Skip to main content
Governance Authority
Category: Fraud Risk Management

Occupational Fraud

Also known as: Internal Organizational Fraud, Internal Fraud
Simply put

Occupational fraud generally refers to fraudulent activity committed against an organization by its own employees, managers, or executives, who use their position to deceive the organization for personal gain. In broader descriptions, it can also extend to certain third parties acting against the organization. It is sometimes called internal organizational fraud to distinguish it from fraud committed by outsiders.

Formal definition

Occupational fraud is a category of fraud in which an employee, manager, or executive of an organization deceives that organization, typically by misusing their occupational position or access. Some descriptions extend the concept to include third parties acting against the organization. The Association of Certified Fraud Examiners (ACFE) treats occupational fraud as a defined category studied in its recurring global research (the Report to the Nations), and the term is also referred to as internal organizational fraud. Practitioners should note that specific typologies, legal treatment, and thresholds for what constitutes fraud vary by jurisdiction, sector, and applicable law; this entry is educational and not legal, audit, or compliance advice.

Why it matters

Occupational fraud is distinct from fraud committed by external parties because the perpetrator holds a position of trust and legitimate access within the organization. That combination of trust and access is precisely what makes it difficult to detect: employees, managers, and executives understand internal processes and controls and may be able to circumvent or override them. For boards and management, occupational fraud therefore represents a risk that internal controls alone cannot fully eliminate, and it typically demands a layered response spanning prevention, detection, and response.

The risk is a recurring subject of study rather than an isolated concern. The Association of Certified Fraud Examiners (ACFE) treats occupational fraud as a defined category and examines it in its recurring global research, the Report to the Nations, which is built on analysis of large numbers of real investigated cases drawn from many countries and territories. The existence of this sustained body of research reflects that occupational fraud is a persistent, cross-border, cross-sector exposure rather than a problem confined to any single industry or region.

Because the perpetrator is an insider, occupational fraud also carries governance and accountability implications beyond the direct financial loss. It can expose weaknesses in the control environment, in segregation of duties, and in oversight arrangements. How any given incident is characterized, prosecuted, or remediated depends on the facts, the applicable law, and the jurisdiction, so organizations generally treat both the definition and the response as matters requiring professional judgment rather than a single fixed template.

Who it's relevant to

Boards and audit committees
Boards and their audit committees typically carry an oversight responsibility for the organization's control environment and for management's approach to fraud risk. Understanding that occupational fraud is committed by insiders who may be able to override controls helps directors ask informed questions about prevention, detection, and escalation, while recognizing that day-to-day design and operation of controls sits with management.
Chief compliance and risk officers
Compliance and risk functions generally consider occupational fraud as part of the organization's broader fraud risk exposure. Because typologies and legal treatment vary by jurisdiction and sector, these officers often coordinate policies, awareness efforts, and reporting mechanisms while relying on professional judgment about how the risk applies to their specific organization.
Internal auditors and assurance functions
Internal audit and other assurance functions provide independent evaluation of whether controls relevant to fraud risk are designed and operating as intended. The insider nature of occupational fraud is directly relevant to their work on segregation of duties, access, and management override, though the classification and investigation of any specific incident depends on the facts and applicable law.
General counsel and legal teams
Legal teams are often engaged when a suspected occupational fraud must be characterized, investigated, or acted upon, because whether an act meets the legal threshold for fraud, and how it is addressed, varies by jurisdiction and applicable law. This entry is educational and is not a substitute for legal advice on any particular matter.
Certified fraud examiners and investigators
Fraud examiners and investigators work directly with occupational fraud as a defined category, including through resources such as the ACFE's recurring research. They apply specialized methods to identify and analyze schemes while accounting for variation in typologies, legal treatment, and thresholds across jurisdictions and sectors.

Inside Occupational Fraud

Asset Misappropriation
The theft or misuse of an organization's resources by employees or others with access, such as skimming cash receipts, fraudulent disbursements, payroll schemes, or inventory theft. This is generally the most frequently occurring category of occupational fraud, though individual incidents typically involve smaller losses than other categories.
Corruption
Schemes in which an individual misuses their influence in a business transaction to obtain an improper benefit, including bribery, kickbacks, conflicts of interest, and illegal gratuities. The specific conduct that constitutes corruption, and the legal consequences, vary by jurisdiction and may implicate anti-bribery statutes.
Financial Statement Fraud
The intentional misstatement or omission of material information in financial reports, such as recording fictitious revenue, concealing liabilities, or improper asset valuation. This category is generally the least frequent but tends to involve the largest losses, and often implicates senior management given their access to reporting processes.
The Fraud Triangle
A conceptual model describing three conditions commonly associated with fraud: pressure or incentive, opportunity, and rationalization. It is an explanatory framework used to understand contributing factors, not a legal test or a guarantee that fraud will or will not occur.
Detection and Response Mechanisms
The controls and channels through which occupational fraud is identified and addressed, such as tips and whistleblower reporting lines, management review, internal audit, and reconciliations. Ownership of these activities is distributed across management, compliance, and assurance functions rather than concentrated in a single role.

