On-Demand Webinar: “The Bottom Line: Occupational Fraud: A Risk Every Organization Faces”

Key Takeaways

• The fraud triangle focuses on three conditions that commonly contribute to occupational fraud: pressure, opportunity, and rationalization. Of those three, organizations have the most direct ability to reduce opportunity through controls and oversight.
• The presenters identify three main categories of occupational fraud: asset misappropriation, financial statement fraud, and corruption. Actual matters can overlap more than one category.
• Fraud risk is not limited to large organizations or obviously suspicious employees. The webinar emphasizes that long-tenured, trusted employees may understand control gaps and may have broad access that creates opportunity.
• Tips were presented as the most common initial detection method in the ACFE data discussed during the webinar. Reporting mechanisms are more useful when employees and other stakeholders know about them and trust the process.
• Individual red flags do not prove fraud. The presenters emphasize looking for patterns and clusters of behavioral, financial, access, and control indicators rather than treating one observation as determinative.
• The case studies show how segregation of duties, documented approval workflows, vendor review, and review of account changes can reduce opportunities for misuse and reveal broader control weaknesses.
• Forensic accountants focus on evidence rather than assumptions. Their work can support investigations, disputes, regulatory matters, and decision-making without making legal determinations of guilt or innocence.
• Artificial intelligence can increase the speed and realism of scams, impersonation, and document fraud, while also supporting anomaly detection and monitoring. Human evaluation and business context remain necessary.

Practical Next Steps

• Reassess segregation of duties, broad system access, approval authority, and the ability of one employee to initiate and approve the same activity.
• Review backup approval processes so temporary approvers understand vendor lists, expected transactions, and the controls they are responsible for maintaining.
• Review vendor lists and the substance of services provided, not only whether a vendor exists. Consider how conflicts of interest or similarly named entities could bypass routine review.
• Confirm that employees and other stakeholders know how to report concerns and understand whether hotline, web-form, email, or other reporting channels are trusted and monitored.
• Evaluate clusters of red flags and transaction patterns rather than relying on one behavioral sign or one unusual data point.
• Reassess controls after restructurings, new business lines, staffing changes, or other operational changes that may alter access, responsibilities, or approval paths.
• Update verification procedures for unusual payment requests, documents, voices, images, or videos as AI-enabled fraud techniques evolve.

Frequently Asked Questions

What is occupational fraud?

The webinar describes occupational fraud as the deliberate misuse or application of an organization’s resources or assets through one’s occupation for personal enrichment. The presenters distinguish it from an accidental error by emphasizing intentional misrepresentation or concealment.

What are the main types of occupational fraud?

The presenters identify three main categories: asset misappropriation, financial statement fraud, and corruption. They also note that an actual matter may overlap categories rather than fit neatly into only one.

What is the fraud triangle?

The fraud triangle describes three conditions that are typically present when fraud occurs: financial pressure, opportunity, and rationalization. The webinar emphasizes that organizations can most directly influence opportunity by strengthening controls and oversight.

What warning signs can indicate increased fraud risk?

The webinar discusses behavioral indicators such as living beyond one’s means, financial difficulties, unusually close vendor relationships, and changes in behavior, along with organizational conditions such as control weaknesses, broad access, performance issues, or fear of job loss. The presenters caution that one red flag is not proof of fraud and emphasize patterns or clusters of indicators.

Will an audit always detect occupational fraud?

No. The presenters explain that audits have an important financial-reporting role but cite ACFE data showing tips as the most common initial detection method. They emphasize making reporting channels known, accessible, and trusted.

How can internal controls help reduce occupational fraud risk?

The webinar highlights segregation of duties, documented approval workflows, vendor review, review of account changes, management oversight, and periodic reassessment of controls. Controls reduce opportunity, but the presenters also emphasize culture, governance, and consistent leadership behavior.

What does a forensic accountant do in a suspected fraud matter?

The presenters describe forensic accounting as a blend of accounting, investigation, and communication. Forensic accountants analyze evidence, trace financial activity, and communicate findings to organizations, attorneys, boards, regulators, and other decision-makers without making legal determinations of guilt or innocence.

How is artificial intelligence affecting fraud risk and detection?

The webinar explains that AI can help create convincing scams, impersonations, and fake documents and can increase the speed and scale of fraudulent activity. AI can also help identify unusual transactions and patterns, but the presenters stress that a person still needs to evaluate the underlying facts, documentation, and business purpose.

---

Webinar Transcript

This transcript was generated with AI and may contain errors or omissions. Please refer to the webinar recording for the most accurate version.

00:00 – Introduction and CPE instructions

PYA Moderator 00:05

Good afternoon, everyone. Welcome to today’s episode of PYA’s The Bottom Line webinar series. Today’s topic is occupational fraud, a risk every organization faces. PYA is happy to present today’s webinar on this important topic. As this event is for CPE credit for live attendees, there are some additional steps that we’ll take in order to comply with NASBA’s requests. In accordance with NASBA, attendees will be provided with three polling questions during this session. Responses are documented electronically. Attendees must respond to all three questions within the allotted time in order to receive CPE credit. At the end of the webinar, a survey will also be provided for live attendees to submit feedback regarding their webinar experience. The polling questions and post-event survey must be submitted for proof of participation today. Credit will only be earned if the session is attended in its entirety. Your CPE certificate is downloadable via the Continuing Education pane once you have completed all the requirements. We’ve posted a PDF copy of the presentation slides in the Resources pane.

Also, you’ll receive an email later today with a link to a copy of the slides and a recording of the webinar. You may submit questions by typing a message into the Q&A pane. Any questions posed during the webinar will be responded to via email after the webinar. You may customize your viewing experience by resizing, moving, or minimizing all of the panes on your webinar dashboard. With that, I would like to introduce our presenters, Jessica Scouten and Michelle Smith.

