{"id":6741,"date":"2026-07-23T00:14:18","date_gmt":"2026-07-22T22:14:18","guid":{"rendered":"https:\/\/maraz.es\/?p=6741"},"modified":"2026-07-24T12:44:55","modified_gmt":"2026-07-24T10:44:55","slug":"internal-fraud-in-business-an-action-guide","status":"publish","type":"post","link":"https:\/\/maraz.es\/en\/internal-fraud-in-business-an-action-guide\/","title":{"rendered":"Internal Fraud in Business: An Action Guide"},"content":{"rendered":"<h2><strong>Interan Fraud in Business<\/strong><\/h2>\n<p><strong>Discovering that someone on the inside \u2014 a trusted employee, an executive, even a business partner \u2014 may be committing fraud is one of the most destabilising experiences in a business owner\u2019s life. It is not just the money: it is the betrayal. And precisely because it hurts so much, it is the moment when the most mistakes are made.<\/strong> This guide explains, step by step and with the reasoning behind every decision, how to act on a suspicion of internal fraud without destroying evidence, without violating rights and without compromising the recovery of the money.<\/p>\n<h2><strong>Internal Fraud in Numbers<\/strong><\/h2>\n<p>The global reference study is the &#8220;Occupational Fraud 2024: A Report to the Nations&#8221; by the ACFE, based on 1,921 real cases across 138 countries. Its conclusions: the typical organisation loses <strong>5% of its annual revenue<\/strong> to fraud; the median loss per case was <strong>USD 145,000<\/strong> (24% more than in the previous edition); and the median scheme took <strong>12 months to be detected<\/strong>, draining around USD 9,900 a month. <strong>43% of frauds come to light through tips<\/strong> \u2014 three times more than any other method \u2014 and more than half of those tips come from employees themselves.<\/p>\n<p>And one figure that speaks directly to the middle market: companies with fewer than 100 employees suffer a median loss of USD 141,000, almost the highest by organisation size, with far less capacity to absorb it.<\/p>\n<p>The Spanish picture is consistent: Deloitte\u2019s Fraud Survey estimated the impact at <strong>2.45% of turnover<\/strong>, with supplier fraud and misappropriation among the most frequent schemes. And the most painful part: <strong>60% of companies recover less than 25% of what they lose<\/strong>. The underlying thesis of this guide follows directly from the data: fraud runs for too long before being detected and is almost never fully recovered. The quality of your reaction in the first few days decides which side of that statistic you end up on.<\/p>\n<h2><strong>The Three Major Types of Internal Fraud<\/strong><\/h2>\n<ul>\n<li><strong>Asset misappropriation.<\/strong> The most frequent (89% of cases, median loss of USD 120,000): manipulation of cash and collections, false invoices and fictitious suppliers, ghost payroll, inflated expenses, altered payments and transfers.<\/li>\n<li>Present in 48% of cases (median of USD 200,000): bribes, kickbacks and \u2014 very typical of the middle market \u2014 hidden conflicts of interest between the purchasing manager and a supplier.<\/li>\n<li><strong>Financial statement fraud.<\/strong> The least common (5%) but the most expensive (median of USD 766,000): inflating revenue, hiding liabilities, overstating inventory. It is almost always the territory of executives, and its direct aim is usually not their own pocket, but dressing up results to earn bonuses, sustain financing or hide poor management.<\/li>\n<\/ul>\n<p>*Note: 84% of fraudsters displayed at least one <strong>behavioural red flag<\/strong> before being discovered: living beyond their means (39%), personal financial difficulties (27%) or an unusually close relationship with a supplier or customer (20%). Add to these the organisational signals: the employee who never takes holidays or lets anyone touch &#8220;their&#8221; tasks, the recurring discrepancies that &#8220;always end up being explained&#8221;, the opaque bookkeeping. One nuance, to avoid witch hunts: there is no fraudster profile \u2014 87% are first-time offenders \u2014 and no single red flag proves anything. But several together justify taking a closer look.