Common questions

Answers to the questions practitioners most commonly ask about Occupational Fraud.

Is occupational fraud primarily an internal audit problem to detect and resolve?
No. While internal audit provides independent assurance over the design and operating effectiveness of anti-fraud controls, it does not own the risk. Under a three-lines model, management (the first line) owns and manages fraud risk and operates the day-to-day controls; risk and compliance functions (the second line) typically set frameworks, monitor, and provide oversight; and internal audit (the third line) provides independent assurance. Attributing detection and resolution solely to internal audit conflates an assurance role with operational and management accountability. The board or its audit committee generally oversees the overall approach but does not perform the controls.
Does having an anti-fraud policy or code of conduct mean an organisation is legally compliant and protected?
Not necessarily. A written policy or code is typically a voluntary or expected element of a control environment, but its existence does not by itself establish compliance or effectiveness. What matters is control design and, separately, operating effectiveness, whether the controls actually function as intended over time. Legal requirements relating to fraud, financial reporting, and internal controls vary by jurisdiction, sector, and entity type, and a code that exists on paper but is not embedded, monitored, or enforced may provide limited assurance and limited legal mitigation. Whether specific obligations apply depends on the facts and applicable law, and this entry is educational rather than legal advice.
How should an organisation assess its exposure to occupational fraud?
A common approach is a structured fraud risk assessment that identifies potential schemes (such as asset misappropriation, corruption, or financial statement manipulation), evaluates inherent risk before controls, considers existing controls, and estimates residual risk. Many organisations frame this in terms of likelihood and impact, and align it with recognised frameworks; for example, some draw on COSO principles addressing fraud risk within internal control. The assessment is typically owned by management with oversight from the board or audit committee, and its scope and rigour depend on the organisation's size, sector, and risk profile.
What role does the board or audit committee play in addressing occupational fraud?
The board, often acting through an audit or risk committee, generally holds an oversight role: setting the tone at the top, approving or reviewing the anti-fraud approach and risk appetite, and challenging management on the adequacy of controls and the handling of significant incidents. It typically does not design or operate individual controls, which is a management responsibility. The precise allocation of duties varies with the governance framework, applicable listing rules or codes, and the entity's structure, so committees should confirm their specific mandate.
Which controls are commonly used to reduce occupational fraud risk?
Organisations frequently combine preventive and detective controls. Preventive measures often include segregation of duties, authorisation and approval limits, access restrictions, and pre-employment or vendor due diligence. Detective measures may include reconciliations, data analytics, exception monitoring, and confidential reporting or whistleblowing channels. It is important to distinguish control design (whether a control is capable of addressing the risk) from operating effectiveness (whether it works consistently in practice). The appropriate mix depends on the assessed risks, cost-benefit considerations, and the organisation's context.
How can an organisation evaluate whether its anti-fraud measures are working?
Evaluation typically distinguishes between testing control design and testing operating effectiveness over a period. Management may use ongoing monitoring and self-assessment, the second line may perform independent monitoring, and internal audit may provide independent assurance through periodic testing. Indicators can include the operation of detective controls, the volume and handling of reports through whistleblowing channels, and the results of investigations. No single metric confirms effectiveness, and conclusions depend on professional judgment, the quality of evidence, and the specific facts. This entry is educational and not a substitute for audit, compliance, or legal advice.

Common misconceptions

Occupational fraud is primarily committed by outsiders or a few obviously untrustworthy individuals.
By definition, occupational fraud is perpetrated by those within the organization who abuse their position, and perpetrators frequently have no prior indicators of concern. This is why controls generally focus on reducing opportunity rather than relying solely on judgments about individual character.
Internal audit or the compliance function alone is responsible for preventing occupational fraud.
Fraud prevention is generally a shared responsibility. Management typically owns the design and operation of preventive controls, assurance functions such as internal audit provide independent evaluation, and the board and its committees provide oversight. Attributing sole accountability to one function misstates how the lines of defense typically operate.
The most common type of occupational fraud is also the most costly.
These are generally distinct measures. Asset misappropriation is typically the most frequent category, while financial statement fraud tends to involve the largest losses per incident. Frequency and severity should be assessed separately rather than treated as the same dimension.

Best practices

Design layered preventive and detective controls that reduce opportunity, such as segregation of duties, authorization limits, and independent reconciliations, and periodically test both control design and operating effectiveness.
Establish and publicize confidential reporting channels, including whistleblower lines, since tips are commonly a leading source of fraud detection, and ensure protections against retaliation consistent with applicable requirements.
Clarify accountability across the lines of defense so that management owns day-to-day controls, assurance functions provide independent evaluation, and the board or audit committee retains oversight.
Use a structured fraud risk assessment to identify where pressure, opportunity, and rationalization may arise across asset misappropriation, corruption, and financial statement fraud, and prioritize responses accordingly.
Provide targeted training and set a clear tone from the top reinforcing ethical expectations, reporting obligations, and consequences for misconduct.
Tailor the fraud program to the entity's jurisdiction, sector, and size, and seek qualified legal, audit, or compliance advice for specific situations, as this guidance is educational and not a substitute for professional advice.