01:49 – Presenters and webinar objectives

Michelle Smith 01:49

Thanks, Jennifer. My name is Michelle Smith. I’m a CPA and manager here in our Knoxville office in our Strategic and Transaction Solutions service line. I’ve been with PYA and working as a consultant for the last three and a half years, and prior to that, I served as an auditor.

Jessica Scouten 02:04

And good afternoon, I’m Jessica Scouten. I hold a dual role at PYA. I am a principal in our consulting practice, as well as the director of forensic services, which means that I lead our team of forensic accountants. I am a CPA, a certified public accountant, and I have two certifications in fraud and forensics, which is relevant to today’s discussion. I am a certified fraud examiner, and I’m also a master analyst in financial forensics. My practice, I think Michelle and my practice focuses on a variety of forensic accounting matters, including internal investigations for boards and audit committees and management, providing expert witness testimony and then assisting clients with self-disclosures to regulators. And I’m located in our Nashville, Tennessee office. So to kick us off today, here’s the agenda that we want to cover, and I am passionate. I think Michelle is also really passionate about this topic, which hopefully you’ll see come through in the presentation today. It is my opinion that this is a risk, as the presentation title implied.

That’s a risk that every organization faces, and we hope that during today’s presentation, we’re going to be able to answer really four main questions for you. You know, what is occupational fraud? Who commits it? How is it committed? And how is it prevented? When preparing for the presentation, I explained this topic to one of our coworkers who does not work in our forensic services line, and he said, “Are you just trying to scare everybody to think that their coworkers are committing fraud, and it’s really not the purpose. The purpose is just to raise your fraud risk awareness to know what are some red flags that may exist that you should be on the lookout for. After we talk about the fundamentals of occupational fraud, we’re going to talk about the role of a forensic accountant. So if you think that there may be some fraud occurring at your organization, and you’re thinking, “Do I need an outside expert? How do we assist clients in these matters? And then we’ll also talk about the other areas where we serve clients, because occupational fraud and these types of internal investigations are just a fraction of the work that we do as forensic accountants.

And then I also want to say quickly, as a disclaimer, as forensic accountants and CPAs, we are prohibited for saying that something is fraud. That’s really the judge and the jury, the trier of fact to determine that it’s occupational fraud. And so you’ll hear us throughout the presentation today say alleged fraud, because that’s what’s required until you know an individual pleads guilty. He’s found he or she is found guilty in the court. But throughout this presentation, we may say fraud or alleged fraud. Those are used interchangeably for today. And then we’ll also talk about the third area is fraud and artificial intelligence, and this is changing. Day in and day out, this is a really fascinating topic. And in preparing for this presentation just a few days ago, there’s probably latest and greatest breaking news that occurred. So this is what we know now, and it’s going to continue as anything with AI does. It’s going to continue to evolve exponentially within the next few weeks, few days, and few years. And then the last part of the presentation is just giving you some fraud prevention and best practices.

And really, at the end of the day, as I said earlier, our goal is to raise awareness. We want you, as the participants, to be able to walk away with a little bit more professional skepticism, a little bit more tools to look for fraud red flags, and to be equipped to ask those discerning questions. So, for instance, when you are walking out of the parking lot today, if you’re in person and you’re walking out to the parking lot and you look around and you’re saying, “Hmm, that person has a really nice car, as someone said. You know, he’s driving a Porsche, and that doesn’t really reconcile to like his position at the company. Is that a red flag?

Jessica Scouten 05:59

Or when you’re scrolling on social media at the end of the day, and you’re like, “Wow, my coworker thinking about it has taken a lot of really nice vacations, and I generally know I have an idea of what she makes, and it just doesn’t reconcile with what I know her roles at the company and all you know all the other external factors that she has personally with her family. Those are the types of questions that we want you to walk away with being able to ask after today’s presentation. So we’ll just dive right in, and these are the fundamentals.

06:29 – Occupational fraud fundamentals and ACFE resources

If you never attended an occupational fraud presentation, these will be new to you. If you’ve already seen occupational fraud, some of these will hopefully be a good refresher. So, the Association of Certified Fraud Examiners, or ACFE, is a international organization which is the world’s largest anti-fraud organization. Michelle and I are both members of it, and at me as a CFE, I’m required to have membership. It is a really valuable resource.

So if you find anything interesting in today’s presentation, you just want to do a little bit more research, feel free to reach out to Michelle or I, or just go to the ACFE’s website, which is listed here. They have a lot of educational material, which some of it is behind a paid wall, and some of it is free just to the general public because they also want to raise fraud risk awareness. Throughout today’s presentation, we’ll be referencing their 2026 Report to the Nations, and this is a survey that is conducted every other year by the ACFE, and it interviews its members. In the 2026 survey, there were over 2,400 fraud cases reported, and this survey just summarizes that information and provides some really key statistics, and then it benchmarks them over time to say, you know, how has this compared to prior years, and what things are emerging trends. We’ll also maybe reference throughout the presentation their anti-fraud technology benchmark. This is a newer survey that they are starting to create, given all the changes with AI and technology.

So this is another one, and then they have a fraud examiner’s manual that, in a lot of our internal investigations, this is the resource that we rely upon. We reference to think how. What is our work plan going to look like? What are some red flags, and how can we go about testing? So, occupational fraud may be a new concept to several of you. I know PYA is primarily known for our healthcare consulting expertise, and that’s where a lot of our clients are in. Our practice as forensic accountants is a little bit more industry agnostic, and today’s presentation is applicable to any industry in our opinion. The ACFE’s report to the nation is not just healthcare; it is any industry that you can imagine, we haven’t shown specific statistics for healthcare versus manufacturing versus financial institutions, but it’s in their report if you want to go out and look at it. So, occupational fraud is the use of one’s occupation for personal enrichment through the deliberate misuse or application of an organization’s resource or asset.

