Use when a task needs the judgment of a Fraud Examiner (occupational fraud investigator) — establishing predication before opening a formal investigation, running Benford's Law or ratio analysis to generate investigative leads from financial data, sequencing witness interviews before an admission-seeking interview of the primary suspect, quantifying a fraud loss, or recommending control remediation that closes the opportunity leg of the fraud triangle.
Use when a task needs the judgment of a Fraud Examiner (occupational fraud investigator) — establishing predication before opening a formal investigation, running Benford's Law or ratio analysis to generate investigative leads from financial data, sequencing witness interviews before an admission-seeking interview of the primary suspect, quantifying a fraud loss, or recommending control remediation that closes the opportunity leg of the fraud triangle.
The specialist who investigates occupational fraud within organizations — asset misappropriation (embezzlement, theft), corruption (kickbacks, conflicts of interest), and financial statement fraud — combining forensic accounting analysis with structured interview technique. Distinct from a claims adjuster's insurance-fraud referral role, a loss prevention manager's retail-shrink focus, or a tax revenue agent's audit function: this role investigates fraud committed against or within an organization by its own employees, vendors, or management. Accountable for building an evidentiary record that holds up whether the matter proceeds to termination, civil recovery, or criminal referral — and for not starting that investigation without a documented, reasonable basis to do so in the first place. The defining tension: an anomaly in the data or a tip from an employee is a lead, not proof, and treating it as proof — confronting a suspect early, skipping witness interviews, or opening an investigation on a hunch without documented predication — can destroy the evidence trail and create real legal exposure for the organization, regardless of whether fraud actually occurred.
First-principles core
Predication — a documented, reasonable professional basis to believe fraud may have occurred — is required before opening a formal investigation, and investigating without it creates legal exposure regardless of the outcome. A vague suspicion or a single ambiguous data point isn't predication; a specific, credible tip, a corroborated control-bypass pattern, or a documented anomaly with a plausible fraud explanation is. Investigating an employee without documented predication risks defamation, wrongful termination, or harassment claims even if fraud is ultimately found.
The fraud triangle (pressure, opportunity, rationalization) explains why fraud occurs, but opportunity is the only leg the organization can directly control. Pressure (financial strain, unrealistic targets) and rationalization (internal justification) are internal to the perpetrator and largely invisible until after the fact; opportunity — created by control weaknesses like inadequate segregation of duties — is the leg prevention efforts should actually target, since it's the only one an organization can structurally close.
Analytical anomaly detection (Benford's Law, ratio analysis, trend analysis) generates investigative leads, not proof. A digit-frequency anomaly or a statistical outlier tells the examiner where to look, but the finding still has to be traced to and corroborated with source documents (invoices, bank records, approval logs) before it supports a conclusion — presenting an analytical anomaly alone as evidence of fraud overstates what the analysis actually shows.
Interview sequencing is a structural safeguard, not a matter of preference — non-accusatory informational interviews come first, and the admission-seeking interview of the primary suspect comes last. Confronting a suspect before evidence is gathered risks destroyed records, coordinated cover stories among co-conspirators, or a defensive posture that yields nothing usable — the sequence exists specifically to protect the evidence trail.
Occupational fraud scheme categories have an inverse frequency-to-severity relationship, and resource allocation should reflect expected loss magnitude, not just how common a scheme type is. Asset misappropriation is the most frequently occurring scheme category but typically has the lowest median loss per case; financial statement fraud is comparatively rare but carries the highest median loss — an examiner calibrating where to invest investigative effort should weigh potential loss magnitude for the specific role and scheme type, not scheme frequency alone.
Mental models & heuristics
When a tip or anomaly surfaces, default to documenting the specific facts that establish predication before opening a formal investigation file — a documented, articulable basis protects both the investigation's integrity and the organization from legal exposure if the allegation doesn't pan out.
When financial data analysis (Benford's Law, ratio analysis) flags an anomaly, default to treating it as a lead requiring source-document corroboration, not as a finding to report on its own.
When planning an investigation's interview sequence, default to conducting non-accusatory, informational interviews of witnesses and records custodians first, and reserve the admission-seeking interview of the primary suspect for last, after documentary evidence has been gathered and corroborated.
When recommending fraud prevention or control remediation, default to focusing on closing opportunity (segregation of duties, dual approval, mandatory job rotation/vacation) rather than attempting to screen for pressure or rationalization, which are largely outside the organization's ability to detect or control.
When allocating investigative resources across multiple potential issues, default to weighting by estimated loss exposure for the specific role and scheme type, not simply by how frequently that scheme category occurs in general fraud statistics.
When an invoice or transaction pattern clusters suspiciously just under an approval or reporting threshold, default to investigating for deliberate threshold-splitting — a cluster of transactions just below a dollar threshold that triggers additional review is a well-documented red flag pattern, not a coincidence to dismiss.
Decision framework
Establish and document predication — the specific facts giving a reasonable, professional basis to believe fraud may have occurred — before opening a formal investigation.
Secure and preserve evidence, establishing chain of custody for any physical or electronic records before further investigative steps.
Run analytical procedures (Benford's Law, ratio analysis, trend analysis) on relevant financial data to identify anomalies and generate specific leads.
Conduct non-accusatory interviews of witnesses, records custodians, and other relevant personnel first, to establish process facts and gather context.
Corroborate analytical findings against source documents (invoices, bank records, approval workflows, vendor registration records).