*<\/p>\n<h2><strong>The Fraud Triangle<\/strong><\/h2>\n<p>Economic criminology has explained it for decades with Donald Cressey\u2019s <strong>fraud triangle<\/strong>: <strong>for an honest person to cross the line, three elements must come together:<\/strong><\/p>\n<ul>\n<li><strong>Pressure<\/strong> (personal debt, addictions, an unsustainable lifestyle, or the professional pressure of unattainable targets);<\/li>\n<li><strong>Opportunity<\/strong> (weak controls, excessive trust, concentration of duties in a single person);<\/li>\n<li>and <strong>rationalisation<\/strong> (the story fraudsters tell themselves: &#8220;it\u2019s a loan&#8221;, &#8220;they owe me&#8221;, &#8220;everyone here does it&#8221;). Whoever commits fraud looks for a justification for their conduct.<\/li>\n<\/ul>\n<p><strong>Of the three vertices, the only one the company fully controls is opportunity.<\/strong> That is why effective prevention is not about hiring honest people \u2014 87% of fraudsters had no criminal record \u2014 but about closing the doors.<\/p>\n<h3><strong>The Incentive Nobody Watches: Poorly Designed Variable Remuneration<\/strong><\/h3>\n<p><strong>There is a fourth factor that deserves its own chapter because the company itself creates it: poorly designed variable remuneration systems.<\/strong> An aggressive bonus tied exclusively to the year\u2019s EBITDA, impossible sales targets, or a general manager\u2019s pay linked to accounting results that they themselves prepare are structural invitations to manipulate. It is no coincidence that financial statement fraud is the executive\u2019s territory: whoever holds the incentive often also holds the keys to the books.<\/p>\n<p>The solution is not to eliminate variable pay, but to design it well: auditable metrics beyond the beneficiary\u2019s control, multi-year horizons that discourage one-off accounting windfalls, clawback clauses if results are later restated, and long-term alignment schemes such as <a href=\"https:\/\/maraz.es\/en\/phantom-shares-how-to-align-and-retain-key-talent\/\">phantom shares<\/a>, which tie the reward to real, sustained value creation rather than a single year\u2019s snapshot.<\/p>\n<h2><strong>Employee Fraud and Executive Fraud:<\/strong><\/h2>\n<p>Not all internal fraud is the same, and the key difference is the position of the perpetrator. The ACFE data are eloquent: fraud committed by <strong>rank-and-file employees<\/strong> has a median loss of around USD 60,000; by <strong>middle managers<\/strong>, around USD 184,000; and by <strong>owners and senior executives<\/strong> it soars above USD 450,000 \u2014 and takes considerably longer to detect.<\/p>\n<p>The reason is structural: executives do not need to circumvent the controls, they can <strong>override<\/strong> them (the so-called *management override*), they have access to more information, they sign alone and they arouse fewer suspicions precisely because of their position. And where there is <strong>collusion<\/strong> \u2014 two or more people acting in concert \u2014 losses multiply and controls based on cross-checking are neutralised.<\/p>\n<p>The practical consequence: the controls that work for employee fraud (reconciliations, dual signatures, cash counts) are not enough for executive fraud. The latter requires governance counterweights: a board with its own information, external audit with direct access, a whistleblowing channel that does not report hierarchically to the person under investigation, and effective oversight by the owners. As we analyse in <a href=\"https:\/\/maraz.es\/en\/from-accounting-fraud-to-bankruptcy\/\">from accounting fraud to bankruptcy<\/a>, when poor corporate governance leaves managers without counterweights, fraud is not a risk: it is a matter of time.<\/p>\n<h2><strong>The Step-by-Step Action Guide for Fraud in the Company<\/strong><\/h2>\n<h3><strong>Step 1: What NOT to Do<\/strong><\/h3>\n<p><strong>The first impulse \u2014 confronting, losing your temper, firing on the spot \u2014 is the most expensive mistake. Do not confront the suspect<\/strong>: they will destroy evidence, tip off accomplices and prepare their version; surprise is your only real procedural asset. <strong>Do not dismiss in the heat of the moment<\/strong>: a dismissal without solid evidence usually ends up ruled unfair or void, and weakens any criminal complaint. <strong>Do not discuss it with those around you<\/strong>: rumours alert the fraudster and, if the suspicion proves unfounded, expose you to claims.