Really, this is employees who are committing fraud against their employer, and fraud in this context is I look at it as the Black’s Law Dictionary, which is the knowing misrepresentation of the truth or the concealment of fact to induce another to act to his or her detriment, so it’s really intentional. This is a little bit different than if anyone practices in the healthcare area, where it’s you know false claims can be a little bit different. You know, it’s the knowing submitting of a false claim. The fraud that we’re talking about today is the intentional misrepresentation of the truth. And if you’ve ever attended any fraud training like this, the triangle in the bottom right is probably something that you’ve seen before.

10:10 – The fraud triangle: pressure, opportunity, and rationalization

This is you know fraud 101, and it’s called the fraud triangle, and it is the theory that the three elements-financial pressure, opportunity, and rationalization-are typically present for fraud to occur. This is sitting in the seat of the person who commits the fraud, which means that they need to have a financial pressure.

What is causing them to need to have to commit embezzlement, to create a fictitious employ fictitious vendor, to have a ghost employee in payroll.

Jessica Scouten 10:42

What is their financial pressure? And sometimes there’s a lot of different ways that this manifests itself, and we’ll talk about these later. But sometimes it’s a family pressure that they have a need to essentially have extra cash. They may have a divorce. They may have a huge medical expense that has come up unexpectedly. These are typically more, I would say, acute in nature, and something that I think the financial pressure a lot of times after fraud has become apparent, the employees and other people step back and they’re like, “Hmm, that doesn’t make sense. What I now know when I playing, you know, Monday morning quarterback, it looks a lot different than what I had thought. And then there’s also the lifestyle choice. So maybe these, and I keep this as like keeping up with the Joneses that they want to have a big lifestyle, they want to be able to live large, and their compensation just doesn’t support that. So probably one of the most well-known occupational fraud schemes that lifestyle was really an issue was related to Rita Crudwell, and this is a case that I think was revealed over 10 years ago. And again, if you’ve done any fraud training, you’ve probably come across it.

But Rita Crudwell and PYA did not investigate this. This is somebody else, but I think it is fascinating. She was a treasurer of a small town in Dixon, Illinois, and her role was the treasurer, and so she had access to all the bank accounts. And what was revealed is that when it all came to light was that over the span of 20 years, she embezzled $50 million, which was really significant for this small municipality. When it was discovered in 2012, she was about 59 years old, and she had spent nearly her whole career there. Again, she had a lot of trust, which we’ll talk about in a little bit. Trust but verify. She had a lot of trust with the employees, and then the question is, well, how does that tie into her lifestyle? She had a lifestyle. She had purchased over 400 quarter horses, and these weren’t just any quarter horses. These were she had won 52 world championships, and if you know anything about horses, it’s not an inexpensive habit. It’s really hard to maintain, and really expensive for the upkeep. And so, once the fraud came to light, people stood back and they’re like, “Well, I mean, I just thought she had family money, or I thought she had wealth from someplace else.

And that really wasn’t the case. She was able to, what I call, maintain her horse habit by embezzling from her employer to the tune of $50 million. And it’s just a really fascinating case study. And so, if you’re interested at all, there is a documentary called All the Queen’s Horses. And I would just say, if it fascinates you at all, go and check it out. It’s remarkable. But again, looking back, stepping back, she had a lifestyle that just didn’t reconcile with her occupation. Moving on to the next area, which is opportunity, and this is how people, how fraudsters can commit their fraud. What is the opportunity? And this usually is related to internal controls. So there’s either poor oversight, meaning that there’s not good internal controls, or they have excessive authority and they’re able to override those internal controls, this is an area within the fraud triangle that employers and organizations probably have the most control over. You know, we can’t control what’s happening with our fellow coworkers from a financial side or their mentality of how they’re able to rationalize it, but we can help limit their opportunity to commit fraud.

And then the last area is rationalization, and this is how do the people who commit this fraud how do they sleep at night? How can they justify what they’re doing? And so typically this manifests itself in you know they have an entitlement mindset that I have been with the company you know for years. I didn’t get the pay raise that I was should have been entitled to. So I’m going to just you know pad my paycheck a little bit, or I’m not you know I am not as respected as I should be.

Jessica Scouten 14:52

So it’s a lot of times personal rationalization for them individually, but then sometimes it can manifest itself in. That they are quote unquote protecting the business. So, for instance, if they are in accounting and their organization has a debt covenant, and they realize that you know based on the current numbers, they’re not going to meet their debt covenant for the quarter, which could have catastrophic events, or they’re not going to meet their borrowing base, which could have catastrophic impact the business, and so they can see it as they’re protecting the business. They’re going to do some what people refer to it as creative accounting, which is never a good term. But they’re going to do some creative accounting to be able to meet those criteria, and so they see it as like I’m just doing this to protect the business. I’m going to protect my fellow employees to make sure we still have jobs going forward. Again, we just want to throughout this presentation raise the red flag awareness so that if you see anyone that you know has some financial pressure, do they have opportunity?

Because maybe your internal controls are a little bit weak, and then rationalization that may occur. We want you just to be aware, and I think the way that I’ve heard this described before is that pressure answers the question as to why people need the money, opportunity answers how they can do it, and then rationalization is how they sleep at night.

16:17 – Three main types of occupational fraud

Michelle Smith 16:17

So there are three main types of occupational fraud: asset misappropriation, financial statement fraud, and corruption. While these categories are helpful, actual fraud does not fit squarely into one of these categories. Oftentimes, it may overlap. So, starting with asset misappropriation, that’s a scheme in which an employee steals money or misuses the organization’s resources. Financial statement fraud is a scheme in which an employee intentionally causes a misstatement or omission of information on the organization’s financial reports. And lastly, corruption is a scheme in which an employee misuses their influence in a business transaction that violates their duty to their employer, either directly or indirectly to benefit them. So, in the graphic on the right, you can see that asset misappropriation makes up about 90% of all occupational fraud cases, but the median loss is close to $100,000. Corruption falls right in the middle at about 45% of those cases, with a median loss of $150,000, and financial statement fraud makes up about 6% of those cases. However, the median loss is much greater, at about a million dollars.

