Internal fraud costs companies millions: ACFE report on 2,402 real cases
Median losses per occupational fraud case exceed 104,000 USD, and 56% of companies recover nothing. ACFE analyses 2,402 cases from 143 countries.
The greatest risk comes from within the company, not from outside
According to data published by the Association of Certified Fraud Examiners (ACFE) and cited by JURIDICE.ro, companies systematically underestimate the internal threat: employees, managers and associates with legitimate access to money, assets and documents generate significantly larger losses than external factors.
The fourteenth edition of the report Occupational Fraud: A Report to the Nations is based on 2,402 real cases, investigated and finalised by certified specialists in 143 countries. Cumulative losses exceed 3.4 billion USD, with a median loss of 104,000 USD per case.
External audit detects fraud in only 2% of cases
In 43% of cases, fraud was discovered through a report — nearly three times more frequently than through internal audit (15%) or managerial checks (13%). External audit represented the initial detection method in only 2% of situations.
Of the reports received, 55% came from employees, 21% from clients and 11% from suppliers. In Romania, Law No. 361/2022 obliges companies with at least 50 employees to establish internal reporting channels — targeting precisely the statistically most effective detection tool, provided that it is known and usable even when the suspicion concerns a hierarchical superior.
Small firms are more exposed and less protected
Companies with fewer than 100 employees record a fraudulent invoicing rate of 28%, compared to 18% in large firms, whilst payment manipulation appears in 18% of cases compared to 8%. The gap is explained by control differences: only 24% of small firms had a reporting channel, compared to 85% in large ones, and managerial checks existed in 41%, compared to 79%.
The report identifies as practical priorities the separation of duties in making payments, confirmation of receipt of goods before approval of invoices, and monitoring of relationships between persons who decide on purchases and suppliers. In 38% of cases, perpetrators combined multiple types of fraud — for example, a bribe received from a supplier in exchange for approval of invoices for goods not delivered.
Each month of delay increases the damage
The median duration until discovery is 12 months. The correlation with loss is direct: median loss is 40,000 USD for fraud stopped within the first six months and exceeds one million USD for fraud lasting over five years.
The controls that most shortened the duration of fraud are surprise audits — associated with a median duration of 8 months compared to 16 months in their absence — followed by managerial checks and data monitoring. Absence of controls, circumvention of them and lack of managerial oversight together explain 70% of fraud. At the same time, 80% of companies modified their controls only after the incident occurred.
The typical perpetrator has no previous record and enjoys trust
Among fraud perpetrators, 88% had not previously been accused or convicted, which limits the usefulness of criminal record checks at hiring. The position held significantly influences the extent of loss: operational employees cause a median loss of 50,000 USD, managers of 125,000 USD, and owners and directors of 475,000 USD, with fraud lasting on average 23 months compared to 8 months in the case of employees.
Nearly half of fraud cases involved at least two persons, which reduces the efficiency of dual payment approval when both signatories act in concert. The report notes that 84% of perpetrators displayed at least one behavioural warning sign prior to discovery: a standard of living beyond known income (39%), financial difficulties (29%), an unusually close relationship with a supplier or client (17%), or refusal to delegate duties (12%).
Recovery of losses remains the exception, not the rule
Data on recovery are, according to the report, the most concerning: 56% of defrauded companies recovered nothing, 29% recovered partially and only 15% recovered in full. Authorities were notified in 54% of cases, and civil actions were filed in only 25%.
Among companies that did not notify authorities, 51% considered internal sanctions sufficient, and 35% feared negative publicity. Where cases reached criminal authorities, 72% concluded with guilty pleas or convictions.
Real chances of recovery are established in the first days: preservation of documents, determination of the extent of loss, identification of recoverable assets and choice of procedural course are steps with direct effect on the outcome.
Romania, above the global average on corruption
In the Eastern Europe and Central Asia region, to which Romania belongs, corruption appears in 57% of cases, compared to 45% globally. The regional median loss is 170,000 USD, exceeding the world average.
The central conclusion of the ACFE report is that internal fraud constitutes an inherent risk for any organisation, committed as a rule by persons without previous records, in positions of trust. Risk reduction depends on internal controls adapted to actual activity — including at management level — and on credible reporting channels, through which employees and partners can report irregularities without fear of retaliation.
The ACFE report can be downloaded free of charge from the organisation's website. The analysis was signed by lawyer Mircea Samuilă.
Source: JURIDICE.ro