Occupational Fraud Red Flags: How Fraud Is Detected and the Fraud Examiner’s Role

How big is occupational fraud?

Occupational fraud is fraud committed against an organisation by someone inside it, whether an employee, a manager or an owner. In the 14th edition of ACFE’s report, based on 2,402 real cases from 143 countries and territories, Certified Fraud Examiners estimate that organisations lose 5% of revenue to fraud each year. ^[1]

The median loss per case was USD 104,000, and the typical case ran for 12 months before it was detected. ^[1] In the Middle East and North Africa region the median loss was USD 123,000, and corruption featured in 60% of cases. ^[1]

What are the three categories of occupational fraud?

ACFE classifies occupational fraud into three categories. Asset misappropriation is the most frequent and has the lowest median loss, while financial statement fraud is the rarest but by far the most costly. ^[1] Corruption sits between the two, and it matters particularly to Gulf organisations because of its higher share of cases in the Middle East and North Africa (60% against 45% globally). ^[1]

Knowing the category tells you where to look: asset misappropriation shows up in payments, stock and cash; corruption in procurement and vendor relationships; and financial statement fraud in closing entries and accounting estimates.

How is fraud actually detected?

Tips are the leading method by a clear margin: they uncovered 43% of cases, followed by internal audit at 15% and management review at 13%. ^[1] Of those tips, 55% came from employees, 21% from customers, 14% from anonymous sources and 11% from vendors. ^[1]

That makes the reporting channel the most important detection tool an organisation has. By mechanism, web-based portals were used for 46% of tips, email for 34% and telephone for 23%. ^[2] So offer more than one channel, and open it to vendors and customers, not just staff.

Training makes a difference: employees at organisations that provided fraud awareness training were more than twice as likely to submit a tip that led to detection, and 71% of employee whistleblowers had received such training. ^[1]

What are the behavioural red flags?

84% of perpetrators displayed at least one behavioural red flag. ^[1] The most common were:

Source: ACFE 2026 report. ^[1]

Some red flags are less frequent but linked to higher losses. The highest median loss was associated with excessive pressure from within the organisation (USD 532,000), followed by past legal problems (400,000), an unusually close association with a vendor or customer (300,000) and refusal to take leave (250,000). ^[2]

There are signs in the HR file too: 45% of perpetrators showed at least one HR-related red flag, such as a poor performance evaluation or fear of job loss. ^[1] The important caveat is that 16% showed no behavioural red flag at all, ^[1] so warning signs complement controls rather than replace them.

Which control gaps do fraudsters exploit?

The fraud triangle explains a case through three elements: pressure or incentive, such as a debt or financial need; opportunity created by weak controls, such as inadequate segregation of duties; and rationalisation, such as feeling unfairly treated. Opportunity is the element internal audit can influence most directly. ^[3]

In ACFE’s report the leading control weaknesses were a lack of internal controls (33%), override of existing controls (19%) and a lack of management review (18%). ^[1] Two or more perpetrators were involved in 49% of cases, with a median loss of USD 224,000 against 55,000 for a single perpetrator. ^[1] Segregation of duties alone is therefore not enough unless collusion is also monitored.

To conceal the fraud, perpetrators created fraudulent physical documents in 39% of cases and altered physical documents in 33%. ^[1] Checking that documents are genuine, not merely present, is part of detection.

ACFE links anti-fraud controls with lower losses and quicker detection, citing surprise audits, management review and proactive data monitoring and analysis among them. ^[2] Data tests you can start with include:

• Vendors sharing a bank account number, address or phone number with employees.
• Repeated purchase orders just below approval limits.
• Invoices with duplicate numbers or amounts for the same vendor.
• Manual journal entries posted at weekends, out of hours or close to period end.
• Staff in sensitive roles who have not taken leave for a long time.

Who does what: management, internal audit and the fraud examiner?

The Global Internal Audit Standards require internal auditors to develop competence in pervasive risks such as fraud (Standard 3.1), to consider the probability of fraud as part of due professional care (4.2) and to consider fraud risks when assessing engagement risk (13.2). ^[3] But, as the IIA position quoted in the same paper makes clear, internal auditors are not expected to have the expertise of someone whose primary job is investigating fraud, and investigations are best carried out by those experienced in them. ^[3]

The Certified Fraud Examiner (CFE) exam reflects that specialism, covering Fraud Schemes and Financial Crimes, Fraud Investigations and Legal Issues, and Fraud Prevention and Deterrence. ^[4]

Hypothetical example: a vendor who is too close

A procurement officer at a distribution company has refused to take annual leave for two years and insists on handling one particular vendor’s account personally. Finance notices that purchase orders for this vendor often come in just below the approval limit that requires a manager’s signature.

These observations alone do not prove fraud, but they combine two behavioural red flags, an unusually close vendor association and refusal to take leave, ^[2] with a data pattern that deserves examination. The right response is to inform the head of internal audit confidentially, analyse the purchase orders and prices against other vendors, and then hand the examination to a specialist if the indicators hold up, without confronting the employee early.

What should you do when you suspect fraud?

The key rule: do not confront the suspect or start an investigation yourself. Preserve documents and system logs as they are, escalate through the channel your organisation’s policy sets out, and consult legal counsel before any interview. If internal audit suspects management involvement, it must first gather concrete evidence; the Anti-Fraud Collaboration paper describes the practice of taking that evidence to the general counsel to assess its validity and legal implications. ^[3]

Reporting to the authorities differs from one Gulf country to another, in both the competent body and the procedure. In Saudi Arabia, for example, suspected financial or administrative corruption can be reported to the Oversight and Anti-Corruption Authority (Nazaha). ^{[5, 6]} Your policy should therefore name the competent body in each country where you operate, after legal review.

Conclusion

Most fraud is uncovered by a tip from someone who noticed something, not by chance. Provide several reporting channels, train staff to recognise red flags, close the three most exploited control gaps, and write down in advance what to do on suspicion and who will carry out the examination.