Collusion in Accounting: Schemes, Red Flags, and Reporting

Collusion in accounting happens when two or more people coordinate to manipulate financial records in a way that defeats the controls meant to catch a lone bad actor. One person creates the fake vendor, another approves the invoice, a third processes the payment, and every checkpoint lights up green because the person doing the checking is in on it. That is what makes collusion so hard to spot: the paperwork looks right by design. Catching it depends on reading the numbers skeptically, watching how people behave around controls, and understanding that tips from insiders uncover more occupational fraud than any other method, roughly 43% of cases according to the Association of Certified Fraud Examiners.

Why Collusion Defeats Normal Controls

A single employee who pads an expense report leaves a trail. The transaction fails to reconcile, a supervisor notices, and the scheme falls apart. Collusive fraud is engineered to avoid that outcome. Participants split the work so each person’s piece looks normal in isolation, and the control that should flag the transaction never fires because the controller is a participant.

The participants can be entirely internal, entirely external, or a mix of both. Inside a company, the most dangerous combination pairs a senior executive who directs the scheme with accounting staff who execute the entries. External parties often include vendors submitting fictitious invoices or customers signing side agreements that quietly alter the real terms of a sale. When independent auditors are compromised, detection becomes extraordinarily difficult, because the people hired to find fraud are helping conceal it.

The Schemes You Will Actually See

Revenue Manipulation

Revenue fraud tends to cause the largest investor losses, and it shows up in several forms. Channel stuffing involves the sales team pressuring distributors to buy far more product than they can move, often with secret side agreements granting generous return rights. Accounting books the shipments as revenue immediately, knowing much of it will come back. The current quarter looks strong because it is borrowing from the next one.

Fictitious sales go further. Sales creates fake customer accounts or shell entities, the warehouse signs off on shipments that never leave the dock, and accounting records the revenue. Every document in the chain looks legitimate because each person involved produced their piece to match the others. These schemes often collapse later, when the fake receivables age and nobody can explain why the “customers” never pay.

Inventory Inflation

Inventory schemes require warehouse personnel and finance staff to cooperate. Warehouse employees falsify count tags or log nonexistent items into the inventory system. The inflated count flows to the balance sheet, overstating assets, and simultaneously understates cost of goods sold on the income statement, lifting reported profits. Inventory is inherently hard to verify from the outside, especially for companies with goods spread across many locations, which is why the scheme can run for years.

Expense Concealment

Hiding expenses is the mirror image of inflating revenue. One of the most common methods is misclassifying routine operating costs as long-term assets. When a company treats ordinary repair work as a capital improvement to property or equipment, the cost does not hit the income statement right away. It gets spread over years through depreciation, and current-period profits jump. Facilities staff mischaracterize the work and accounting books it to the wrong account, which is the textbook collusion pattern.

Financial Red Flags

The numbers almost always tell on the fraudsters eventually, even when the paperwork looks clean. Knowing which numbers to watch is the whole game.

Days sales outstanding, or DSO, is one of the most reliable early indicators. It measures how long a company takes to collect payment after making a sale. When DSO climbs steadily without any change in credit policies or customer base, it suggests the company is booking revenue that is not converting to cash. That pattern fits both channel stuffing and fictitious sales. A declining inventory turnover ratio tells a similar story on the balance sheet, pointing to inventory that may not exist or has become unsellable.

The most revealing comparison is between reported net income and cash flow from operations. Accrual income is relatively easy to manipulate through journal entries, timing games, and classification tricks. Cash flow is much harder to fake, because it tracks money actually moving. When a company reports strong earnings quarter after quarter but operating cash flow lags well behind, something is propping up those earnings artificially. That gap should trigger a deeper look.

Related-party transactions deserve special attention whenever they appear. A company routing revenue through entities controlled by insiders, or buying services from vendors with undisclosed ties to management, creates perfect cover for collusion. These transactions are not automatically fraudulent, but when they lack a clear business purpose or carry unusual terms, they warrant serious scrutiny.

Control and Behavioral Red Flags

Collusion turns controls into theater. The controls appear to function, but the people operating them have agreed to let specific transactions pass. Reading that requires looking at how controls actually operate rather than how they look on paper.