<\/p>\n<p><strong>Do not investigate on your own<\/strong>, rummaging through their computer or asking a trusted IT person to &#8220;take a look&#8221;: you can turn valid evidence into unlawful, unusable evidence. The golden rule: the fraud has already been running for twelve months on average; a few days of preparation change nothing, improvising changes everything.<\/p>\n<h3><strong>Step 2: Preserving the Evidence Without Violating Rights<\/strong><\/h3>\n<p><strong>The evidence is above all digital and documentary, and preserving it demands technique and law at the same time.<\/strong> Digital evidence is acquired through <strong>forensic cloning<\/strong> (a bit-by-bit copy) with a <strong>hash<\/strong> fingerprint guaranteeing its integrity, in line with the ISO\/IEC 27037 standard and maintaining the <strong>chain of custody<\/strong>; the original is never worked on. The courts demand three attributes: authenticity, integrity and lawfulness.<\/p>\n<p>Lawfulness is the minefield. The employer\u2019s power of control (Article 20.3 of the Spanish Workers\u2019 Statute) collides with the employee\u2019s right to privacy: <strong>Article 87 of the Spanish Data Protection Act (LOPDGDD)<\/strong> requires the company to have established and communicated rules on the use of corporate devices, and the ECHR\u2019s <strong>Barbulescu<\/strong> doctrine and Spanish Supreme Court case law (judgment of 8 February 2018) impose clear prior notice and the threefold test of <strong>suitability, necessity and proportionality<\/strong>.<\/p>\n<p>With a well-communicated usage policy and targeted, proportionate access, the evidence is lawful; without it, or with an indiscriminate mass search, the evidence is excluded from the proceedings and drags the dismissal into nullity with it. If internal interviews are held, they must respect the presumption of innocence, state their purpose and allow legal assistance if requested. This step is taken with a lawyer and an expert \u2014 never alone.<\/p>\n<h3><strong>Step 3: Assembling the Team<\/strong><\/h3>\n<p>A well-run fraud case stands on three legs: the <strong>forensic advisor<\/strong> (economic-financial expert) who reconstructs the facts, traces the flows and quantifies the damage; the <strong>employment lawyer<\/strong>, who secures the dismissal and the deadlines; and the <strong>criminal lawyer<\/strong>, who directs the complaint and the precautionary measures. If the alert came in through the <strong>whistleblowing channel<\/strong>, Spain\u2019s Law 2\/2023 also imposes its own procedure: acknowledgement of receipt within 7 calendar days and closure of the internal investigation within a maximum of 3 months, with strict protection of the whistleblower against retaliation.<\/p>\n<h3><strong>Step 4: The Expert Report, the Backbone of the Case<\/strong><\/h3>\n<p>The <a href=\"https:\/\/maraz.es\/en\/forensic-report-on-accounting-fraud\/\">economic-financial expert report<\/a> translates the fraud into the judge\u2019s language: how much was taken, how, for how long and leaving what trail. Article 335 of the Spanish Civil Procedure Act configures it as the instrument for providing the technical knowledge the court lacks; to be worth anything, it must be impartial, methodologically sound, respect the chain of custody and be <strong>ratified<\/strong> by the expert in court, where they will face cross-examination by the parties. Modern forensic work cross-references data: supplier master files against employees\u2019 bank accounts, delivery notes against actual deliveries, ultimate beneficial owners of interposed companies against the executives under investigation.<\/p>\n<p>And one tactical piece few people know: the report sets the <strong>dies a quo<\/strong>. The 60-day employment law period for sanctioning very serious misconduct (Article 60.2 of the Workers\u2019 Statute) runs from the moment the company has <strong>full and well-founded knowledge<\/strong> of the facts \u2014 in practice, from receipt of the final forensic report \u2014 and, in concealed or continuing misconduct, from the moment the concealment ceases. Well managed, the report puts you in control of the calendar.<\/p>\n<h3><strong>Step 5: The Avenues of Action (Compatible With Each Other)<\/strong><\/h3>\n<ul>\n<li><strong>Employment<\/strong>: disciplinary dismissal for breach of contractual good faith, within the 60-day period.