Most organizations that experience occupational fraud had controls in place when it happened. The controls existed — they just weren't working. According to the ACFE's 2024 Report to the Nations, the median fraud case runs for 12 months before detection and costs $145,000. Across the economy, fraud drains an estimated 5% of annual revenue — roughly $8,300 every day for a mid-size business turning $60 million.
The control failures behind those numbers aren't random. They cluster around predictable patterns: controls that were never tested, processes where one person held too much authority, and review mechanisms that covered a fraction of actual transaction volume. Understanding these patterns — and mapping the right controls to the right processes — is where fraud prevention moves from theory to practice.
Why internal controls are your first line of defense against fraud
Criminologist Donald Cressey identified three conditions that must coincide for fraud to occur: opportunity, pressure, and rationalization. A later refinement — the fraud diamond, developed by David Wolfe and Dana Hermanson — added a fourth: capability, meaning the access and skills to actually execute the scheme.
Of these four factors, opportunity is the only one an organization can engineer away. Pressure and rationalization live inside the minds of individuals. Controls can't reach them. But a control environment that removes unmonitored access, enforces dual review, and tests transactions at scale directly eliminates the precondition that makes most fraud possible.
Organizations with strong anti-fraud programs don't just catch fraud faster — the ACFE finds their losses run 50% lower than organizations with weak or absent controls. That's the deterrence effect: when fraud is hard to commit without detection, fewer people attempt it.
The three types of internal controls for fraud prevention
No single control type stops all fraud. The three categories — preventive, detective, and corrective — each address a different point in the fraud lifecycle, and effective programs stack them deliberately.
Preventive controls
Preventive controls work by making fraud structurally difficult before a transaction clears. The most impactful examples:
- Segregation of duties (SoD) — separating the ability to initiate, approve, and record transactions so no single employee controls a complete cycle
- Authorization thresholds — tiered approval requirements that escalate high-value transactions to additional signatories
- System access restrictions — limiting who can create vendors, post journal entries, or release payments at the ERP level
- Purchase order (PO) requirements — blocking invoice processing without a matched, pre-approved PO
- Dual authorization for payments — requiring two independent approvals above defined amounts
The limitation of preventive controls is structural: they assume the people applying them are acting in good faith. A manager with override authority can bypass them. Two employees working together can circumvent SoD by coordinating their actions — no control design prevents collusion among determined participants.
Detective controls
Detective controls don't stop fraud at the gate — they identify it after the fact and shorten the window it operates in. Account reconciliations, duplicate payment reviews, exception reports, anomaly monitoring, and whistleblower hotlines all belong here.
The ACFE data on detection methods is instructive. Tips — from employees, customers, or vendors — remain the most common initial discovery mechanism, accounting for over 40% of identified cases. But organizations running proactive data monitoring detect fraud in roughly half the time of those waiting on tips. The difference is systematic coverage: analytics find what no one thought to report.
Corrective controls
Corrective controls handle the aftermath: investigation protocols, disciplinary procedures, process redesign, and remediation plans that close the gap the fraud exploited. They're essential for limiting damage and preventing recurrence — but they operate after the loss has occurred. Strong preventive and detective controls reduce how much corrective action is ever needed.
The 4 anti-fraud controls that reduce losses by 50% or more
The ACFE's 2024 Report to the Nations identifies four controls that consistently correlate with fraud losses and detection times at least 50% lower than organizations without them.
Internal audit function
An active internal audit function changes the risk calculus for potential fraudsters — not because auditors catch everything, but because the threat of independent, ongoing testing raises the perceived probability of discovery. More concretely, internal auditors test whether controls are operating as designed, distinct from whether they are documented. That distinction matters: a three-way match requirement written into policy but never enforced is invisible to a documentation review and visible only to transaction-level testing.
Management review
Structured, regular review of financial data and exception reports by managers who understand their own processes catches patterns that automated systems often miss. A purchasing manager who knows her team processes around 200 invoices per month will notice 400 - regardless of whether an automated rule fired. Contextual knowledge is the asset management review brings that no algorithm replicates.
Code of conduct and ethics program
The deterrence value of a code of conduct comes primarily from its enforcement record, not its existence. An organization that visibly investigates and acts on violations signals that reporting has consequences. One that publishes a code and ignores complaints signals the opposite. Anonymous reporting mechanisms — paired with documented, consistent follow-through - are what give codes operational weight.
