Fraud, corruption and financial misconduct

Some of the most important lessons in business ethics come from collapse. Enron, once the seventh-largest company in the United States, went bankrupt in 2001 after hiding debt in off-balance-sheet partnerships. WorldCom disguised billions of dollars of ordinary expenses as capital investments. In Canada, Nortel Networks, at its peak worth more than a third of the Toronto Stock Exchange's total value, restated its results several times in the early 2000s over improper accounting before eventually going bankrupt in 2009. Germany's Wirecard announced in 2020 that €1.9 billion of cash it had reported probably did not exist. FTX, a cryptocurrency exchange, collapsed in 2022 after customer funds were diverted to an affiliated trading firm; its founder was convicted of fraud in 2023 and sentenced to 25 years. This lesson examines why fraud and corruption happen, how they are detected, the anti-corruption laws that apply to Canadian and American firms, and the controls that make misconduct harder.

The scale of occupational fraud

The Association of Certified Fraud Examiners (ACFE) studies occupational fraud, meaning fraud committed by people against the organizations that employ them. Its 2024 Report to the Nations, based on nearly 2,000 cases in over 130 countries, estimated that organizations lose about 5 % of revenue to fraud each year, that the median case lasted about a year before detection and caused a median loss of about US$145,000, and that tips were by far the most common detection method, accounting for about 43 % of cases, more than three times as many as internal audit. The ACFE classifies occupational fraud into three categories: asset misappropriation, the most common but usually least costly (such as billing schemes, expense fraud and theft of inventory); corruption (bribery, conflicts of interest and kickbacks); and financial statement fraud, the least common but most costly per case.

Why people commit fraud: the fraud triangle

Criminologist Donald Cressey, studying embezzlers in the 1950s, proposed what became known as the fraud triangle. Fraud tends to occur when three elements are present. Pressure, or incentive, is a financial or emotional need, such as personal debt, pressure to meet targets or fear of losing a job. Opportunity is the ability to commit and conceal the fraud, usually because of weak controls, poor oversight or a position of trust. Rationalization is the justification that allows a person to see the act as acceptable, such as 'I am only borrowing the money', 'the company owes me' or 'everyone does it'. Later researchers added capability, the skills, position and confidence needed to carry out a fraud, turning the triangle into a diamond.

Organizations have the most direct control over opportunity, through internal controls, segregation of duties, oversight and audit. But they also influence pressure, through targets and incentives (lesson 3), and rationalization, through culture: an organization where rules are bent at the top and employees feel mistreated makes rationalization easier. The rationalizations people use for fraud are close cousins of the moral disengagement mechanisms in lesson 3.

Financial statement fraud and earnings management

Financial statement fraud deliberately misstates results to mislead investors, lenders or regulators. Common schemes include recognizing revenue early or fictitiously, for example by recording sales that are not final or 'channel stuffing' by shipping excess goods to distributors; capitalizing expenses that should be charged immediately, as WorldCom did; understating liabilities and reserves; overstating assets such as inventory or receivables; and hiding debt off the balance sheet, as Enron did. Between legitimate accounting judgment and fraud lies a gray zone of earnings management, in which managers use the discretion that accounting standards allow, or time real decisions such as delaying maintenance, to meet targets. Earnings management may be legal, but it erodes the reliability of financial information and can be the first step on the slippery slope.

Analysts and auditors use such ratios, along with other red flags, to identify where to look more closely. Other warning signs include earnings that consistently beat forecasts by tiny margins, cash flow from operations that lags reported profits for years, frequent changes of auditors or chief financial officers, complex related-party transactions, and a domineering chief executive with a weak board.

Data analytics: Benford's law

Benford's law states that in many naturally occurring sets of numbers, such as invoice amounts or expense claims, the first digit is not uniformly distributed: about 30 % of numbers begin with 1, 18 % with 2, and fewer than 5 % with 9. The expected share for a first digit \(d\) is:

People who invent numbers tend to spread first digits more evenly or cluster amounts just below approval thresholds. Auditors compare actual first-digit frequencies with Benford's expected frequencies to flag unusual patterns for review. The program below simulates genuine invoices and a set containing fabricated amounts just below a $5,000 approval limit.

