Topic starter
22/02/2026 9:37 pm
TL;DR: Insider fraud still accounts for roughly 5% of annual revenue losses and averages $1.7 million per case, according to Delinea research, with more than half of occupational fraud cases involving missing or overridden controls. Trust-based access control fails when user access reviews, segregation of duties, and least privilege are treated as paperwork rather than enforced governance.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “Reduce insider risk: Real-life corporate fraud examples”.
Key questions
Q: What fails when organisations trust employees more than access controls?
A: Fraud control fails when the same person can create, conceal, or reconcile activity without challenge.
A: Segregation of duties reduces risk by preventing one person or team from controlling every step in a sensitive process.
Q: How can security teams tell whether privileged access reviews are actually working?
A: They are working when every privileged entitlement is inventoried, every decision is traceable, and revoked access is removed from all connected systems without delay.
Practitioner guidance
- Tighten Segregation of Duties around financial workflows Map who can create, approve, record, and reconcile transactions in ERP, CRM, HCM, and payment systems.
- Rebuild user access reviews around actual transaction capability Review access by what a user can do in the application, not by job title alone.
- Limit administrative access in spend and accounting programs Reduce standing access for users who administer virtual cards, expense tools, journal entries, or reconciliation functions.
Bottom line: The article shows that insider fraud is a control failure as much as a people problem, because trusted access becomes dangerous when governance is weak.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/10/2026 2:50 am
Trust is not a control: insider fraud persists when organisations substitute confidence in employees for enforceable access governance. The article’s cases show that access rights, financial workflows, and reconciliation duties must be constrained before fraud begins, not investigated after the loss. For IAM and IGA teams, the real question is whether control design can survive trusted-user abuse.
A few things that frame the scale:
- U.S. fraud losses are projected to reach $40 billion by 2027.
A question worth separating out:
Q: When should organisations prioritise least privilege over broader role convenience?
A: Prioritise least privilege whenever a role grants access to finance, admin, production, or cross-functional collaboration systems. Broader roles are easier to administer, but they expand blast radius and make offboarding harder. If temporary access is needed, enforce expiry so convenience does not become permanent privilege.
👉 Read our full editorial: Insider fraud exposes the limits of trust-based access control