<\/li>\n<li><strong>Civil<\/strong>: a claim for the amounts taken plus damages.<\/li>\n<li><strong>Criminal<\/strong>: depending on the case, <strong>misappropriation<\/strong> (Article 253 of the Spanish Criminal Code) where there is definitive disposal of money or assets received with an obligation to return them \u2014 for money, the courts apply the &#8220;point of no return&#8221; doctrine: the offence is complete when the funds are applied to unrelated purposes making their immediate replacement impossible \u2014; <strong>unfair administration<\/strong> (Article 252) where managers abuse their powers and cause damage without necessarily appropriating anything (unauthorised investments, unsecured loans, below-market sales); <strong>forgery of commercial documents<\/strong> (Article 392) for manipulated invoices and accounts; <strong>fraud\/deceit<\/strong> (Article 248) where deception is involved; and, where there was parallel bookkeeping or simulated expenses, possible concurrence with <strong>tax offences<\/strong> (Article 305). Above EUR 50,000 the aggravated forms apply, with penalties of up to six years and limitation periods of up to ten. All three avenues can run in parallel, and the criminal deadlines \u2014 far longer than the employment one \u2014 almost always remain open even if the dismissal window has lapsed.<\/li>\n<\/ul>\n<h3><strong>Step 6: Recovering the Money<\/strong><\/h3>\n<p>Winning the case is useless if the fraudster has already emptied their accounts \u2014 remember: most companies recover less than a quarter. That is why, alongside the criminal complaint, <strong>precautionary measures<\/strong> are sought: preventive seizure of assets, freezing of accounts, judicial attachment of shareholdings. The judge grants them where there is *fumus boni iuris* (a prima facie case \u2014 which the forensic report sustains) and *periculum in mora* (a real risk of insolvency or frustration). Check the policies too: <strong>employee dishonesty (crime) insurance<\/strong> covers these losses, but usually requires a prior police report and has strict notification deadlines whose breach can leave a genuine claim uncovered.<\/p>\n<h3><strong>Step 7: Remediating and Closing the Gaps<\/strong><\/h3>\n<p><strong>Once the case is resolved, it is time to rebuild: redesign the delegation-of-authority matrix, implement automated segregation of duties in the ERP, regularise the accounting entries affected \u2014 and, where appropriate, file corrective tax returns with the tax authorities to defuse contingencies \u2014 and communicate proactively with banks, auditors and investors to preserve financing lines and reputation,<\/strong> with the support of specialised <a href=\"https:\/\/maraz.es\/en\/financial-advisory\/\">financial advisory<\/a> if the fraud has touched the debt structure or the business plan.<\/p>\n<h2><strong>The Silent Impact: Valuation, M&amp;A and Financing<\/strong><\/h2>\n<p><strong>There is a cost of fraud that does not show up in the income statement but can exceed the theft itself: its effect on the value of the company.<\/strong> In an <a href=\"https:\/\/maraz.es\/en\/mergers-acquisitions\/\">M&amp;A process<\/a>, a fraud uncovered during <a href=\"https:\/\/maraz.es\/en\/financial-due-diligence\/\">due diligence<\/a> forces a clean-up of normalised EBITDA \u2014 unsupported revenue or improper outflows distort the margins on which multiples are applied \u2014 and hardens the contract: the buyer will demand specific indemnities, escrow retentions on the price or, directly, a discount.<\/p>\n<p><strong>And in financing,<\/strong> a fall in EBITDA or an unjustified rise in debt can breach the <a href=\"https:\/\/maraz.es\/en\/financial-covenants-how-to-negotiate-them-with-banks\/\">banking covenants<\/a> and trigger early-repayment clauses, turning a fraud problem into a cash problem. The lesson: unmanaged fraud is paid for three times \u2014 the theft, the litigation and the lost value.<\/p>\n<h2><strong>Preventing Internal Fraud in the Company: Code of Ethics, Compliance and Whistleblowing Channel<\/strong><\/h2>\n<p>Effective prevention operates in three layers. The first is cultural: a real <strong>code of ethics<\/strong> \u2014 not a PDF on the intranet \u2014 that management visibly complies with. The famous *tone at the top* is not rhetoric: when staff see those at the top bending the expense rules or mixing the till with their own pocket, the fraudster\u2019s rationalisation (&#8220;everyone here does it&#8221;) is served.