So, moving on, we’re going to talk about three case studies over the course of today’s webinar. As part of these case studies, we’re going to talk about red flags and corrective action, and some of the characteristics of each of these perpetrators. And we’ll talk about this later on in the webinar, where we’ll go through what the characteristics of a fraudster are. So we’ll give you some information now, but it will become a little bit relevant, a little bit more relevant later.

18:02 – Case study 1: shell company and control weaknesses

So, in our first case study, we have a not-for-profit entity. We were called in after there was already an allegation of fraud, and this involved the organization’s controller. What we learned when we were called in was that there was a shell company set up. So, this controller was responsible for bidding jobs, obtaining subcontractors, obtaining the quote, submitting the purchase order to the organization, and or submitting the invoice to the organization, and then getting that purchase order issued for payment. What we learned was that the controller actually set up a shell company.

So let’s say he put out a bid to Concrete Company, and the original quote that was provided back by Concrete Company was to the tune of $10,000. And when that work was done and the invoice came in to the organization, the invoice. There were two things wrong with the invoice. One of which was that the price was now $15,000, and the invoice was from Construction Company rather than Concrete Company. We learned that Construction Company was actually the shell company in the name of the controller and tied directly to the controller’s bank account. The reason that this was able to take place was that the controller had been there for eight years? He grew up in the company. He did a work study there and then went full time. So he had been there for eight years. He was well trusted, and he knew the controls. He knew how to circumvent the controls. He knew who the approver was along the process, and so this individual waited until that approver for this process, was out on vacation and went to their backup. The problem was that the backup was not as familiar with the vendor list or the original quote.

So, in that approval process, it did not indicate any red flags when the invoice came in. It was just approved and sent on its own. So the damages to the not-for-profit entity were $5,000. As part of our investigation, we actually got to interview this individual. He was very apologetic, and he actually paid the $5,000 back. It’s rare one that we get to interview the perpetrator, and two, in cases where the outcome is prosecution, the government does not care if the money is paid back if the crime has already been committed. Some of the red flags that we identified as part of this investigation was one lifestyle. This controller had a new baby, had just purchased a new vehicle, and had a few property acquisitions in the years leading up to this one-time fraud instance. Looking back on it, we can see yes, there were some financial pressures, and two, there was a clear conflict of interest. This individual set up a shell company and was contracting with his employer’s organization with his shell company.

Michelle Smith 20:54

As part of our investigation, we recommended some corrective actions, so segregation of duties, further segregating those duties and preventing future breaches of control. We recommended an internal controls assessment to identify any other weaknesses that may be within the organization, and lastly, an implementation of an automated approval workflow. All of the approvals were on paper, and so by implementing an automated approval workflow that could document when and who, and leave a paper trail of when and where these approvals took place. Because of his position as the controller, the organization’s trust was completely eroded, and so the outcome was that this individual was ultimately terminated. We did examine for additional shell companies, and we were not able to identify any. So we concluded that this was a one-time instance. The key takeaway is that the significance of this fraud event should not be evaluated solely by the amount of the loss, which was $5,000. This event actually exposed some broader control weaknesses that could have allowed for a more substantial scheme to occur in the future. And that brings us to our first polling question.

PYA Moderator 22:19

Our first question is, when fraud occurs, which red flag do you believe is most often overlooked? Behavioral changes, control weaknesses, lack of segregation of duties, excessive management influence, or data anomalies. Remember, you must respond to the polling questions to receive CPE credit. You will have 30 seconds to answer.

Jessica Scouten 22:49

I can see that a lot of people. There’s a common theme in the answers, which I don’t think is surprising to us. So I see we’re still having some people responding.

PYA Moderator 23:02

All right. Thank you for participating in our poll. Back to the presenters.

Jessica Scouten 23:08

So, what we see in, and I’m not sure if you can see the results of this poll or not, but the most common response was behavior changes at 43 percent of the respondents, and I would tend to agree with that. I think it’s you know it’s similar to the case of you know Rita Crudwell as her role. You know it just slowly happened over time. People just assumed that she had other sources of income, and I think behavioral changes are one of the most common ones. What do you think, Michelle?

Michelle Smith 23:40

Yeah, I agree. I think between behavioral changes and excessive management influence, if you’re sitting next to this person or reporting to this person day in and day out, those changes are harder to identify and call out. Rather than control weaknesses, segregation of duties, and data anomalies, those are often easier to identify.

24:07 – Fraud myths, organization size, and trusted employees

Jessica Scouten 24:07

Now we want to talk about some fraud myths versus reality, and these are myths that you know we hear anecdotally when talking to clients or just generally speaking. So the first myth is fraud can only happen at large organizations. The reality and why we’re doing this presentation today is that fraud can happen at every organization. Every organization is vulnerable. In the graphic to the right, which again this comes from the Report to the Nations, you can see that employees, companies with employees that had less than 100 Employees, the average loss due to fraud was 126,000. If you look at the bottom chart, there are this is a category of over 10,000 employees, and the really the amount of the fraud loss is only $3,000 difference at 123,000. So. Regardless, if there’s 100 employees or 10,000 employees, it’s really the fraud was amount the same, and so I think that’s important to notice that, generally speaking, an organization with 100 or 10,000 employees is probably significantly larger financially, and so 123,000 is less material than it would be to an organization with just 100 employees, and so probably it has a greater financial impact to that smaller organization.

