ITS 4450 - Fraud Risk Assessment Tools and Investigation

Chapter 5, Recognizing the Symptoms of Fraud

This lesson presents material from chapter 5. Objectives important to this lesson:

  1. Symptoms of fraud
  2. Accounting anomalies
  3. Internal control weaknesses
  4. Analytical fraud symptoms
  5. Extravagant lifestyles
  6. Unusual behaviors
  7. Tips and complaints
Chapter 5

The author tells us that fraud may be detected after suspicions are raised. We are warned that suspicion is simply that, and it is not proof. Investigation must be made to determine whether a fraud is taking place. To that end, the author introduces six categories of symptoms of fraud:

  1. accounting anomalies - The text gives an example of fake medical bills being submitted for several employees by 22 "doctors" who had the same two addresses. The phony doctors were the inventions of the manager of the claims payment department. Accounting audits were satisfied that the bills matched the payments, but a fraud audit raised suspicion about too many vendors being at each location.
  2. weak internal controls - In the example above, the company never verified that the patients received care,or that the doctors existed. The text also mentions that the manager committing the fraud had not taken a vacation in ten years. This is not clear evidence, but it is a violation of a standard control that everyone should take time off and have their job done by someone else on a regular basis. Failure to comply with this concept is suspicious in staff who control payments.
  3. analytical anomalies - In the example case, more money was paid to the 22 phone doctors than to real doctors. Company paid medical expenses went up 29% due to those payments. Payments to the phony doctors were all made under the company funded program, and nothing was paid to them under regular insurance coverage.
  4. extravagant lifestyle - Employees whose regular expenses are in excess of their known income are always suspicious. In the example case, the manager was spending more money than she earned, but she explained that there had been an inheritance of a large sum of money. This story was not true.
  5. unusual behavior - Many behaviors may be indicators that an employee is having problems. The employee in our example was having Jekyll and Hyde mood swings, which is not a indicator of fraud, but it may be an indicator of pressure or illness.
  6. tips and complaints - As noted in previous chapters, fraud may be reported first by employees who notice odd things that auditors and managers do not. In our example, there was no reporting, which only goes to show that we cannot rely on having every kind of indicator.

The text turns to accounting anomalies, odd documentation that an accounting audit should find. The list of possible clues on page 143 requires that an auditor be familiar with accounting and business practices. The list on page 145 is a little more accessible to those of us without extensive accounting training. If you don't know already, an accounting journal records the events of an a business that add or subtract from its assets and its liabilities.

  • journal entries without documentation - we would only be taking the word of whoever entered the entry that it had happened
  • unexplained adjustments to receivables (amounts owed to us), payables (amounts we owe to others or to other accounts), revenues (amounts paid to us) , or expenses (amounts we pay to others or to other accounts)
  • entries that do not balance - all entries must balance, according to generally accepted accounting principles
  • entries made by persons who do not normally make such entries - this violates the security principle of integrity

The book gives several illustrations of false journal entries, and we could conclude that the persons committing these frauds should simply have been better bookkeepers. (English majors: what is unusual about that last word?) That is a good point, but a better point is that a good accounting system is meant to find errors, leading to accurate data for the company using it. The text cautions us to watch that ledgers are balanced, that entries in them make sense, and that entries are properly documented. A fraud investigator must understand the situation and ask the system the right questions.


On page 147, the text moves on to internal controls, which is a more common topic in our security classes. A list of common weaknesses in controls is presented:

  • lack of segregation of duties
  • lack of physical safeguards
  • lack of independent checks
  • lack of proper authorization
  • lack of proper documents and records
  • overriding of existing controls
  • inadequate accounting system

Each of these weaknesses can be considered as an example of a company using inadequate checks and balances regarding protection and use of its assets. The examples that follow illustrate that weaknesses in the system provide opportunities for people who would otherwise not find themselves in the fraud triangle. A more pressing danger is the case of an employee who creates a control weakness in order to exploit it. This is the reason that we must watch all processes. It probably has always been so. In my opinion, the solution proposed by the text on page 148 for small businesses has a weakness. It makes a single person the internal control of several processes, which presents that person with opportunity for fraud. Independent checks might improve this control, even in a small organization, and would definitely be called for in a large one.

On page 148, the text discusses analytical symptoms of fraud. The list that appears on that page could be summarized as saying "look for atypical or abnormal data about anything we measure". An example is given of a company whose inventory of an asset was overstated, proven by calculating what the warehouses could actually hold and what the forklifts in it were capable of moving. Calculations of this sort should be used regularly to confirm that claimed assets actually exist, that they are located where records say they are, and that they are properly valued. The text presents several examples of fraud that was detected through careful examination of operations and documents.

The key to the next section of the chapter is shown well in the graphic on page 153. We know that pressure on the perpetrator is one of the causes of fraud. The graphic tells us that this pressure is often accompanied by guilt about the crime, and by fear of detection. Add those three elements together and you can expect that a person committing fraud will have behavioral changes. The list of changes on page 153 are things to watch for. The behaviors themselves are not unique to persons committing fraud., Drastic changes in a person's behavior can indicate stress, illness, or other conditions. The point is that many people committing fraud are not sociopaths or professional criminals. When a 'normal' person commits this crime, we can expect to see warning signs.

The text reminds us to investigate tips and complaints we receive about possible fraud or other wrongdoing. It is easy to say that a report is just an attempt to cause trouble for someone the reporter does not like, but we need to be sure. Staff who work with a fraud are more likely to notice changes in behavior and improper work performance. A report about a coworker acting oddly may be an indication that there is some kind of problem. In a benevolent organization, the first response should be to refer the reported employee to the Employee Assistance Program. The investigators in the organization have an obligation to investigate tips impartially, seeking the truth. If the truth is that there has been a crime, then the purpose of the investigation changes.


  1. Continue the reading assignments for the course.
  2. Complete the assignments and class discussion made in this module.