Fraud Detection Checklist: Five Controls That Catch Simple Schemes

Purpose of This Checklist

Despite reforms like the Sarbanes-Oxley Act and enhanced governance frameworks, simple frauds still succeed. First Brands and Tricolor both collapsed in September 2025 after basic schemes, such as double-pledged collateral and inflated invoices, went undetected by lenders, auditors, and internal controls.

This checklist offers five specific verification controls your organization can implement immediately to detect the simple frauds that sophisticated frameworks often miss. It's designed for internal audit teams, compliance officers, and finance leaders overseeing lending relationships, asset-backed facilities, or complex capital structures.

The controls focus on independent verification rather than management reporting. As the Tricolor and First Brands cases show, the longest-running frauds are often hidden in routine financial reports.

Prerequisites

Before implementing this checklist, ensure your organization has:

• Direct access to bank records for cash flow verification (not just management-provided reconciliations).
• Authority to request source documentation from counterparties, lenders, and service providers.
• UCC search capabilities through your state's Secretary of State filing systems or a commercial UCC search provider.
• A documented escalation protocol when verification results conflict with management reporting.
• Independence from the business units you're monitoring (no dual reporting to the CFO who signs the financials you're verifying).

If any of these prerequisites are lacking, document the gap and escalate it as a material weakness in your monitoring framework.

The Fraud Detection Checklist

Control 1: Independent Cash Flow Verification

Frequency: Monthly for high-risk relationships; quarterly minimum for all material credit facilities.

What you're testing: Whether cash inflows reconcile to reported performance without management adjustment.

Procedure:

• Obtain bank statements directly from the financial institution (not from management).
• Trace the three largest cash receipts to underlying customer invoices or loan repayments.
• Calculate implied collection rate from actual deposits vs. reported receivables.
• Flag any variance exceeding 5% for immediate investigation.
• Document reconciling items with source evidence, not management explanation.

Why it matters: First Brands used adjusted EBITDA to mask concealed leverage. Cash deposits are factual, they either clear the bank or they don't.

Red flag threshold: If management cannot produce bank-verified evidence of cash receipts within 48 hours, treat the relationship as high-risk and increase monitoring frequency.

Control 2: UCC Collateral Cross-Check

Frequency: At origination, then quarterly for asset-backed facilities.

What you're testing: Whether pledged collateral appears on other lenders' UCC filings.

Procedure:

• Pull UCC-1 filings for the debtor in all states where they operate.
• Review collateral descriptions on all active filings.
• Cross-reference serial numbers, VINs, or specific asset identifiers against your collateral schedule.
• Flag any overlap with other secured parties.
• For equipment or vehicle portfolios, perform random field verification of 10% of units annually.

Why it matters: Tricolor allegedly double- and triple-pledged assets to multiple lenders. These pledges appear in public UCC records that most lenders never checked until bankruptcy.

Red flag threshold: Any evidence of overlapping security interests requires immediate subordination agreement review or facility suspension.

Control 3: Corporate Governance Structure Audit

Frequency: Annually, or upon any C-suite turnover.

What you're testing: Whether adequate segregation of duties exists to prevent management override.

Procedure:

• Request and review the current board committee structure.
• Verify the audit committee includes at least one financial expert, as defined by SOX Section 407.
• Confirm the audit committee meets at least quarterly without management present.
• Review signing authorities, no single executive should approve disbursements, record transactions, and reconcile accounts.
• Verify external audit partner rotation complies with SOX Section 203 (five-year limit).

Why it matters: Both First Brands and Tricolor lacked governance structures that would have prevented founder-led fraud schemes. Governance isn't a compliance formality, it's a credit risk indicator.

Red flag threshold: If the CEO or founder maintains unilateral signing authority over $500K, or if no independent audit committee exists, classify the relationship as elevated risk.

Control 4: Capital Structure Transparency Test

Frequency: At origination and upon any new financing event.

What you're testing: Whether you can map all cash flows and collateral without management interpretation.

Procedure:

• Diagram all special-purpose vehicles (SPVs), subsidiaries, and off-balance-sheet entities.
• Trace collateral flow from origination through securitization or factoring arrangements.
• Identify all parties with claims on the same asset pool.
• Request and review inter-company loan agreements.
• Verify that your collateral isn't also securing related-party debt.

Why it matters: Complex structures aren't sophisticated, they're risk factors. If you can't independently map where cash and collateral flow, you can't detect when they're being diverted.

Red flag threshold: If management cannot provide a complete org chart with inter-company cash flows within five business days, suspend further advances until you receive it.

Control 5: Reporting System Calibration Check

Frequency: Semi-annually, or after any system migration.

What you're testing: Whether automated risk monitoring tools produce results that match source data.

Procedure:

• Select five transactions from the most recent monitoring report.
• Trace each transaction back to source documentation (invoice, payment record, loan tape).
• Recalculate the risk metrics manually using the same inputs.
• Compare your calculation to the system output.
• If variances exceed 2%, audit the system's calculation logic and data feeds.

Why it matters: A junior analyst caught Tricolor's fraud by noticing loan principal wasn't declining in a spreadsheet, not because a sophisticated system flagged it. Your monitoring tools are only as reliable as their programming and data inputs.

Red flag threshold: Any systematic variance between source documents and system outputs requires immediate system audit and suspension of reliance on automated reports.

Customization Options

For asset-based lending: Add monthly borrowing base certificate reconciliation (Control 1) and increase UCC verification frequency (Control 2) to monthly for portfolios exceeding $50M.

For private credit funds: Expand Control 3 to include LP reporting verification, confirm that portfolio company financials match what's reported to your investors.

For internal audit teams: Integrate Controls 1, 2, and 5 into your annual audit plan as standalone procedures, not sub-tests within broader reviews.

For compliance officers: Use Control 3 as your annual governance assessment template and Control 4 for new relationship due diligence.

Validation Steps

After implementing this checklist for one quarter:

1. Count your flags: How many red flag thresholds did you hit? Zero flags may indicate you're not testing rigorously enough.
2. Measure response time: How long did it take management to provide requested documentation? Delays are themselves a signal.
3. Review your escalations: Did any flagged issues result in facility modifications, increased reserves, or relationship termination? If not, your escalation protocol may need strengthening.
4. Test your independence: Did you face pressure to soften findings or accept management explanations without source verification? Document it.
5. Update your risk ratings: Relationships that consistently pass these controls should receive favorable risk ratings. Those that don't should face increased monitoring or exit.

The frauds at First Brands and Tricolor succeeded because nobody performed these basic checks consistently. Your monitoring framework should assume management reporting is unreliable until you've independently verified it. That's not cynicism, it's effective control design.