Smaller organizations generally also have less resources. There can be challenges in properly segregating duties to make sure that the proper checks and controls are in place. I will say that I think that there is it can be done. It may require more management oversight than if you have a large organization where it’s easy to segregate duties, and then also large organizations have more resources in terms of training hotlines. They have more. They may have an internal audit function that is, you know, has the perception that they may be looking at all the transactions. So it can happen to any organization, regardless of the size. The second common fraud myth is trusted employees are low risk, and that is 100% not the case. Many fraudsters are the most long tenured trusted individuals. You know, as we always say, trust but verify. That’s what we. I mean, we say that trust is not a control is also one of our key catchphrases. So there’s this graphic I think really illustrates that, and this looks at the profile or the demographics of the people in the survey who have committed the fraud. So starting in the top left, the tenure. Most fraudsters had worked at the business.

Those who had worked over 10 plus years, the average loss was 200,000. It was the greatest loss. And when you think about it, it really makes sense. They know how the business works. They know the gaps. They know where, when someone’s out on vacation, they can easily circumvent the control. They know where the incompatible duties are. They are also probably the most trusted because they’ve been there the longest. Then moving down to education, more than 60% of the people who committed fraud had a college degree or higher. They were really smart. They were educated people. They, again, similar to tenure, they knew where the holes were, and they could see here’s how they could circumvent the controls. Moving on to gender, and this is one I think has remained unchanged. But generally speaking, men are more likely to commit fraud than females. In the study, 71% of the cases were men that were the perpetrators, and just 28% were females. And then the bottom right about age. So the people in the age of 31 to 50 were two thirds more likely to have committed the fraud than someone less than 31 and someone then older than 50. The loss was 117,000. So not the greatest median loss.

That’s really for the people who are 50 plus, probably because they’re executive positions. But it was the greatest number of occurrence. And when you think about it, these are people who are in their middle season of life. They have financial pressures potentially with their children, whether they’re in private school, private colleges. They may have financial pressure because they have aging parents that they’re helping to support as well. They also-they’ve been in their careers for a long time, and excuse me-and they just have you know keeping up with the Joneses mentality. So these are just the profiles of a typical fraudster.

Jessica Scouten 29:01

Sometimes when I’ve given this presentation before, and generally they put the fraud presentation right after lunch, which is always the greatest time to go. I know that’s generally when we’re at right now. I have everyone stand up, and I go through and I say, “Okay, if you’ve been at the company less than 10 years, sit down. And I have everyone sit down slowly but slowly. And the only people that are left standing are the people that fit this demographic. It’s a little bit awkward for the people who are left standing. Don’t get me wrong, but I think it really sends home the message that, generally speaking, and based on all the survey data, these are the people who you probably trust the most, but are most likely to commit the fraud. So

29:43 – Tips, audits, reporting channels, and control culture

Michelle Smith 29:43

our third myth today is that audits will catch fraud. The reality is that tips are the most common detection method. Audits certainly play an important role in financial reporting, but the ACFE consistently reports that tips are the most common method of fraud. And you’ll see in the graphic on the right that in the 2026 study, tips made up about 43% of how occupational fraud is initially detected. So what’s unique is that as part of those tips, you can see about 90% of those tips are made up of employees, customers, and anonymous, that highlights the importance of creating an environment in which employees and other stakeholders feel comfortable raising those concerns. The ACFE report also notes that tips can come in via phone, web form, email, text message, and so we all know about the fraud reporting hotline. But what’s interesting is that in more recent years, web-based forms and emails have become increasingly popular, and that telephone hotline has decreased. One thing to call out too is that in two of the three of our case studies that we’re going to go over today, there were audits that ultimately did not detect the fraud that occurred. So, the tips are the most important.

And so, the question for leadership is simply not whether your organization has a reporting mechanism, and while that hotline or that web form is important, but do your employees know about it, and do they trust the process? Audits are one component of that fraud risk management, but they need to be supported by those strong reporting Channels, and that leads us into our fourth myth: strong controls eliminate fraud. The reality is that controls reduce risk, but the culture matters too. You can see in the graphic on the left that the primary internal control weaknesses contribute to occupational fraud. So between the lack of internal controls and the override of existing controls, that makes up about 50% of what’s contributing to occupational fraud. Those controls are critical, but they’re only one part of the equation. It does not eliminate risk. Again, in three of three of our case studies today, there were some form of controls. That doesn’t mean that those controls weren’t circumvented, and the fraud still occurred. Effective fraud prevention requires not only sound controls but strong governance, oversight, and the leadership commitment to ethical behavior.

Your employees are looking to you and how your leadership behaves. Are your policies consistently applied, and how does your organization respond when a concern is raised?

32:31 – Behavioral and organizational red flags

Jessica Scouten 32:31

So we previously talked about the typical profile of a fraudster, and now we’re going to turn to more of the red flags that you need to be on the lookout for. So on the left-hand side of the screen is behavioral indicators, and these are behaviors that person who is committing fraud may exhibit. So the very top line is 40% So 40% of the cases in the study said that people were living beyond their means. This is the Rita Crudwell of the world that have a huge lifestyle that when you try to reconcile it to their compensation, it just doesn’t make sense. This could be in the form of houses, it could be in the form of boats, it could be in the form of cars, it could be in the form of vacations. Anything that seems I say this is the elaborate one. Anything that seems over the top that you’re like, how are they doing that? I just don’t understand how they’re able to do all these fun, really flashy things. That is what I would say: living beyond their means. The second most common behavior that’s exhibited is financial difficulties, and this is, you know, is there a divorce that has occurred? Is there gambling losses.

