David H. Glusman and Michael J. Molder
David H. Glusman and Michael J. Molder ()

For centuries, ships have signaled messages of distress to each other through colored flags arranged in specific positions. Your business may be sending you signals of distress, including catastrophic employee dishonesty. If you can read the signs, you can head off disaster, but first you need to be able to recognize the red flags of fraud.

In his 1973 book, “Other People’s Money,” Donald R. Cressey wrote, “Trusted persons become trust violators when they conceive of themselves as having a financial problem which is non-shareable, are aware this problem can be secretly resolved by violation of the position of financial trust, and are able to apply to their own conduct in that situation verbalizations which enable them to adjust their conceptions of themselves as trusted persons with their conceptions of themselves as users of the entrusted funds or property.” His analysis led to the development of the fraud triangle: pressure (or motivation), opportunity and rationalization. Like a stool absent one of these legs, most frauds will collapse.


Motivation to commit fraud is typically financial need. It can arise from illicit activities, such as an addiction or extramarital affair. Or it can come from perfectly normal needs, such as a spouse’s job loss, costs of caring for an ill or aging family member, or fear of investor response to adverse financial reports. Some of the red flags of pressure to commit fraud are:

Employees living beyond their means: A common indication that an employee is under pressure to commit fraud is a lifestyle that is inconsistent with official compensation. While there are many alternative explanations (inheritance, asset sales, spouse promotions or bonuses, etc.), a clerical employee driving a luxury car or wearing expensive jewelry is an indication of possible fraud.

Unexpected family disruption: Showing an interest in staff personal situations such as changes in marital status or a family member’s illness is part of the social contract. We spend a lot of time with our co-workers, and empathy for these types of family disruptions can help make the workplace a more productive environment. At the same time, it provides insight into financial pressures that can lead to fraud.

Indicia of addictive behavior: Addicts tend to follow certain behavior patterns, regardless of the nature of the addiction. As discussed in “What Are Addictive Behaviors?” (www.indiana.edu/~engs/hints/addictiveb.html), addicts obsess about the object of their addiction, become irritable and depressed when prevented from pursuing in their addiction, and demonstrate low self-esteem. These types of behavior can manifest in the workplace. Problematic as some addictions can be, even if the addiction does not impair function in the workplace, it can impose significant financial obligations on the addict, which, in turn, pressures the addict to steal to support the habit.


Capability to commit occupational fraud typically arises from a lapse in internal controls. The organization places the perpetrator in a position of trust that enables the individual to circumvent procedure with little or no risk of being caught. Some of the red flags of opportunity to commit fraud are:

Concentration of duties: The most common recommendation from accountants for improving internal controls is segregation of duties. Separating the access to assets from the authorization to utilize assets from the accounting for those assets is one of the most effective means to combat occupational fraud. Unfortunately, employers often will disregard that recommendation because they believe it involves hiring additional staff or because they are concerned that employees will perceive it as a lack of trust.

Refusal to take vacations or other paid leave: Ongoing thefts generally involve a circumvention of some form of internal control. Examples include pocketing the paychecks of ghost employees, controlling the bank statements that reflect unauthorized transactions and receiving deliveries of personal products that the employer paid for. Perpetrators will avoid time off of the job to prevent others from assuming duties that will reveal the theft.

The “too-successful” bidder: When one vendor always seems to get the contracts to supply goods and services to the enterprise, it may be a sign of a side deal with the employee granting those contracts.

Arbitrary transaction limits: Many organizations set thresholds for independent review of transactions. For example, all checks more than $5,000 require a manual signature or product purchases more than $50,000 must be made through an RFP. Perpetrators use these arbitrary thresholds to process fraudulent transactions that slip through the system, such as multiple checks for $4,900 or buying $100,000 of product from friends or family at inflated prices using four separate purchase orders.


As the Association of Certified Fraud Examiners reports, “The vast majority of fraudsters are first-time offenders with no criminal past; they do not view themselves as criminals. They see themselves as ordinary, honest people who are caught in a bad set of circumstances.” Setting aside the minority of people who simply set out to commit fraud, most perpetrators need to be able to justify their conduct to themselves. That justification can arise from being passed over for promotion, a perception that other employees are receiving unwarranted, favorable treatment, or a belief that the organization or management is being dishonest. Some of the red flags of rationalization to commit fraud are:

Complaints about preferential treatment: A common rationalization for occupational fraud is that the perpetrator “deserves” it because some other employee or department is getting apparently unwarranted special treatment. Frequent complaints that others are “do-nothings,” “pampered” or “privileged” are indications that an employee may be working up the justification for theft.

Unrealistic performance expectations: Employees’ expectations about bonuses, raises and promotions color how they perceive their employers’ treatment. Employees who are expecting large bonuses because the organization has been particularly successful or believe that they are “up” for a promotion may consider being passed over as validation for theft.

Tone at the top: Perhaps the single most common rationalization for employee misconduct is a perception that the behavior is consistent with management intent. Situations where management flouts company policies, circumvents internal controls or dismisses regulatory requirements can morph into an employee’s justification to do that as well.

Hardly an exhaustive list, none of these behaviors are proof of employee theft. As red flags are raised on the bow, the captain must consider the prospect of danger on the horizon and take immediate steps to evaluate that potential.

David H. Glusman is partner-in-charge of Marcum LLP’s Philadelphia office and heads the region’s litigation support services and marital dissolution practice groups. Glusman has experience in forensic accounting and business valuation, estate and trust analysis for high-net-worth individuals, and in medical consulting for physician practices and hospital-physician-related issues.

Michael J. Molder is a senior manager in the advisory services division of the firm. Molder specializes in litigation support services in the firm’s Philadelphia office and is a member of its marital dissolution practice group. He helps solve cases involving allegations of financial impropriety and has counseled and acts as an accounting expert in such matters.