Asset Misappropriation Fraud: Red Flags, Controls, and Recovery

Asset misappropriation fraud — the theft or misuse of an organization’s own resources by employees or insiders — is best caught by watching for a short list of behavioral and accounting warning signs, and best prevented by separating financial duties, running a confidential tip line, and applying basic data analytics to transactions. Those three controls, used together, consistently reduce both the frequency of fraud and the median loss when it does occur. Everything else in a prevention program supports them.

Asset misappropriation accounts for roughly 89% of occupational fraud cases, with a median loss of $120,000 per incident.¹ The losses show up as shrinking margins, inventory shortages, and balance-sheet variances nobody can explain.

Warning Signs in People

Red flags do not prove fraud. They tell you where to look.

The most persistent behavioral indicator is an employee whose lifestyle visibly exceeds their salary — new cars, luxury vacations, expensive jewelry — with no obvious explanation like a spouse’s income or an inheritance. Close behind are employees who refuse to share duties, resist cross-training, or never take vacation. A mandatory vacation policy is a fraud control for exactly this reason: it forces someone else to handle the work, and that is often when irregularities surface.

Unusually tight relationships with specific vendors or customers can signal kickback arrangements. Financial stress — debt problems, addiction, a costly divorce — does not make someone a criminal, but it does create the pressure that fraud researchers consistently identify as one of the three conditions (along with opportunity and rationalization) that enable occupational fraud.

Warning Signs in the Books

Unexplained inventory shortages are the clearest signal of non-cash theft. When the physical count and the book balance diverge beyond normal shrinkage, something is wrong.

For cash schemes, watch for a high volume of voided transactions or credit memos concentrated under a single employee’s login. Missing originals — photocopied invoices, receipts that lack sequential numbering, purchase orders without proper authorization — should raise immediate questions. A pattern of small, round-dollar expense claims just below the approval threshold is a classic expense fraud signature.

Late-period journal entries that post directly to expense accounts, bypassing normal purchasing workflows, are frequently tied to billing schemes. Payments to vendors with only a P.O. Box address, vendors with no web presence, or vendors whose banking details match an employee’s are all worth investigating on sight.

The Schemes Those Flags Point To

The flags matter because they trace back to a handful of recurring schemes. Cash is the most common target. Skimming pockets incoming payments before they ever hit the accounting system, so the transaction simply does not exist on paper. Cash larceny takes money after it has been recorded and leaves an imbalance that reconciliation can catch, which is why larceny tends to be discovered faster than skimming.

Disbursement schemes push the company to issue payments it should not. Billing fraud — typically a shell vendor submitting invoices for goods or services never provided — carries a median loss of $100,000 per case. Check and payment tampering (forged signatures, altered payees, intercepted checks) carries a median loss of $155,000. Expense reimbursement fraud and payroll schemes (fictitious employees, inflated hours) are lower-value per incident, around $50,000 median, but they are common: expense fraud appears in roughly 13% of reported cases and payroll in about 10%.¹

On the non-cash side, inventory, equipment, and raw materials walk out the door the same way cash does. Theft of intellectual property — customer lists, formulas, designs, trade secrets — is the quietest variant: a thumb drive copy may go unnoticed for months, and the competitive damage can dwarf a billing scheme.

Controls That Actually Prevent It

Lack of internal controls is the single most cited factor enabling fraud, present in 32% of cases studied; another 19% involved someone overriding controls that already existed.¹ Controls that leadership ignores are worse than useless, because they create a false sense of security.

Segregation of Duties

The foundational control: no single person controls an entire transaction from start to finish. Three functions must sit with different people — authorization (who approves), recording (who books it), and custody (who touches the asset). The employee who authorizes a purchase should not also process the vendor payment, and neither of them should reconcile the resulting account.

For cash, the person opening the mail and logging incoming payments should be different from the person making the bank deposit, and a third person should perform the bank reconciliation. When one person handles all three steps, they can steal and erase the evidence.