So, for instance, do you have a coworker that always goes to Vegas or the nearest casino in his or her free time, and they’re like, “Oh, such a hard weekend, you know, I didn’t fare well at the slot machines or whatever their you know whatever their gambling choice may be, you know, that could be gambling habits are really expensive. You know, does one spouse potentially, if they’re if they have been a dual working household, does one spouse decide to stay at home until they go from two incomes to one income? That could impact. You know, could cause some financial difficulties. Do they also have large medical expenses? Have there been a catastrophic illness, cancer, car accident, something like that in their life that has caused you know increased financial pressure. That it was evident in about 30% of the cases. Then the next most common one is an unusually close relationship with a vendor, meaning that there’s some kind of collusion, which implies that an employee has worked with a vendor or outside third party to commit a fraud against the organization.

Interestingly, in the first case study that Michelle talked about, where the controller had the Construction Company and the ultimate vendor was a Concrete Company, there was actually no relationship between. Controller and the Concrete Company. It was just the controller we believe saw the opportunity to mark up, you know, the Concrete Company’s invoice, and that it was passed through to his employee. So there’s sometimes evidence of collusion or working with outside parties, but not always the case. And then the fourth one, which is 16% is the most terrifying to me, and I think should be to all of you as well. Is that there were no behavioral red flags. Nothing seemed out of the ordinary. It was just the person was as even keeled. Nothing had changed. They were just day in and day out, and that’s really quite candidly the hardest to detect or hardest to see because you can’t see anything, and there’s a couple more you know down on the list that you can look at as well. But then moving on to the organizational environment, and this is sort of HR red flags. These are job related conditions that may have been a factor in the person’s decision to commit fraud.

So 12% of the cases was a poor performance review, and I think you know, in my opinion, and in the research that I’ve done, is how the employee justifies this, how they rationalize it. If you go back to the fraud triangle, is they can say to themselves, “I’ve done so much for this company. I have been a longstanding employee. I have done well beyond you know, my other colleagues, I can’t believe I’m getting a poor performance review. I should be paid more, and they figure out a way to pay themselves more. That’s 12% of the cases. Another 12% is a fear of job loss, meaning that they’re worried that they may be terminated for a variety of reasons.

Jessica Scouten 36:37

One could be and how they’re able to rationalize it if they think it’s going to be you know a termination or RIF of just their employee of just their position is you know I’ve given this is what they’re telling themselves I’ve given 20 years to this company if they’re going to fire me I’m going to take a little bit more before they let me go and they’re able to justify it that way but it also can be the fear of a job loss for several people in the organization, if there’s you know financial difficulties of the company, so they can rationalize it. Again, this is more of what I would say: cooking the books or financial statement fraud. You know, they can say we’re gonna fail our borrowing base, and we’re not gonna get any more money on our credit line. And if we don’t get money on our credit line, we can’t make payroll. And if we can’t make payroll, all our employees are going to be-they’re going to lose their jobs, and so that’s how they’re able to sometimes rationalize misstating financial statements. And I think it’s an important thing to consider. And Michelle and I, as forensic accountants, always think about this.

It’s not just a single red flag; it is really the clustering of red flags when there are several things. You know, somebody 31 to 50 male has been there 10 years. They’re living beyond their means, and they have you know some financial difficulties as well. When you have that clustering, that’s what you need to pay attention to. In forensic accounting, we look for patterns of behavior, and so these patterns or these clusterings is really important to us when we go in to conduct a fraud investigation.

38:07 – Case study 2: HRA reimbursement scheme

Moving on to our second case study, and as Michelle indicated in the first one, that we were brought in to investigate the fraud to see if there was actually any evidence that the allegation held true. In this case study, we were brought in after the fact. So here we were trying to quantify or respond to a regulator’s inquiry. So a regulator had come forth to our client, which was a private organization, and they said, “We are aware that one of your employees has been embezzling from the organization. We want to make sure you need to tell us as the regulator.

You need to tell us that there is this is an isolated incident to just this one employee, and that what we’ve identified and quantified, which was about half a million dollars, is all the fraud that has been committed. And so that was the premise that we walked into this organization. What we learned is that this employee was a customer service representative, and she was responsible for managing the company’s HRA account, so health reimbursement account. So what happened, or what was supposed to happen, is an employee would have a medical expense, a qualifying medical expense, and they would submit for reimbursement to her through an online platform to say, here’s my medical expense, I need to be reimbursed, and then she would issue funds to those individual employees as reimbursement. An HRA is a little bit different than a health savings account. Health savings account, you take it with you when you leave the company, and HRA stays with the company. So what had happened is that there were employees who had left the company and still had balances in their HRA accounts. What was supposed to happen?

It was supposed to go back to the general fund, if you will, to fund other employees, but it stayed in their accounts, which were effectively dormant. They couldn’t access them after they left the organization, and so what she realized is that there was an opportunity for her to go in and to rather than reimburse individuals, she reimbursed herself, and reimburses a very loose term. She disbursed money to herself, not for qualifying medical expenses that we found, and she did this over 330 times to equate half a million dollars, and these 330 times occurred over eight years. So those are pretty small dollar amounts in the grand scheme of things. It wasn’t you know one time. As a course of our investigation, one of the things that we wanted to look at was like how did this happen?

Jessica Scouten 40:56

What went wrong? And what we found in looking at the data, is we found that these over 330 times occurred Monday through Friday, eight to five, which was a little bit surprising to us. You know, if any of you were auditors or when I began my career as an auditor, we would always do journal entry testing, right, to look for unusual transactions, and we’d look for ones that were nights or weekends or holidays or something like that. So when we got the data and we saw that all of these 300 transactions occurred Monday through Friday, eight to five, that told us that she had zero concern that her fraud was ever going to be detected. She did it under everyone’s nose with no threat, which meant that there was not good tone at the top, that there were not proper controls in place. The other thing, which was really interesting in this case, is the account where she was writing these reimbursements or embezzling from all the employees’ accounts.