import math, random
random.seed(9)
expected = {d: math.log10(1 + 1 / d) for d in range(1, 10)}
genuine = [math.exp(random.uniform(math.log(50), math.log(50_000))) for _ in range(5000)]
fabricated = genuine[:4600] + [random.uniform(4000, 4999) for _ in range(400)]  # amounts kept under a 5,000 limit
def first_digit_shares(xs):
    counts = [0] * 10
    for x in xs:
        counts[int(str(int(x))[0])] += 1
    return {d: counts[d] / len(xs) for d in range(1, 10)}
g, f = first_digit_shares(genuine), first_digit_shares(fabricated)
print("digit  Benford  genuine  with fabricated")
for d in range(1, 10):
    print(f"  {d}     {expected[d]:5.1%}   {g[d]:5.1%}    {f[d]:5.1%}")

digit  Benford  genuine  with fabricated
  1     30.1%   28.9%    26.7%
  2     17.6%   17.9%    16.4%
  3     12.5%   12.5%    11.5%
  4      9.7%    9.4%    16.8%
  5      7.9%    8.1%     7.4%
  6      6.7%    7.1%     6.6%
  7      5.8%    6.2%     5.6%
  8      5.1%    5.2%     4.7%
  9      4.6%    4.6%     4.2%

The fabricated set shows an excess of amounts beginning with 4. Benford's law is a screening tool, not proof: it applies only to data spanning several orders of magnitude, and an unusual pattern may have an innocent explanation, such as a common price point. It directs investigators where to look.

Bribery and corruption

Corruption is the abuse of entrusted power for private gain. In business, it includes bribing public officials to win contracts, licenses or favorable treatment; commercial bribery between private parties; kickbacks; and facilitation payments, small payments to speed up routine government actions. Corruption harms economies by distorting competition, inflating costs, reducing the quality of public services and undermining trust in institutions. It also exposes firms to severe penalties, debarment from public contracts, and reputational damage. Transparency International's Corruption Perceptions Index ranks countries by perceived public-sector corruption and is widely used in risk assessments.

The Foreign Corrupt Practices Act (FCPA) of 1977 prohibits US companies, issuers of securities in the United States and others from bribing foreign officials to obtain or retain business, and requires issuers to keep accurate books and records and maintain adequate internal accounting controls. It contains a narrow exception for facilitating payments for routine governmental action, such as processing visas, which many companies nonetheless prohibit because the exception is narrow and such payments are illegal in many other countries. The Foreign Extortion Prevention Act of 2023 made it a crime for foreign officials to demand or accept bribes from US companies. FCPA enforcement was historically the most active in the world, but in February 2025 an executive order paused new enforcement for review, and guidelines issued in June 2025 focused enforcement on cases linked to cartels and transnational criminal organizations, conduct that harms the competitiveness of US companies, national security, and serious misconduct involving substantial bribes. Analysts reported 2025 as the lowest year for FCPA enforcement in more than a decade; the statute of limitations, books-and-records obligations and foreign anti-bribery laws mean companies still face significant risk.

Third parties are the main channel for bribery. Most enforcement cases involve agents, consultants, distributors or joint venture partners who pay bribes on a company's behalf. Due diligence on third parties, contractual anti-corruption clauses, audit rights, scrutiny of unusually high commissions or vague 'consulting' services, and monitoring of payments are central controls. Red flags include an agent recommended by a government official, requests for payment in cash or to offshore accounts, and refusal to certify compliance.

Internal control and certification

After Enron and WorldCom, the Sarbanes-Oxley Act of 2002 created the Public Company Accounting Oversight Board to oversee auditors, banned many non-audit services by auditors to their audit clients, and required chief executive and chief financial officers to certify financial reports (section 302). Section 404 requires management to assess internal control over financial reporting and, for larger companies, an auditor to attest to that assessment. Executives who knowingly certify false reports face criminal penalties.

Internal controls follow familiar principles: segregation of duties, so that no single person can initiate, approve, record and reconcile a transaction; authorization limits; reconciliations; physical controls over assets; and independent review. The COSO internal control framework, widely used in both countries, organizes controls into five components: control environment, risk assessment, control activities, information and communication, and monitoring. The control environment, essentially the tone at the top, comes first because controls are easily overridden by management if the culture permits it, which is exactly what happened at WorldCom and Wirecard.

Lessons from major cases

The major frauds share recurring themes. A charismatic, dominant leader faced little challenge. Aggressive growth targets and stock-based pay created pressure. Complex structures obscured the truth: Enron's special-purpose entities, Wirecard's third-party acquiring partners, FTX's commingling of customer and affiliate funds. Gatekeepers failed: auditors, boards, analysts and regulators missed or overlooked warning signs, and at Wirecard journalists and short sellers who raised concerns were attacked. And employees who saw problems either did not speak up or were not heard. The remedies follow: independent and engaged boards, skeptical gatekeepers, simple and transparent structures, controls that management cannot easily override, and protected channels for speaking up, the subject of lesson 10.