Management override is the single most dangerous control failure. When a senior executive can bypass the normal approval process for vendor payments, journal entries, or contract terms, the control environment becomes decorative. The three-way match between purchase order, receiving report, and invoice is meaningless if a vice president can authorize payment without it. Auditors should specifically test whether management has used override authority and what went through that channel.

Poor separation of duties creates the conditions for collusion even where nobody started out intending fraud. When the same person can authorize a purchase, confirm receipt, and approve payment, the temptation grows over time. In a collusive scheme, poor separation also means fewer people need to be recruited. Overly centralized decision-making, where a small group controls every significant accounting judgment, produces the same effect.

High volumes of manually created journal entries posted outside normal business hours or at period-end deserve close examination. The PCAOB has identified several characteristics that make a journal entry suspicious: entries to accounts rarely used in normal operations, entries made by people who do not normally post journal entries, entries with round-number amounts, and post-closing entries with little or no description.1Public Company Accounting Oversight Board. Audit Focus: Journal Entries A cluster of entries matching those descriptions is a strong signal that someone is making adjustments designed to move the financial statements.

On the human side, intense pressure from executives to hit specific earnings targets is the most common precondition for collusive fraud. When bonuses, promotions, or continued employment ride on hitting a particular number, the message filters down: find a way to make the numbers work. Accounting staff who feel their livelihoods depend on meeting an unrealistic target become susceptible to rationalizing entries they know are wrong.

Unusual turnover in finance and internal audit roles is another telling pattern. Employees who discover fraud but lack a channel to report it often simply leave. When a company cycles through controllers, internal auditors, or accounting managers faster than normal, it may reflect people unwilling to participate in what they are seeing. The inverse is equally concerning. A long-tenured employee who refuses to take vacation, delegates nothing, and guards their processes obsessively may be protecting a scheme that would unravel in their absence.

How Forensic Accountants Look Deeper

When red flags accumulate, forensic specialists apply techniques that go beyond conventional audit sampling. Journal entry testing analyzes the full population of entries rather than a sample, filtering across millions of transactions for the PCAOB-flagged attributes.1Public Company Accounting Oversight Board. Audit Focus: Journal Entries The power is in aggregation. One round-number entry to an unusual account means nothing. Two hundred of them, posted in the final week of the quarter by the same user, is a pattern worth investigating.

Benford’s Law adds a statistical lens. In large sets of real financial transactions, the digit 1 appears as the leading digit about 30% of the time, while 9 appears only about 5%. When humans fabricate numbers, they tend to distribute digits more evenly or cluster around psychologically comfortable amounts, and those deviations are detectable. The analysis works best with datasets of at least 5,000 records and does not prove fraud by itself, but it efficiently identifies which accounts or transaction types warrant a closer look.

Network analysis maps relationships between people, vendors, accounts, and transactions. When the same vendor address appears across multiple supposedly independent suppliers, or the same bank account receives payments from several entities inside the company, those connections surface. Line-by-line auditing almost never catches them. A network graph makes them obvious.

Why an External Audit Alone Will Not Catch Collusion

There is a widespread assumption that an external audit should catch any significant fraud. Professional auditing standards explicitly acknowledge that it does not, and collusion is the main reason. The risk of missing a material fraud is higher than the risk of missing an honest error, precisely because fraud involves deliberate concealment. Collusion makes it worse by causing auditors to rely on evidence that looks genuine but was fabricated cooperatively.

An auditor’s ability to detect fraud depends on the skill of the perpetrators, how frequently they manipulate records, how many people are involved, and how senior those people are. When senior management orchestrates the scheme, they can direct which documents the auditor sees, control which employees the auditor interviews, and override the very controls the auditor is testing. That is a structural limitation, which is why insider tips and forensic analytics matter so much.

Reporting Collusion and Protecting Yourself

Because audits have built-in limits against collusion, tips from insiders remain the most effective detection method. Federal law provides two overlapping protections and incentives for people who report accounting fraud at public companies.