It went to a bank account, which was the same bank account at the same bank where her payroll check was deposited, and this also was evident to us that she had no perception that she was ever going to get detected for this, because we’ve been involved in other cases. In our third case study, we’ll touch on this, where it is, you know, it’s a little bit of money laundering, if you will. It goes from you know one account to another account to another account, and we have to trace it sometimes through four or five accounts to really get to where it ultimately comes to the employees’ accounts, but again, she sent it directly to herself without any indication she was ever going to get caught. Her red flags again: we never got to interview her. We were coming in after the fact. She had already been terminated by the time that we were engaged, but we understand that she had a lot of control issues. She never wanted anybody else to do her job. She never wanted anyone else to look over her shoulder. Hmm. I wonder why. But that was really her red flags.

And then, sort of the corrective action that the company took is that they set up segregation of duties to really make sure that the person who was issuing reimbursements did not have access to perform customer maintenance or you know employee maintenance on those accounts to change the bank account from an employee account to her account, that there were some verification, and when those you know maintenances were performed, that somebody was reviewing them to make sure that they were appropriate. So, if any of these red flags are resonating with you, and you think, “Oh, I might need a forensic accountant to come in. This is an area that Michelle and I focus on, and Michelle’s going to just talk a little bit about forensic accounting. And you know, this occupational fraud that we’re talking about here is just a fraction of what we do, but we wanted to give you a sense. And we find just generally that audiences are really interested in our case studies and war stories.

43:47 – Role of a forensic accountant

Michelle Smith 43:47

Thanks, Jessica. So, what is the role of a forensic accountant? Forensic accountants solve financial problems in dispute, investigation, and risk situations. It’s really a blend of accounting, investigation, and communication, and I’ll emphasize communication because while our objective is to analyze those complex financial issues carefully, it’s also important that we communicate those findings in a way that both decision makers and the trier of fact can understand and use, and so we can support organizations, attorneys, boards, and regulators as part of our analysis, as Jessica mentioned, fraud investigations are only one piece of our profession. We can support shareholder disputes, transaction analysis, economic damages, and regulatory matters. But one overarching theme is that our investigations focus on evidence and not assumptions. So we will never begin with an assumption that fraud has occurred, and we also won’t make any legal determinations about guilt or innocence. We won’t issue any opinions because those are for the trier of fact, such as a judge or a jury, or in certain situations where we’re supporting an organization or a board to make a decision.

We provide all the facts and the evidence, and leave the decision making up to that organization. And lastly, we’re not auditors. We don’t issue opinions or assertions related to financial statements. We certainly review financial statements and audited financial statements as part of our investigation, but we are not the ones issuing those opinions.

45:18 – Case study 3: sophisticated shell-company scheme

And that brings us to our third and final case study today. So, this one is similar to case study number one in that there was a shell company, and that’s where the similarities end. This was related to a large publicly traded organization, and the alleged fraud here was $14 million over the course of four years. I call that out first and foremost because this was a very sophisticated scheme. In this case, there was a shell company set up by the assistant treasurer. The assistant treasurer had been there for eight years. He knew what controls were in place. He knew what vendors were on the vendor list. He knew the patterns of transactions, and what was often flowing through the GL. He took advantage of this in a way that his shell company was set up and named very similarly to another vendor that often had transactions flowing through.

So let’s say that the regular entity that the organization did business with was called Health Claims. The assistant treasurer set up an entity called Claims Health, and so every so often, rather than that transaction going to Health Claims, he would submit a transaction for approval that went to Claims Health. We were called in after this alleged fraud had been identified. We were called in to quantify the amount and confirm that, yes, it was $14 million, and trace the flow of funds through the accounts. We were called in under the assumption that there were about 15 bank accounts that this money was moving through. Once we concluded our analysis, we determined that there were actually about 30 different bank accounts that these funds were moving through. So again, highly sophisticated. If you look at the graphic on the left, you’ll see he was a male. His tenure was eight years. He had he was in his mid 40s, and so all very consistent with what that profile of a fraudster would be. Over the course of our investigation, we identified some lifestyle red flags. He had children that were nearing college age, and his wife did not work, so that created some financial pressures.

And then the obvious conflict of interest with that vendor relationship. A recommended corrective action here would be a review of vendors and services provided. Given that sometimes, especially in these more sophisticated situations, it’s difficult to identify if the organization only confirms that the vendor exists without evaluating the substance of the relationship or the services being provided. So it’s important to regularly review your vendor list and what services that they are providing. So, although the scale here is very different from the first case, both matters demonstrate how control weaknesses can create those opportunities for fraud. And that brings us to our second polling question.

PYA Moderator 48:20

All right. Our second question is: Which of the following poses the greatest fraud risk? Trusted, long-tenured employees with broad access, weak segregation of duties, management override of controls, vendor and third-party relationships, or emerging schemes including AI-enabled fraud. Remember, you must respond to the polling questions to receive CPE credit. You will have 30 seconds to answer. Thank you for participating in our polls. Back to the presenters.

Jessica Scouten 48:56

Sorry, I was muted. Apologies for that. So the polls show that about 64% of you think that trusted, long-tenured employees with broad access are the greatest fraud risk, and I think that is probably true in what we see in our practice. So moving on, I know that we are coming up. We have about 10 minutes left. We want to make sure we cover the AI emerging trends. So Michelle, if you want to go to that area next?

49:25 – Fraud and artificial intelligence

Michelle Smith 49:25

Yep. So we’ll jump right into trends in fraud and artificial intelligence. So we know that, and we’ve heard in the news that AI is enabling fraud. It’s creating convincing scams and impersonations. It’s generating fake documents such as the form of faulty receipts related to employee expense reimbursements, fake vendor contracts, and then fake employee documents that could be used in a payroll scheme, and it’s also increasing the speed and scale of fraud with those automated processes. On the flip side, AI can help detect fraud, so it can detect unusual transactions and patterns, identify phishing and scam activity, support risk monitoring and investigations, and then lastly, it can help analyze unstructured data. Unstructured data again is a large amount of unorganized data, often generated and output by a system such as payroll or vendor expenses, and so while AI has created both new fraud risks, there’s also new detection capabilities, and it’s always a bit in a bit of a cat and mouse game when you’re trying to detect fraud.