Management certification of financial statements
Formal certification under SOX Sections 302 and 906 requires executives to personally attest that reported data is accurate and that controls are effective. For public companies this is mandatory; for others it's a structural deterrent worth adopting voluntarily. The effect is accountability: a certification that turns out to be false isn't an administrative shortcoming - it's a personal legal exposure.
Key internal controls mapped to financial processes
Generic control frameworks - segregation of duties, authorization, reconciliation - cover the fundamentals. The more useful frame is process-specific: which fraud schemes appear in which processes, and which controls directly counter them.
Before mapping by process, one cross-cutting risk deserves attention. Vendor master data is the entry point for some of the highest-value schemes regardless of process: ghost vendors, duplicate supplier records, and unauthorized bank detail changes. Segregating vendor creation rights from payment authorization, logging every change with an approval trail, and running periodic duplicate detection on bank account numbers and tax IDs protects every downstream process. The accounting and internal controls article covers vendor master governance in depth.
Procure-to-pay (P2P)
Top fraud risks: ghost vendors, duplicate invoices, kickbacks, unauthorized bank detail changes.
Key controls:
- Three-way matching - PO, goods receipt, and invoice aligned before payment releases
- Independent dual approval for new vendor onboarding
- Bank detail change verification through a callback or written confirmation independent of the requestor
- Full-population duplicate invoice detection - not periodic sampling, but every invoice, every cycle
Order-to-cash (O2C)
Top fraud risks: revenue skimming, fictitious credits, unauthorized discount manipulation.
Key controls:
- Segregation between the billing function and cash application
- Independent authorization thresholds for credit notes
- Exception-based review of discount approvals outside policy parameters
- Accounts receivable aging reconciliation performed by someone outside the billing team
Record-to-report (R2R)
Top fraud risks: journal entry manipulation, improper period-end adjustments, revenue recognition timing schemes.
Key controls:
- Mandatory documented rationale attached to manual journal entries
- Posting restrictions on high-sensitivity accounts by user role
- Monitoring for entries posted outside business hours, on weekends, or by users whose role doesn't ordinarily touch the affected account
That last point is more diagnostic than most practitioners realize. Legitimate accounting follows business hours. A pattern of significant journal entries posted on Saturday nights before a quarter close - especially by senior finance staff - is a behavioral signal worth investigating before the numbers are accepted.
Travel & expenses (T&E)
Top fraud risks: duplicate claims, split transactions, inflated or personal expenses coded as business.
Key controls:
- Approval workflows with supervisor sign-off above defined thresholds
- Cross-claim duplicate detection across the full expense population
- Split transaction flagging - multiple claims just below the receipt requirement from the same submitter on the same date
- Mileage and per diem validation against policy rates
Treasury
Top fraud risks: unauthorized wire transfers, fraudulent bank account substitution, business email compromise.
Key controls:
- Dual authorization for outbound wires, verified independently of the payment initiator
- Bank reconciliation assigned to someone with no payment initiation rights
- Pre-approved vendor payment method restrictions - no ad hoc wire to a new account without a verified change process
- Callback verification for any payment instruction received by email
Why internal controls for fraud prevention fail
Management override
When the person with override authority is the one committing the fraud, no preventive control stops them. The schemes behind Enron, WorldCom, and HealthSouth share a common mechanism: senior management used their authority to suppress or bypass the controls designed to catch them. Subordinates were pressured not to question, and documentation was manipulated after the fact.
The only reliable countermeasures are detective controls and oversight structures that don't report through the same management chain - independent internal audit, active audit committees, and transaction-level analytics that surface anomalies regardless of who authorized them.
Collusion
SoD fails when two people agree to split and cover for each other. A vendor master administrator and a payment approver working together can create a ghost vendor and process payments to it, with each step appearing independently authorized. No single transaction triggers a flag; the scheme is visible only in the pattern across many.
This is why behavioral and relational analysis matters alongside individual transaction controls. A new vendor created by employee A and approved exclusively by employee B, across 30 payments over six months, is a pattern the data exposes - even when each individual transaction passed its control check.