<\/p>\n<p>The second is structural: <strong>internal controls and segregation of duties<\/strong> (whoever requests a payment neither approves nor executes it), dual signatures, reconciliations, surprise audits and data analysis. More than half of all frauds are linked to weak or overridden controls, and organisations with whistleblowing channels and proactive auditing cut both losses and scheme duration in half.<\/p>\n<p>The third is legal: Spain\u2019s <strong>Law 2\/2023<\/strong> requires companies with 50 or more employees to operate a confidential Internal Reporting System admitting anonymous reports, with an independent manager, a register of communications kept for 10 years and protection of the whistleblower; non-compliance carries fines of up to EUR 600,000 for serious infringements and EUR 1,000,000 for very serious ones.<\/p>\n<p>And <strong>criminal compliance<\/strong> under Article 31 bis of the Spanish Criminal Code can exempt the legal entity from liability for offences committed by its executives and employees, provided the prevention model was effective, implemented before the offence and supervised by an autonomous body. One practical note: reacting immediately and rigorously to an alert \u2014 internal investigation, forensic work, measures \u2014 is precisely the best evidence before a judge that your compliance model genuinely works.<\/p>\n<h2><strong>The Role of the Corporate Finance Forensic Advisor<\/strong><\/h2>\n<p>Throughout this journey, the work of the <a href=\"https:\/\/maraz.es\/en\/financial-report-forensic\/\">forensic advisor<\/a> is the technical foundation on which the other pieces rest: <strong>quantifying the damage<\/strong> with method (actual loss and lost profit, without speculation), <strong>tracing the flows<\/strong> from the money\u2019s exit to its final destination, <strong>preparing and ratifying the expert report<\/strong> that sustains the dismissal, the civil claim, the criminal complaint and the precautionary measures, and <strong>supporting the negotiation or the litigation<\/strong> with solid evidence, as we explain in <a href=\"https:\/\/maraz.es\/en\/forensic-finance-how-reports-support-legal-cases\/\">Forensic Finance: how reports support legal cases<\/a>.<\/p>\n<p><strong>At Maraz Corporate Finance we provide this service to companies and law firms, combining expert-witness discipline with a corporate finance perspective: we do not just prove what happened \u2014 we help protect the company\u2019s value while it is resolved.<\/strong><\/p>\n<h2><strong>Conclusion: Think First, Preserve Second, and Only Then Act<\/strong><\/h2>\n<p>Suspecting internal fraud is hard, but the worst decision is the impulsive one. The data say it plainly: those who detect early, preserve well and surround themselves with the right team not only sanction the person responsible \u2014 they recover money, protect the value of their company and come out stronger, with better controls. If you are in this situation, at <strong>Maraz Corporate Finance<\/strong> we can help you quantify the damage, trace the flows and build the expert report that sustains your case, with rigour and discretion. The first conversation, confidential, is best had sooner rather than later.<\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"color: #333399;\"><strong><a style=\"color: #333399;\" href=\"https:\/\/www.linkedin.com\/in\/paula-rey-bonastre-031b9636a\/\" target=\"_blank\" rel=\"noopener\">Paula Rey Bonastre<\/a><\/strong><\/span><\/p>\n<p><span style=\"color: #333399;\"><strong>Analyst &#8211; Maraz Corporate Finance<\/strong><\/span><\/p>\n<p>&nbsp;<\/p>\n<h2><strong><em>FAQs on Internal Fraud<\/em><\/strong><\/h2>\n<h3><strong><em>Can I directly dismiss an employee if I suspect they are stealing from me?<\/em><\/strong><\/h3>\n<p><em>*<strong>Not advisable. Without solid evidence and quantification, the dismissal usually ends up ruled unfair or void and leaves you without leverage to recover the money.