Physical and System Access

High-value or easily resold inventory belongs in secured areas with restricted access and sign-in/sign-out logs. Cash collection points need locked drawers subject to surprise counts. Blank check stock and sensitive financial records should be under lock with access limited to a short list of authorized personnel.

IT permissions should mirror the segregation framework. If someone does not need access to the vendor master file, they should not have it. Financial systems should enforce multi-factor authentication, and system logs should be monitored for after-hours access, large data exports, and repeated failed login attempts. Capping the dollar amount a single user can approve shrinks the window for large disbursement schemes.

Reconciliation and Review

Bank reconciliations should be performed monthly by someone not involved in processing receipts or disbursements. Surprise audits of cash drawers, petty cash, and inventory counts should happen at random intervals; scheduled audits are easy to game. All balance sheet accounts should be reconciled monthly, and any unexplained variance should trigger a follow-up rather than being quietly written off.

Periodic review of the vendor master file is one of the most underused controls available. Scanning for duplicate addresses, vendors sharing banking information with employees, and recently added vendors with no purchase history can surface billing schemes before they take root.

Tone at the Top

None of this works if leadership treats controls as optional. When executives bypass approval workflows or tolerate sloppy recordkeeping, employees notice, and some will exploit the gap. A written anti-fraud policy, communicated to every employee and enforced consistently regardless of the offender’s rank, is where the culture piece lives. It cannot be delegated to accounting.

Why a Tip Line Belongs at the Center

Tips are responsible for detecting 43% of all occupational fraud, more than internal audit, management review, or any other method.¹ A confidential reporting channel is the single most effective detection tool an organization can deploy.

A whistleblower hotline, whether internal or run by a third party, needs to be genuinely anonymous, easy to use, and actively promoted. Employees who fear retaliation will not call. Employees who do not know the hotline exists cannot call.

For publicly traded companies, federal law reinforces the channel. Employees who report conduct they reasonably believe violates federal fraud statutes — including mail fraud, wire fraud, or securities fraud — are protected from retaliation under the Sarbanes-Oxley Act.² An employer cannot fire, demote, suspend, or harass an employee for reporting fraud to a federal agency, a congressional committee, or a supervisor. Retaliated employees can seek reinstatement, back pay, and legal fees. The deadline to file a retaliation complaint is 180 days from the date the employee became aware of the retaliatory action.

Data Analytics Cuts Losses in Half

Organizations that use proactive data analytics to monitor transactions experience fraud losses roughly 50% lower than those that do not.³ The idea is simple: instead of relying on manual review, software continuously scans transactions for patterns associated with fraud.

Useful tests flag duplicate invoice numbers or amounts, identify vendors whose addresses or bank accounts match employee records, highlight payments falling just below approval thresholds, and detect unusual spikes in expense reimbursements or overtime. None of this requires sophisticated AI. Most accounting packages and even spreadsheet tools can run the checks. The barrier is not technology. It is the commitment to run the tests regularly and act on what they return.

If You Are a Small Business

Small organizations face a brutal mismatch. They suffer disproportionately high fraud losses — a median of $141,000 for companies with fewer than 100 employees — yet rarely have enough staff to fully segregate duties.¹ When one person handles bookkeeping, deposits, and reconciliations, the classic framework collapses.

Compensating controls close the gap:

The owner or a trusted manager should personally open and review bank statements, canceled checks, and credit card statements every month. Thirty minutes catches most schemes that rely on nobody looking.
Require two approvals for payments above a set threshold. The second approver can be a co-owner, board member, or outside accountant.
Have an external bookkeeper or CPA perform bank reconciliations, so an internal fraudster cannot manipulate the reviewer.
Use expense management systems that enforce spending limits, automated invoice matching that verifies purchases before payment, and payroll software that flags unusual entries.

None of these equal full segregation of duties. A small business that implements all of them is still far better protected than one that does nothing because “we trust our people.” Trust is not a control.