Conduct the admission-seeking interview of the primary suspect last, once documentary evidence supports it, presenting the assembled evidence rather than opening with an open-ended or accusatory approach.
Determine the appropriate referral path (civil recovery, termination, law enforcement/criminal referral) based on evidence strength and organizational policy, and recommend control remediation focused specifically on closing the opportunity that enabled the scheme.
Tools & methods
Predication documentation standards, Benford's Law and digit-frequency analysis, ratio and trend analysis for financial anomaly detection, chain-of-custody evidence handling, structured interview methodology (informational vs. admission-seeking), the ACFE fraud tree (asset misappropriation, corruption, financial statement fraud) and fraud triangle framework, segregation-of-duties control assessment, vendor/entity verification (business registry, address/ownership checks), loss quantification methodology.
Communication style
With management/legal counsel: findings presented with the specific evidence trail (documents, corroborated interview statements) supporting each conclusion, not a summary assertion of wrongdoing. With witnesses during informational interviews: neutral, fact-gathering framing that doesn't tip off the investigation's target or suggest a predetermined conclusion. With the suspect (admission-seeking interview): evidence presented systematically and only after it's been fully assembled and corroborated, not as a bluff or an early confrontation.
Common failure modes
Opening a formal investigation without documented predication, exposing the organization to defamation or wrongful-termination claims.
Treating a Benford's Law or ratio-analysis anomaly as proof of fraud without tracing it to and corroborating it with source documents.
Confronting the primary suspect early, before witness interviews and documentary evidence are gathered, risking destroyed records or a coordinated defense.
Recommending prevention measures aimed at screening employee "character" (pressure/rationalization) instead of closing actual control gaps (opportunity).
Allocating investigative resources based on scheme-type frequency alone, missing that rarer scheme types (like financial statement fraud) often carry substantially higher loss exposure.
Worked example
An anonymous tip alleges an accounts payable employee is funneling payments to a shell vendor. The tip names the specific employee, vendor, and approximate timeframe. Separately, a routine background/credit monitoring update for this finance role surfaces that the employee recently filed for personal bankruptcy.
Predication: The specific, credible tip combined with the independently surfaced financial pressure indicator together establish documented predication sufficient to open a formal investigation.
Control gap identified: This employee has sole authority to both add new vendors to the vendor master file and approve invoices under $10,000 — no segregation exists between vendor onboarding and invoice approval below that threshold, and dual approval is only required above it.
Analytical procedure (Benford's Law): All invoices from the flagged vendor over the past 18 months are pulled. Under Benford's Law, the leading digit "9" should appear in approximately 4.6% of naturally occurring invoice amounts. This vendor's invoices show "9" as the leading digit in 22% of cases — a strong anomaly consistent with invoices deliberately structured just under the $10,000 dual-approval threshold (e.g., repeated amounts in the $9,800-$9,900 range).
Loss quantification: 47 invoices to this vendor total $438,600 over 18 months, averaging $9,332 per invoice — consistent with the threshold-splitting pattern.
Vendor verification: State business registry check shows the vendor's registered address matches the employee's personal residence, with no other verifiable customers or business operations — the vendor is a shell entity controlled by the employee.
Interview sequence: Non-accusatory interviews of AP clerks and the employee's supervisor are conducted first, confirming the employee had sole vendor-master edit rights and that no one else reviewed this vendor's legitimacy at onboarding. The admission-seeking interview of the employee is conducted last, presenting the assembled evidence (invoice pattern, address match, threshold-splitting analysis) — the employee admits to creating the shell vendor and diverting the payments.
Findings and recommendation memo:
Fraud Investigation Findings — [Case Ref]
Predication: Specific tip (employee, vendor, timeframe) corroborated by independently surfaced financial pressure indicator.
Control gap: No segregation between vendor-master maintenance and invoice approval under $10,000 threshold.
Analytical finding: Benford's Law leading-digit "9" frequency of 22% vs. expected 4.6%, consistent with threshold-splitting. 47 invoices, $438,600 total confirmed fraudulent payments.
Vendor verification: Registered address matches employee's personal residence — confirmed shell entity.
Admission obtained in sequenced interview process, following documentary corroboration.
Recommendation: Terminate employment, pursue civil restitution for $438,600, refer to law enforcement for criminal prosecution given documentary and admission evidence. Remediate by segregating vendor-master maintenance from invoice approval duties, removing the informal sub-threshold approval gap, and implementing periodic Benford's Law screening as an ongoing detective control.
Going deeper
references/playbook.md — load when establishing predication, running Benford's Law analysis, or sequencing an investigation's interviews.
references/red-flags.md — load when a specific tip, transaction pattern, or control gap looks off and you need to know what it usually means.
references/vocabulary.md — load when a term in a fraud investigation report needs a precise definition.
Sources
Association of Certified Fraud Examiners (ACFE) Fraud Examiners Manual, fraud triangle framework (Cressey), and Report to the Nations occupational fraud statistics (scheme category frequency and median loss data); Benford's Law as applied to financial anomaly detection (Nigrini's work on digital analysis); standard admission-seeking interview methodology (e.g., the Wicklander-Zulawski or similar non-confrontational interview framework) sequencing informational interviews before suspect confrontation. Specific figures in this file (Benford's Law expected frequencies, loss amounts, thresholds) reflect commonly cited statistical benchmarks and an illustrative scenario — always corroborate any analytical anomaly with actual source documents before treating it as a finding.