<\/strong> First preserve the evidence with professional help; then, with the forensic report and the employment lawyer, structure the dismissal within the 60-day period from full knowledge of the facts.*<\/em><\/p>\n<h3><strong><em>Can I review the employee\u2019s corporate email and computer?<\/em><\/strong><\/h3>\n<p><em>*<strong>Yes, within limits: you must have given prior notice that those media may be monitored<\/strong> (a usage policy compliant with Article 87 LOPDGDD) and the access must be suitable, necessary and proportionate, targeted at the specific investigation (Barbulescu doctrine; Spanish Supreme Court, 8 February 2018). A mass search, or one without prior notice, renders the evidence unlawful and drags the dismissal into nullity.*<\/em><\/p>\n<h3><strong><em>How long do I have to act?<\/em><\/strong><\/h3>\n<p><em>*<strong>Under employment law, very serious misconduct becomes time-barred 60 days after full knowledge<\/strong> \u2014 which in practice is set by receipt of the forensic report \u2014 and in concealed or continuing misconduct the clock runs from when the concealment ceases. Criminal deadlines are far longer: five years for unfair administration and up to ten for aggravated misappropriation, so the criminal route usually remains open even if the employment window has closed.*<\/em><\/p>\n<h3><strong><em>What is the difference between misappropriation and unfair administration?<\/em><\/strong><\/h3>\n<p><em>*<strong>Misappropriation<\/strong> (Article 253 of the Spanish Criminal Code) requires the definitive disposal of money or assets received with an obligation to return them: the &#8220;point of no return&#8221;. <strong>Unfair administration<\/strong> (Article 252) is committed by whoever, holding powers to manage another\u2019s assets, abuses them and causes damage without necessarily appropriating anything: unauthorised investments, unsecured loans, below-market sales.*<\/em><\/p>\n<h3><strong><em>Does variable remuneration encourage fraud?<\/em><\/strong><\/h3>\n<p><em>*<strong>Poorly designed, yes:<\/strong> a bonus tied solely to the year\u2019s results prepared by the beneficiary themselves is a structural incentive to manipulate. Well designed, it aligns: auditable and independent metrics, multi-year horizons, clawback clauses and long-term value schemes such as phantom shares reduce the risk instead of creating it.*<\/em><\/p>\n<h3><strong><em>My company has fewer than 50 employees \u2014 am I required to have a whistleblowing channel?<\/em><\/strong><\/h3>\n<p><em>*<strong>Law 2\/2023 applies from 50 employees. Below that threshold it is not mandatory, but it is highly advisable:<\/strong> tips are the leading fraud-detection method (43% of cases), and a channel \u2014 together with segregation of duties and a genuinely applied code of ethics \u2014 halves both losses and the duration of schemes.*<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Interan Fraud in Business Discovering that someone on the inside \u2014 a trusted employee, an executive, even a business partner \u2014 may be committing fraud is one of the most destabilising experiences in a business owner\u2019s life. It is not just the money: it is the betrayal. And precisely because it hurts so much, it [&hellip;]<\/p>\n","protected":false},"author":8,"featured_media":6740,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[166],"tags":[],"class_list":["post-6741","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-financial-report-forensic"],"acf":[],"_links":{"self":[{"href":"https:\/\/maraz.es\/en\/wp-json\/wp\/v2\/posts\/6741","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/maraz.es\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/maraz.es\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/maraz.es\/en\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/maraz.es\/en\/wp-json\/wp\/v2\/comments?post=6741"}],"version-history":[{"count":0,"href":"https:\/\/maraz.es\/en\/wp-json\/wp\/v2\/posts\/6741\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/maraz.es\/en\/wp-json\/wp\/v2\/media\/6740"}],"wp:attachment":[{"href":"https:\/\/maraz.es\/en\/wp-json\/wp\/v2\/media?parent=6741"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/maraz.es\/en\/wp-json\/wp\/v2\/categories?post=6741"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/maraz.es\/en\/wp-json\/wp\/v2\/tags?post=6741"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}