What it means
Practitioners usually sort corporate fraud into three families. Asset misappropriation covers theft of cash, stock or data and is by far the most common; financial statement fraud means misstating the published accounts; and corruption covers bribery, kickbacks and undisclosed conflicts of interest.
The three types differ enormously in frequency and cost. Asset misappropriation happens most often but usually involves smaller sums, while financial statement fraud is comparatively rare and does the most damage, because it can destroy a listed company's market value in a single announcement.
Most schemes require the same three ingredients. There must be pressure such as personal debt or an unreachable target, an opportunity created by weak controls, and a way for the person to justify the act to themselves, often starting as a temporary borrowing they fully intend to repay.
The defences are unglamorous and effective. Segregation of duties so that no one person can both approve and pay, mandatory holiday for finance staff, supplier bank detail changes verified by callback, regular reconciliations reviewed by someone independent, and a confidential reporting line catch a high proportion of schemes.
The true cost extends well past the money taken. Investigation fees, legal advice, insurance excesses, management time, higher audit costs, lost customer contracts and reputational damage routinely exceed the original loss by a wide margin.
In practice
Real-world examples.
Example
A hospital procurement officer awards contracts to a medical supplies firm secretly owned by a relative, at prices roughly 18% above the market rate. The arrangement runs for four years until a routine benchmarking exercise flags the pricing gap and a conflict of interest check uncovers the relationship.
Example
A listed technology company books revenue on distributor shipments that carry an unlimited right of return, inflating reported sales by $46,000,000 across six quarters. When the practice is disclosed the shares fall by more than a third in a day and the regulator opens an investigation.
Example
A charity's bookkeeper diverts $4,000 a month by adding a personal bank account to the payroll under a former volunteer's name. Because the same person prepared the payroll and reconciled the bank account, the scheme runs undetected for over two years.
Formula
Calculation
The number that gets a board's attention is the total cost, not the amount stolen:
Total cost of fraud = direct loss + investigation and legal costs + remediation costs - amounts recovered
A mid-sized construction firm discovers that a finance manager created a fictitious subcontractor and paid it $800,000 a year for three years, a direct loss of 3 x $800,000 = $2,400,000. The forensic accounting investigation costs $600,000, legal fees to pursue the individual and deal with the auditors come to $350,000, and rebuilding the payments controls costs $150,000, so gross cost is $2,400,000 + $600,000 + $350,000 + $150,000 = $3,500,000.
The company's fidelity insurance pays out $1,000,000, leaving a net cost of $3,500,000 - $1,000,000 = $2,500,000. On a net profit margin of 10%, replacing that lost profit requires $2,500,000 / 0.10 = $25,000,000 of additional sales, which is the comparison that usually persuades a board to fund better controls.Case study
Seen in the real world.
This is an illustrative, fictional scenario. Ashgrove Medical Supplies, an invented distributor of clinical consumables, ran a lean finance team of four people in which the accounts payable clerk both set up new suppliers and released the weekly payment run.
Over five years the clerk added eleven fictitious suppliers with plausible names and invoiced small amounts against real cost centres, averaging $310,000 a year for a total of $1,550,000. The invoices always sat below the $25,000 threshold that would have triggered a second approval, and the clerk had not taken more than four consecutive days of leave in that period.
The scheme surfaced when the clerk was hospitalised and a colleague covering the payment run noticed two suppliers sharing a bank account number. In the illustrative aftermath, the company recovered $420,000 through insurance and the sale of the clerk's assets, spent $480,000 on investigation and legal work, and introduced supplier verification callbacks, a two-week compulsory leave rule and quarterly duplicate bank account testing.
Watch out
Common mistakes.
- Believing fraud is something that happens at large companies, when smaller businesses are more exposed precisely because they cannot separate duties as easily.
- Relying on the external audit to detect fraud, when an audit is designed to give an opinion on the accounts and is not a fraud investigation.
- Trusting long-serving staff without controls, because tenure grants exactly the system access and unquestioned authority that most schemes need.
Questions
People also ask.
What is the single most effective control for a small business?
Making sure the person who authorises a payment is never the same person who sets up the supplier or reconciles the bank account.
Should a company report fraud to the police?
In most cases yes, and in regulated sectors it is mandatory, though the board will normally take legal advice first to protect any civil recovery action.
Can insurance cover it?
Fidelity or crime insurance covers employee dishonesty up to a policy limit, but it rarely covers consequential losses such as lost contracts or the cost of a restatement.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%