Occupational and Internal Fraud Guide

Most fraud against an organisation is committed by people it already trusts: employees, managers, executives and contractors using access the business gave them. Occupational fraud is quieter than a cyber attack and often runs for months before anyone notices, because the fraudster knows the controls and how to stay under them. This guide explains the ACFE fraud tree, the controls that stop each scheme type, how to run a reporting hotline that people actually use, and the data analytics that find fraud before a tip does. It is written for finance, internal audit, compliance and security leads building or reviewing an anti-fraud programme. The security side of insider risk (data theft, sabotage) is covered in the Insider Threat Programme Guide; this page focuses on financial abuse.

Key takeaways

Asset misappropriation is common, statement fraud is costly. In the ACFE's 2026 Report to the Nations, 90% of cases involved asset misappropriation and 6% financial statement fraud, but the median financial statement fraud loss was $1 million against $100,000 for misappropriation.
Corruption sits in almost half of cases. The same report found corruption in 45% of cases, so procurement, vendor relationships and conflicts of interest deserve their own controls, not a line in the code of conduct.
Tips find fraud, so the hotline is a control. Make reporting easy across web, email and phone, protect reporters from retaliation, and route reports to someone independent of management.
Analytics turn audit sampling into full population testing. Duplicate payments, vendor and employee data matches and approval just below thresholds are cheap tests that run on every transaction.
Access design is a fraud control. Segregation of duties, least privilege in finance systems and prompt leaver revocation remove the opportunity most schemes depend on.

What occupational fraud is and how the fraud tree classifies it

The Association of Certified Fraud Examiners (ACFE) defines occupational fraud as fraud committed by individuals against the organisations that employ them. Its Occupational Fraud and Abuse Classification System, usually called the fraud tree, groups every scheme into three categories. The ACFE's own definitions are: corruption, where an employee misuses influence in a business transaction in breach of their duty to the employer to gain a direct or indirect benefit; asset misappropriation, where an employee steals or misuses the organisation's resources; and financial statement fraud, the intentional misstatement or omission of material information in the organisation's financial reports.

Category	Main branches	Typical examples	Who usually commits it
Asset misappropriation: cash	Skimming, cash larceny, fraudulent disbursements	Unrecorded sales, fake supplier invoices (billing schemes), ghost employees (payroll), inflated or fictitious expense claims, altered cheques or payment details	Staff in accounts payable, payroll, sales, retail and branch roles
Asset misappropriation: inventory and other assets	Misuse, larceny	Stock theft, personal use of company vehicles or equipment, theft of data or intellectual property for sale	Warehouse, logistics, IT and field staff
Corruption	Conflicts of interest, bribery, illegal gratuities, economic extortion	Kickbacks from a supplier, bid rigging, hidden ownership of a vendor, payments to steer a contract, bribed staff selling customer data	Buyers, project managers, sales leads, support staff, executives
Financial statement fraud	Net worth or income overstatement and understatement	Fictitious revenue, timing differences, concealed liabilities, improper asset valuations, improper disclosures	Senior management and finance leadership

Cases often span categories: a buyer who takes kickbacks (corruption) may also approve inflated invoices (billing). Classify by every scheme present, because each one points to a different control gap.

What the Report to the Nations tells you

The ACFE's Occupational Fraud 2026: A Report to the Nations is the 14th edition of its global study. It analyses 2,402 cases from 143 countries and territories across 22 industry categories. Figures below are as published by the ACFE in 2026; use the report itself, not secondary summaries, when quoting numbers to a board.

Finding (ACFE, 2026 edition)	Figure	What to do with it
Cases involving asset misappropriation	90%	Prioritise payments, payroll, expenses and inventory controls
Cases involving corruption	45%	Run conflict of interest declarations and procurement analytics
Cases involving financial statement fraud	6%	Focus on management override, journal entry testing, audit committee oversight
Median loss: financial statement fraud / corruption / asset misappropriation	$1,000,000 / $150,000 / $100,000	Size investigation and assurance effort to impact, not frequency alone
Most common reporting mechanisms used by tipsters	Web-based 46%, email 34%, phone 23%	Offer all three channels, with web as the default
Median loss where the fraudster showed excessive pressure from within the organisation	$532,000	Treat unrealistic targets as a fraud risk factor
Median loss where the fraudster was unusually close with a vendor or customer	$300,000	Feed relationship concerns into procurement reviews
Median loss where the fraudster refused to take vacations	$250,000	Enforce mandatory leave in high-risk roles

The ACFE also reports that the presence of anti-fraud controls such as surprise audits, management review and proactive data monitoring and analysis is associated with lower losses and quicker detection.

Controls by scheme type

Map each branch of the fraud tree to preventive and detective controls. Preventive controls remove the opportunity; detective controls shorten the time a scheme runs.