AI-enabled fraud that outpaces traditional controls
AI-generated fake invoices now replicate authentic vendor templates with matching tax IDs, formatting, and payment terms. Deepfake audio and video have been used to impersonate executives in payment authorization requests — including a 2024 case where a Hong Kong finance employee transferred $25 million after a fraudulent video conference call. Synthetic vendor identities can be constructed with consistent addresses, registration numbers, and transaction histories.
Controls built for human-scale deception - document review, verbal callbacks, visual inspection — cannot reliably detect AI-generated forgeries. What they can detect is statistical irregularity: a new vendor onboarded and paid within the same week, a bank account receiving payments from multiple unrelated companies, an invoice total that appears in Benford's Law-inconsistent distributions. AI-powered analytics catch these patterns precisely because they analyze behavior across the full transaction population, not document appearance.
Building an anti-fraud control environment: where to start
Step 1 - Conduct a fraud risk assessment
Before deploying controls, map the terrain. Identify the processes with the highest fraud exposure, document the specific schemes that could occur in each, and assess what controls currently exist - and whether they're actually being tested. A simple risk matrix plotting likelihood against potential impact shows where to concentrate effort first and where existing controls are adequate.
Step 2 - Strengthen the highest-impact preventive controls first
SoD, authorization thresholds, and system access restrictions are the structural foundation of any anti-fraud program. They're also relatively inexpensive to implement compared to detection technology. Getting these right - ensuring no single employee can initiate and approve their own transactions, that payment limits are enforced at the system level, and that vendor master access is genuinely restricted — eliminates the opportunity conditions behind most common fraud schemes before any analytics layer is needed.
Step 3 - Establish anonymous reporting mechanisms
Whistleblower hotlines consistently produce the highest fraud detection rates of any mechanism the ACFE tracks. They surface schemes that analytics miss because the reporter witnessed behavior, not just a suspicious transaction. The program only works if employees trust it: clear non-retaliation policies, visible investigation follow-through, and confidential submission channels are prerequisites, not optional features.
Step 4 - Deploy detective controls that scale
Periodic manual reviews and spot-check reconciliations leave most transactions unexamined. Systematic transaction monitoring - either through an audit analytics platform or structured exception reporting - surfaces anomalies between audit cycles rather than months after they've accumulated. At this stage, full-population coverage matters more than analytical sophistication: catching every duplicate invoice and every SoD violation on 100% of transactions outperforms complex models that run on a sample.
Step 5 - Test controls continuously, not just annually
Annual or quarterly control testing creates windows that match almost exactly with the ACFE's 12-month median detection time. Continuous controls monitoring (CCM) closes that window by running control tests on transactions as they post. Define what normal looks like for each process, set materiality thresholds, assign exception owners, and treat the output as an ongoing operational signal rather than an annual compliance exercise.
Step 6 - Close the loop: investigate, remediate, document
Detection without follow-through creates the appearance of control without the substance. Every flagged exception needs an assigned owner, a documented investigation conclusion, and - where a control gap is confirmed - a remediation action with a tracked completion date. The audit trail this generates also serves a second purpose: continuous documentation of control effectiveness for SOX, regulatory, or external audit purposes, produced as a byproduct of normal operations rather than assembled at year-end.
The role of internal audit in fraud prevention
Internal audit's fraud prevention value operates on two levels simultaneously. The first is deterrence: employees who know controls are actively and independently tested make different decisions than those who know testing is periodic and partial. The second is verification: internal audit provides objective evidence that management's controls are designed correctly and functioning as intended - a finding neither management nor external audit can credibly provide about their own processes.
The boundary matters. Internal audit doesn't own fraud prevention controls and doesn't manage fraud investigations - those responsibilities sit with management. What internal audit uniquely provides is independent confirmation that the controls management claims to run are actually running, on the transactions that matter.
Conclusion
Internal controls for fraud prevention fail in two ways: they don't exist where they're needed, or they exist but are never verified. Closing the gap between a documented control environment and one that demonstrably works requires moving from periodic, sample-based review to continuous, full-population testing — applied across the financial processes where fraud actually concentrates.
Supervizor provides 350+ pre-built fraud prevention controls across P2P, O2C, R2R, T&E, ITGC, and Treasury — operational in days.
.jpg){kind=icon}