Would you leave the front door unlocked to your business? Of course not. That would give thieves easy access to your assets. Yet a surprising number of organizations do not have strong antifraud controls in place to protect against dishonest people inside their organizations. And theft from insiders — also referred to as “occupational fraud” — can be costly.
Fraud losses vary significantly, depending on the nature of the scam and how soon it is detected. Globally, the median loss is $130,000, according to the findings from the 2018 Report to the Nations on Occupational Fraud and Abuse by the Association of Certified Fraud Examiners (ACFE). Here is a closer look at who was affected and how much was lost, as reported in the latest version of this biennial study.
VICTIM ORGANIZATIONS
Fraud can strike any organization regardless of the nature of its operations or its size. The latest ACFE study included 2,690 fraud cases occurring between January 2016 and July 2017.
While the news media focuses on high profile fraud incidents involving public companies, the median loss for those companies was only $117,000. Private companies suffered far greater losses — their median loss was a whopping $164,000. By comparison, the median losses for government and not-for-profit entities were approximately $118,000 and $75,000, respectively.
In addition, there are subtle distinctions between the types of fraud schemes that strike small and large organizations.
Top 5 Fraud Schemes by Size
Percent of Cases
| Rank | <100 Employees | 100+ Employees |
| 1 | Corruption (32%) | Corruption (43%) |
| 2 | Billing (29%) | Non-cash schemes (22%) |
| 3 | Check tampering (22%) | Billing (18%) |
| 4 | Expense reimbursement (21%) | Cash on hand (14%) |
| 5 | Skimming and cash on hand (20%) | Expense reimbursment (11%) |
To Catch a Thief
Small and large organizations also differ in how they catch fraudsters. Tips were the detection method in 29% of the cases involving small entities, compared to 44% of the cases involving large ones. This could result from the prevalence of reporting hotlines, which are more common among larger companies than small ones with limited resources.
Overall, tips are the most common way fraud is initially detected. But it is important to remember outside stakeholders may also provide tips on unethical behavior. In the 2018 study, 21% of tips came from customers and 9% came from vendors. So, it is important to educate your supply chain partners about any reporting mechanisms you set up.
Internal Controls
Beyond tips, a robust system of internal controls may help detect and prevent fraud. The latest study found that 15% of frauds were detected by internal audit procedures and 13% by management review.
What are the critical elements of an internal control system? In terms of lowering fraud losses, the most effective internal controls in the 2018 study were:
| Control | Percent Reduction in Fraud Loss |
| Code of conduct | 50% |
| Proactive data monitoring and analysis | 52% |
| Surprise audits | 51% |
| External audits | 50% |
| Management review | 50% |
| Hotline | 50% |
On the flip side, weak internal controls often provide dishonest people with the opportunity to steal assets or “cook the books.” In the 2018 study, a lack of internal controls and the ability to override internal controls were cited as the leading factors that contributed to fraud. Together, these factors were present in nearly half of the fraud cases in the latest study.
In addition, the 2018 ACFE study inquired about the types of antifraud controls fraud victims had implemented. The report revealed that 25% of frauds at larger organizations were caused by a lack of internal controls. In contrast, 42% of frauds at small organizations stemmed from weak controls. This finding helps explain why fraud seems to hit smaller organizations harder than larger ones.
Lessons Learned
Over the last two decades, the ACFE’s fraud report has taught important lessons including: No organization is immune to white collar crime. Driven by this report and recent high-profile public fraud cases, companies have increasingly implemented antifraud controls in recent years.
How do your internal controls measure up? Although strong internal controls do not guarantee fraud won’t occur at your organization, they can minimize your losses.