The SEC Whistleblower Program

Under Section 21F of the Securities Exchange Act, anyone who voluntarily provides the SEC with original information leading to a successful enforcement action can receive an award of 10% to 30% of total sanctions collected, as long as those sanctions exceed $1 million.2Office of the Law Revision Counsel. 15 U.S. Code 78u-6 – Securities Whistleblower Incentives and Protection Awards come from the collected sanctions, not taxpayer funds.3U.S. Securities and Exchange Commission. Annual Report to Congress: SEC Whistleblower Program The program also prohibits employers from retaliating through termination, demotion, suspension, or harassment. A whistleblower who experiences retaliation can bring a private lawsuit in federal court within six years and recover reinstatement, double back pay, and attorney fees.

Sarbanes-Oxley Anti-Retaliation

Separately, SOX Section 806 protects employees of public companies who report conduct they reasonably believe violates federal fraud statutes or SEC rules. The protection covers disclosures made internally to a supervisor, externally to a federal agency, or to Congress. Employers cannot fire, demote, suspend, or otherwise punish an employee for a protected disclosure.4Office of the Law Revision Counsel. 18 U.S. Code 1514A – Civil Action to Protect Against Retaliation in Fraud Cases

A SOX retaliation complaint must be filed with the Occupational Safety and Health Administration within 180 days of the retaliatory act or the date you became aware of it. Successful claimants are entitled to reinstatement, back pay with interest, and compensation for special damages including litigation costs and attorney fees.4Office of the Law Revision Counsel. 18 U.S. Code 1514A – Civil Action to Protect Against Retaliation in Fraud Cases That window is tight, and missing it can forfeit the claim. If you believe you are being retaliated against, document each incident as it happens.

How to File

The SEC accepts tips, complaints, and referrals through its online submission system.5U.S. Securities and Exchange Commission. Report Suspected Securities Fraud or Wrongdoing Submitting online generates a confirmation number for your records. To qualify for a monetary award, the information must be original, meaning it was not already known to the SEC from another source. Before filing externally, preserve copies of documents supporting your concerns, but do not remove proprietary company records in ways that violate your employment agreement. An attorney experienced in whistleblower cases can help navigate that line.

What Happens to the Company and the People Involved

When collusion comes to light at a public company, the regulatory response moves fast and from several directions at once. The SEC can bring civil enforcement actions under the Securities Exchange Act of 1934, with monetary penalties structured in three tiers that scale with the severity of the conduct. For each violation, the penalty is the greater of the per-violation cap or the total profit the defendant gained from the fraud.6U.S. Securities and Exchange Commission. Securities Exchange Act of 1934 – Authority and Discretion of the Commission – Section: Money Penalties in Civil Actions The statutory caps are adjusted upward annually for inflation.7Securities and Exchange Commission. Adjustments to Civil Monetary Penalty Amounts In major cases, penalties have reached hundreds of millions of dollars, and the company is typically forced to restate its financial statements, which alone can wipe out billions in market value. Companies that fail to cure material deficiencies or hold minimum listing requirements can also be delisted from stock exchanges, cutting off access to public capital markets.8The Nasdaq Stock Market. Nasdaq Rule 5800 Series – Failure to Meet Listing Standards

Under SOX Section 302, the CEO and CFO must personally certify in each annual and quarterly filing that the financial statements contain no material misstatements, that they fairly present the company’s financial condition, and that they have evaluated the effectiveness of internal controls.9Office of the Law Revision Counsel. 15 U.S. Code 7241 – Corporate Responsibility for Financial Reports Signing those certifications while collusion is ongoing compounds the liability.

Individuals face overlapping federal criminal exposure:

On the civil side, the SEC can seek disgorgement of all profits the individual gained, with no dollar cap. The SEC generally has five years to bring a disgorgement claim, extended to ten years where the fraud involved scienter. Courts can also permanently bar individuals from serving as officers or directors of any public company.14Office of the Law Revision Counsel. 15 U.S. Code 78u – Investigations and Actions Defrauded shareholders then file class actions on top of all of it, and those settlements frequently exceed the government penalties. Between disgorgement, penalties, restitution, and defense costs, the combined exposure often ends in personal bankruptcy for the people who ran the scheme.