years, added a books-and-records offence, and repealed the exception for facilitation payments, which took effect in October 2017. Domestic bribery and secret commissions are offences under the Criminal Code. Enforcement has been modest compared with the United States, with a handful of convictions such as Niko Resources (2011) and Griffiths Energy (2013), and the 2019 guilty plea of an SNC-Lavalin subsidiary to fraud related to work in Libya, which brought a $280 million fine. Transparency International and the OECD have criticized Canada's enforcement as limited.

Third parties are the main channel for bribery. Most enforcement cases involve agents, consultants, distributors or joint venture partners who pay bribes on a company's behalf. Due diligence on third parties, contractual anti-corruption clauses, audit rights, scrutiny of unusually high commissions or vague 'consulting' services, and monitoring of payments are central controls. Red flags include an agent recommended by a government official, requests for payment in cash or to offshore accounts, and refusal to certify compliance.

Internal control and certification

Canada's National Instrument 52-109 requires the chief executive and chief financial officers of reporting issuers to certify annual and interim filings, including that they have designed disclosure controls and internal control over financial reporting and evaluated their effectiveness. Unlike in the United States, Canadian issuers are not required to obtain an auditor's attestation on internal control. Canadian companies listed in the United States must also comply with US requirements.

Internal controls follow familiar principles: segregation of duties, so that no single person can initiate, approve, record and reconcile a transaction; authorization limits; reconciliations; physical controls over assets; and independent review. The COSO internal control framework, widely used in both countries, organizes controls into five components: control environment, risk assessment, control activities, information and communication, and monitoring. The control environment, essentially the tone at the top, comes first because controls are easily overridden by management if the culture permits it, which is exactly what happened at WorldCom and Wirecard.

Lessons from major cases

The major frauds share recurring themes. A charismatic, dominant leader faced little challenge. Aggressive growth targets and stock-based pay created pressure. Complex structures obscured the truth: Enron's special-purpose entities, Wirecard's third-party acquiring partners, FTX's commingling of customer and affiliate funds. Gatekeepers failed: auditors, boards, analysts and regulators missed or overlooked warning signs, and at Wirecard journalists and short sellers who raised concerns were attacked. And employees who saw problems either did not speak up or were not heard. The remedies follow: independent and engaged boards, sceptical gatekeepers, simple and transparent structures, controls that management cannot easily override, and protected channels for speaking up, the subject of lesson 10.