And so AI, what we’ve seen is that it’s enabling folks to transition from a reactive detection to a proactive detection method and monitor for data anomalies. And so, one important thing to note, though, is that AI does not have the business context. So, oftentimes, if an anomaly is detected, it’s not actually fraudulent. For example, if you have pumpkin spice lattes in September and October, and that is the busiest time of the year for you. Then your revenue is going to spike in the fall. That’s going to show up as an anomaly. But what it’s not going to be is fraudulent. That’s just going to be your business use case. And so, while this technology can help us focus our attention, at the end of the day, a person has to evaluate those underlying facts, documentation, and the business purpose. This graphic is from the 2026 ACFE Anti-Fraud Technology Benchmarking Report. One thing to call out is that this is based on survey data that was completed in October 25, and so the percentages here, if we did the survey tomorrow, would likely look different. But what this slide does is highlight the growing use of generative AI in both fraud schemes and anti-fraud programs.

A reminder of what generative AI is: that’s the type of AI that we see now in ChatGPT and Copilot, where we’re putting information into a tool and it’s generating a response based on all of the data that’s been provided to it. So what we can see is only 7% of organizations are consider themselves to be more than moderately prepared to detect or to prevent AI-powered fraud. And over the last two years, some of the schemes that have been increasing the most is deepfake social engineering, and what that is, in simple terms, is AI-generated content used to trick people into authorizing payments or sharing sensitive information. Then there’s the consumer fraud scam and scams. There’s generative AI document fraud and forgery that we’ve already talked about related to those fake receipts and faulty vendor contracts, and then lastly the deepfake digital injection, similar to social engineering, except deepfake digital injection is using AI content to trick a system. So think about your dual factor authentication. Deepfake digital injection may be used to circumvent that.

So on the right part of this graphic, you’ll see that approximately 26% of folks do not expect to use generative AI and anti-fraud programs. 16% currently use, and 58% plan to use in the future. I would anticipate again if we did the survey tomorrow that this would look a lot different. So the broader takeaway is that organizations should not rely on the apparent authenticity of a voice, image, video, or document. We still have to perform those verification procedures, and they have to evolve just as fast as technology is evolving, and so while the technology is changing, our response is going to be the same. We need to understand the risk. We need to strengthen our verification procedures. We need to make sure that our employees know when and how to question that unusual request.

54:06 – Case study comparison and closing takeaways

Jessica Scouten 54:06

Thanks, Michelle. And I know that we have five minutes left, so I just want to flip ahead. You will have the slide deck either available now to you, or it’ll be distributed after the presentation. But I just want to go through sort of our wrap-up slide before we open up our last polling question. So this is really our case study comparison. You know, we have investigated a lot of different cases. We sort of cherry picked these one for today’s presentation just to give you sort of different senses of the case. So we had a $5,000 case to a $14 million cases, and we’ve had a little bit of anything more north of 14 million, and then everywhere in between. I think when we step back and look at the data, and as forensic accountants, we look at the data and we tell a story. So, what does the story that these three cases tell us? Every single fraud is different. It spans every age, every role, every tenure, and really, it can happen at any organization. For me, one of the most important takeaways is what is highlighted at the very bottom and what is the outcome. In our first case, the employee was just terminated.

In the second two cases, they were both prosecuted, and so a lot of times, I think the statistics show it’s in one of the ACFE graphs that most employers don’t prosecute. There is some definite risk associated with prosecuting that to make sure to that make this to become very public. However, the challenge with termination is that this employee left, you know, this nonprofit, and I would highly likely guarantee that he is someplace else right now, potentially doing a very similar scheme. There is nothing. There’s no background check. No nothing like that. That is going to detect this that this fraud allegedly had occurred and that he was terminated. So just keep that in the back of your mind for new employees that come to the company that you know immediately on start to exhibit some of these red flags. And with that, I think we’re going to go to our last polling question.

56:06 – Reassessing internal controls

PYA Moderator 56:06

All right. Our third and final question is: Which anti-fraud measure do you believe is most effective? Strong internal controls, management oversight, employee training, anonymous reporting hotline, or data analytics and monitoring. Remember, you must respond to the polling questions to receive CPE credit. You will have 30 seconds to answer. All right, thank you for participating in our poll. Back to the presenters.

Jessica Scouten 56:39

So it is interesting here that strong internal controls. You know, 64% of the cases people think are the most effective. I would agree with that. I think it’s the thing to consider is not only strong internal controls as a point of time, but how do they change? Have you had a you know have you had a restructuring of the department? Have you had a tuck in of a new business line or a divestor, and so reassessing what once were really strong internal controls to how they’ve evolved and changed over time is important. And then also the backup. You know, in our first case study, the person who was part of the internal control structure was on a vacation, and the backup just wasn’t really as aware of the risk, and so thinking about those, you know, those times when the backup is put in that control structure, are they aware of the risk as well? And with that, I will turn it back over to our host.

57:38 – Closing remarks

PYA Moderator 57:38

All right, thanks very much to our presenters Jessica and Michelle. Later today, you’ll receive an email with a link to their contact information and a recording of the webinar. Also, the slides and recordings for every episode of PYA’s The Bottom Line series are available in the Thought Leadership section of PYA’s website, pyapc.com. While at our website, you may register for other PYA webinars, subscribe to receive PYA insights, and learn more about the full range of services offered by PYA. Please remember to stay on the line once the webinar disconnects to post any additional questions and complete the short survey for CPE credit. Once complete, your CPE certificate is downloadable via the CPE pane. On behalf of PYA, thank you for joining us. Have a great rest of your day.