Insider Fraud

Insider fraud is fraud carried out by a person inside an organisation, such as an employee, manager, director or contractor, who abuses a position of trust, system access or knowledge of internal processes. It is also called internal fraud or occupational fraud. The insider may act alone, with colleagues, or with outsiders such as suppliers, customers or organised criminals. The victim is usually the employer, but in financial firms customers' accounts and data are often the target.

It differs from external fraud in one important way: the perpetrator already has legitimate access and knows where the controls are weak. This makes it harder to detect and, on average, more costly per case. Banks treat internal fraud as a category of operational risk under the Basel framework. It should not be confused with insider trading, which is dealing in securities on confidential information.

• Asset misappropriation. The theft or misuse of the organisation's assets is the most common form. It includes embezzlement of cash, false expense claims, payroll fraud involving fictitious employees, theft of stock, and billing schemes in which payments are made to shell suppliers.
• Corruption. An insider accepts bribes or kickbacks to award contracts, approve loans or overlook defects, or acts under an undisclosed conflict of interest.
• Financial statement fraud. Senior staff misstate revenue, costs or asset values to meet targets or hide losses. It is the least frequent form but causes the largest losses.
• Customer account abuse. In banks and payment firms, staff may transfer money from dormant or vulnerable customers' accounts, open accounts or products without consent, change contact details to enable a takeover, or approve loans to accomplices.
• Data theft. Employees copy customer records, card data or credentials and sell them, enabling external fraud and data breaches.

Insiders may also be recruited or placed by criminal groups to open mule accounts, bypass checks or pass on information.

The best-known explanation is the fraud triangle, developed from the work of the criminologist Donald Cressey. It holds that three conditions are usually present: pressure, such as debt, addiction or unrealistic targets; opportunity, created by weak controls or excessive trust; and rationalisation, by which the person justifies the act as borrowing, as deserved, or as harmless. Organisations can do little about private pressures, so prevention concentrates on reducing opportunity and on a culture that makes rationalisation harder.

Typical offenders are long-serving, trusted staff with no criminal record, which is why background checks alone are a weak defence. Losses tend to rise with the seniority of the offender and the length of time the scheme runs.

Behavioural indicators include living beyond one's means, reluctance to take leave or share duties, unusually close relationships with a supplier or customer, and defensiveness when questioned. Transactional indicators include payments just below approval limits, changes to supplier bank details followed by payments, journal entries without support, activity on dormant accounts, access to records with no business reason, and overrides of system controls. Studies by the Association of Certified Fraud Examiners consistently find that tips from employees, customers and suppliers are the most common means by which schemes come to light, ahead of audit and management review.

Controls are layered so that no one person can start, approve and conceal a transaction.

• Segregation of duties and dual approval. Initiation, authorisation, recording and reconciliation are split, and payments require maker-checker approval.
• Access management. System rights are limited to what each role needs, reviewed regularly and removed promptly when staff move or leave.
• Screening and monitoring. Pre-employment and periodic checks, described under know your employee, are combined with monitoring of staff activity on customer accounts and unusual data access.
• Mandatory leave and rotation. Enforced absences give schemes that need daily attention a chance to surface.
• Reporting channels. A whistleblowing framework with protection for those who report is among the most effective measures.
• Independent review. Reconciliations, surprise checks, data analytics and internal audit test whether controls operate as designed.

Responsibility is divided under the three lines model: business management owns the controls, risk and compliance functions oversee them, and internal audit gives independent assurance.

When a case is suspected, the organisation secures evidence, restricts the person's access and begins an internal fraud investigation, often with help from specialists in forensic accounting. Outcomes may include dismissal, civil action to recover losses, a report to the police, and a claim under fidelity insurance. Regulated firms have further duties: reporting to their supervisor, filing a suspicious activity report where proceeds of crime are involved, and, in some countries, notifying an industry database of confirmed cases so that the person cannot simply move to another firm. Cases involving more than one employee are discussed under employee collusion, which defeats controls that rely on separation of roles.

No control system removes the risk. Senior managers can override controls, and collusion can defeat separation of duties. Small organisations cannot always divide tasks among enough people. Heavy monitoring raises privacy and employment law questions and can damage trust. Remote working and outsourcing extend insider access to people outside the organisation's direct supervision, which widens the population that fraud risk management has to cover.

• Association of Certified Fraud Examiners