Scheme	Preventive controls	Detective controls
Billing and shell vendors	Vendor master changes require a second person and independent verification of bank details; no single user can both create a vendor and approve payment	Vendor to employee address, phone and bank account matching; new vendors paid quickly after creation; invoices without purchase orders
Payroll and ghost employees	HR, payroll and payment release held by different people; joiner and leaver data driven from the HR system of record	Employees with no leave taken, no tax or pension deductions, shared bank accounts, or paid after termination
Expense reimbursement	Receipts required, card data matched, approver cannot be the claimant's report	Round amounts, weekend claims, duplicate receipts, claims just under the receipt or approval threshold
Cheque and payment tampering	Positive pay, payment file integrity checks, dual release in banking portals	Payee name changes after approval, out of sequence payments, manual payments outside the normal run
Conflicts of interest and bribery	Annual and event-driven conflict declarations, gifts and hospitality register, competitive tender thresholds, rotation of buyers	Single-source awards, contract splitting below tender thresholds, a buyer always awarding the same supplier, price drift after award
Financial statement fraud	Board and audit committee oversight, independent internal audit, restricted access to post manual journals	Journal entries posted at period end, by senior users, to unusual accounts, or with round numbers; revenue spikes in the last days of a quarter

Where identity fits: Many schemes rely on toxic access combinations in ERP and finance systems, such as one user who can create a vendor, change its bank details and release payment. Role design, quarterly access reviews in finance applications and prompt removal of leavers are among the most effective fraud controls available, and they are owned by the identity team rather than finance. See the Segregation of Duties Guide and the Insider Threat and Identity Guide.

Running a whistleblowing hotline people trust

A hotline only works if people believe it is safe and that something happens when they use it. Design it around those two beliefs.

Channels: Offer web, email and phone, and allow anonymous reporting with a way to answer follow-up questions (for example a case number and password in a web portal). The ACFE's 2026 data shows web-based reporting as the most used mechanism.
Audience: Open it to employees, contractors, suppliers and customers. Fraud involving a vendor is often spotted first by a competing vendor or by the vendor's own staff.
Independence: Route reports involving senior management straight to the audit committee chair or an independent function, never through the line being accused.
Legal deadlines: In the EU, Directive (EU) 2019/1937 requires private sector legal entities with 50 or more workers to set up internal reporting channels (Article 8(3)), to acknowledge a report within seven days of receipt (Article 9(1)(b)) and to give feedback within a reasonable timeframe not exceeding three months (Article 9(1)(f)). National transposition laws add detail, so confirm local rules.
External routes: Staff may report outside the organisation. In the United States the SEC whistleblower programme pays awards of 10% to 30% of the money collected where original information leads to an enforcement action with sanctions over $1 million, which is a reason to make internal channels the easier, faster option.
Non-retaliation: State it in policy, train managers on it, and monitor the employment outcomes of reporters for at least a year.

See the Cyber Whistleblowing Guide for reporting of security failures.

Fraud analytics that find schemes early

Continuous analytics test every transaction instead of a sample. Start with tests that are cheap to build and produce few false positives, then add more as investigators learn what is noise.

Test	Data needed	Targets
Duplicate payments (same vendor, amount and date window, or same invoice number with different formatting)	AP ledger	Billing schemes, error recovery
Vendor to employee match on bank account, address, phone or tax ID	Vendor master, HR master	Shell companies, conflicts of interest
Payments to vendors created or changed in the last 30 days	Vendor master change log, payments	Shell vendors, bank detail redirection
Amounts just under approval or tender thresholds, and split purchase orders	PO and invoice data, delegation of authority matrix	Threshold avoidance, contract splitting
Digit frequency analysis against Benford's law	Expense claims, journal entries	Fabricated numbers (use as a pointer, not proof)
Payroll records with no deductions, shared bank accounts, or pay after termination date	Payroll, HR leavers	Ghost employees
Manual journals at period end by senior users or to suspense accounts	General ledger with user and timestamp	Financial statement fraud, management override
Users who can perform conflicting steps, and users who actually did	ERP role assignments and transaction logs	Segregation of duties breaches

Behavioural red flags also matter. The ACFE lists excessive pressure from within the organisation, past legal problems, unusual closeness to a vendor or customer, refusal to take holidays and a wheeler-dealer attitude among the flags linked to higher median losses. Managers should be trained to raise them, not to investigate them alone. See the Fraud Rules and Machine Learning Models Guide for scoring approaches.

Building the programme: a phased approach

Assess fraud risk. Run a fraud risk assessment per process (procure to pay, order to cash, payroll, treasury, financial close) using the fraud tree as the checklist. The COSO and ACFE Fraud Risk Management Guide, second edition (released 2 May 2023), aligns its principles with the COSO 2013 Internal Control Integrated Framework and is the usual reference.
Fix access first. Extract ERP roles, identify conflicting combinations, and remove or compensate them. This is often the fastest reduction in opportunity.
Launch or refresh the hotline. Publish channels, set triage rules and response deadlines, and tell staff what happens after a report.
Pilot analytics. Run three to five tests on 12 months of historical data, review every hit with finance, tune thresholds, then schedule them monthly or continuously.
Define the investigation path. Agree who decides to investigate, how evidence (system logs, emails, ledger extracts) is preserved, when legal and HR join, and when law enforcement or insurers are notified.
Report and review. Give the audit committee a quarterly fraud report and re-run the risk assessment yearly or after a major change such as a new ERP or acquisition.