Do Not Rely on Your Annual Audit

Many organizations assume their annual financial statement audit will detect asset misappropriation. It usually will not. Under auditing standards, an external auditor’s job is to obtain reasonable assurance that financial statements are free of material misstatement, not to find every instance of fraud. If an employee is stealing $5,000 a month from a company with $50 million in revenue, that theft is immaterial to the statements, and the auditor is not designing procedures to find it. The standard explicitly places prevention and detection of fraud on management, not the auditor.⁴

If You Discover Fraud

The first 48 hours determine whether you preserve a viable case or destroy it. Every step should be deliberate, documented, and coordinated with legal counsel.

Before the suspected employee knows anything is happening, secure all relevant documentation and electronic records. Create forensic copies of hard drives, preserve email archives, and gather original invoices, purchase orders, and bank records. Digital evidence degrades quickly: files get deleted, emails purged, system logs overwritten. Revoke the suspect’s access to financial software, email, remote network access, and the building. Place them on administrative leave, framed as non-disciplinary to avoid prejudging the outcome. Notify internal counsel, the audit committee if one exists, and the CFO. Keep the circle small. An external forensic accountant is usually worth the cost: they quantify the loss, trace the funds, identify participants, and produce documentation that holds up in court.

Be careful what you say and to whom. Accusing an employee of theft, especially in front of coworkers or in written form, exposes the organization to a defamation claim if the accusation turns out to be wrong or is made with malice. A qualified privilege generally protects good-faith statements made during legitimate workplace investigations and discussions among those with a need to know. That privilege evaporates if the accusation is made with ill will or broadcast beyond people who need the information.

Criminal referral and civil recovery are separate tracks, often pursued in parallel. Mail and wire fraud statutes commonly apply to asset misappropriation schemes that use the mails or electronic communications.⁵⁶ Restitution orders help, but collecting from someone who has already spent the money is frequently the hardest part of the process.

Recovering the Loss

Fidelity Bonds

A fidelity bond (also called an employee dishonesty bond) reimburses the organization for losses from fraudulent acts of covered employees. For employee benefit plans governed by ERISA, bonding is mandatory: every fiduciary and every person who handles plan funds must be bonded for at least 10% of the funds they handled in the prior year, with a minimum bond of $1,000 and a maximum of $500,000, or $1,000,000 for plans holding employer securities.⁷ ERISA fidelity bonds cannot carry deductibles for covered losses and must be issued by a surety approved by the Treasury Department.⁸ Outside ERISA, fidelity bonds are voluntary but widely recommended wherever employees handle cash, manage accounts, or have access to valuable assets.

Theft-Loss Tax Deduction

A business can deduct theft losses on its federal return. The loss is deductible in the year the theft is discovered, not the year it occurred.⁹ The deductible amount is the adjusted basis of the stolen property reduced by any insurance reimbursement or other recovery you receive or expect to receive.¹⁰ Business theft losses go on IRS Form 4684, Section B. Two practical constraints: the loss has to be reduced by anything recovered through insurance, civil lawsuits, or restitution; and the theft must be illegal under the law of the state where it occurred and committed with criminal intent. A sloppy bookkeeper who loses money through incompetence does not create a deductible theft loss. Keep the forensic report and any police reports on file, because the IRS can challenge the deduction.

1
Association of Certified Fraud Examiners. Occupational Fraud 2024: A Report to the Nations
2
Office of the Law Revision Counsel. 18 USC 1514A – Civil Action to Protect Against Retaliation in Fraud Cases
3
Association of Certified Fraud Examiners. Anti-Fraud Data Analytics Tests
4
Public Company Accounting Oversight Board. AS 2401: Consideration of Fraud in a Financial Statement Audit
5
Office of the Law Revision Counsel. 18 USC 1341 – Frauds and Swindles
6
Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television
7
Office of the Law Revision Counsel. 29 USC 1112 – Bonding
8
U.S. Department of Labor. Protect Your Employee Benefit Plan With An ERISA Fidelity Bond
9
Office of the Law Revision Counsel. 26 USC 165 – Losses
10
Internal Revenue Service. Topic No. 515, Casualty, Disaster, and Theft Losses