Rollback here means control exceptions, not reversal: if a new segregation rule blocks a critical payment run, use a time-limited documented exception with a second approver rather than restoring the old access.

Decision guidance for small and large organisations

Area	Small organisation (under about 100 staff)	Large organisation
Segregation of duties	Often impossible in full: use compensating controls such as owner review of bank statements and vendor changes	Rule-based SoD in the ERP with automated conflict checks at role request
Hotline	Third-party hosted service or an external adviser as recipient	Case management system, multi-language, integrated with investigations
Analytics	Quarterly spreadsheet tests on AP and payroll	Continuous monitoring platform feeding a fraud or audit team
Regulatory driver	Usually contractual and lender requirements	Listed company rules, the UK failure to prevent fraud offence, EU whistleblowing law

In the UK, the failure to prevent fraud offence introduced by the Economic Crime and Corporate Transparency Act 2023 came into effect on 1 September 2025. It applies to large incorporated bodies, subsidiaries and partnerships, large incorporated not-for-profits and incorporated public bodies, where an associated person commits a specified fraud offence intended to benefit the organisation and the organisation did not have reasonable fraud prevention procedures. It targets fraud committed for the organisation's benefit, which complements controls against fraud on the organisation. See the UK Failure to Prevent Fraud Offence Guide.

Detection and measurement

Time to detection: median months between scheme start and discovery for closed cases, trending down.
Source of detection: share of cases found by tip, analytics, internal audit and accident. A rising analytics share is a healthy sign.
Hotline health: reports per 100 employees, share of reports acknowledged within seven days, share closed with feedback within three months.
SoD conflicts: number of open conflicting access combinations in finance systems, and how many have documented compensating controls.
Analytics yield: share of alerts that lead to a recovery, control fix or case, used to retire noisy tests.
Recovery rate: amount recovered as a share of confirmed losses.

Framework mapping

Control area	NIST CSF 2.0	NIST SP 800-53 Rev 5	Other
Fraud risk assessment	GV.RM-01	RA-3	COSO and ACFE Fraud Risk Management Guide
Segregation of duties and least privilege	PR.AA-05	AC-5, AC-6	ISO/IEC 27001:2022 Annex A 5.3
Monitoring personnel activity	DE.CM-03	AU-6	ISO/IEC 27001:2022 Annex A 8.16
Screening and sanctions	GV.RR-04	PS-3, PS-8	ISO/IEC 27001:2022 Annex A 6.1, 6.4
Awareness and reporting	PR.AT-01	AT-2	ISO/IEC 27001:2022 Annex A 6.8; Directive (EU) 2019/1937

Common failure patterns

Trusting long-serving staff with everything. The person who "knows the system" and never takes leave often holds conflicting duties nobody has reviewed.
Hotline routed to the accused. Reports about a finance director that land with the finance director end the hotline's credibility.
Bank detail changes accepted by email. Vendor master changes without call-back verification serve both insiders and outside fraudsters. See the Invoice Redirection Fraud Guide.
Access wider than the job. When insiders can see or change far more records than their work needs, bribery becomes cheap. In the Coinbase insider bribery breach, criminals paid overseas support agents to copy customer data they could already reach, and no alert caught the unusual lookups.
Analytics run once. A one-off audit test finds historical cases but does not deter, because staff know it will not run again.
Ignoring outsourced staff. Contractors and outsourced teams with finance or customer access are often outside HR checks and access reviews.

Lessons from incidents

The Coinbase case is corruption in the fraud tree sense: an outsider paid insiders to misuse their position. Strong login controls worked; what failed was scope of access and monitoring of how that access was used. The same pattern applies to a payables clerk with vendor master rights: the control that matters is not authentication but whether one identity can complete a whole scheme alone and whether anyone looks at the pattern of its activity.

Practitioner checklist

Run a fraud risk assessment for each core finance process using the three fraud tree categories.
Extract ERP and banking portal roles and remove or compensate every vendor create, bank change and payment release conflict.
Require call-back verification on a known number for every vendor bank detail change.
Publish web, email and phone reporting channels open to staff, contractors and suppliers, with anonymous follow-up.
Route reports about senior management to the audit committee or an independent function.
Meet the seven-day acknowledgment and three-month feedback rules where EU whistleblowing law applies.
Schedule duplicate payment, vendor to employee match and threshold avoidance tests at least monthly.
Test period-end manual journals by senior users every quarter.
Enforce mandatory consecutive leave and job rotation in high-risk finance roles.
Report fraud metrics to the audit committee quarterly.

Occupational and Internal Fraud Guide: Detect Misappropriation, Corruption and Statement Fraud