This study covers 508 cases of occupational fraud totaling over $761 million in losses. All information was provided by the Certified Fraud Examiners (CFEs) who investigated these cases. Organizations suffer tremendous costs as a result of occupational fraud and abuse. Participants in this study, anti-fraud specialists with a median 16 years’ experience in the fraud examination field, estimate that the typical U.S. organization loses six percent of its annual revenues to fraud. Applied to the US Gross Domestic Product for 2003, this translates to approximately $660 billion in total losses.

Our data strongly supports Sarbanes-Oxley’s requirement for audit committees to establish confidential reporting mechanisms. Occupational frauds in our study were much more likely to be detected by a tip than through other means such as internal audits, external audits, and internal controls. Among frauds committed by owners and executives, which tend to be the most costly, over half of all cases were identified by a tip.

Confidential reporting mechanisms reduce fraud losses significantly. The median loss among organizations that had anonymous reporting mechanisms was $56,500. In organizations that did not have established reporting procedures, the median loss was more than twice as high.

While Sarbanes-Oxley only requires publicly traded companies to establish confidential reporting mechanisms for employees, our data strongly suggests that these programs should also embrace third-party sources such as customers and vendors. Among cases that were detected by a tip, 60 percent of the tips came from employees, 20 percent of the tips came from customers, 16 percent came from vendors, and 13 percent came from anonymous sources. Companies that have implemented basic employee hotlines to ensure Sarbanes-Oxley compliance could detect significantly more frauds by making their hotlines available to third parties as well.

More effective internal controls are needed to detect fraud. Internal Controls ranked fourth – behind By Accident – in terms of the number of frauds detected in our study. Furthermore, the frauds that were detected by internal
controls tended to be relatively small, with a median loss of $40,000, which was by far the lowest of any detection method. More effective types of internal controls are needed to detect fraud, especially larger frauds that may involve senior personnel overriding or circumventing traditional internal controls.

Small businesses suffer disproportionately large losses due to occupational fraud and abuse. The median cost experienced by small businesses in our study was $98,000. This was higher than the median loss experienced by all
but the very largest organizations. Small businesses are less likely to be able to survive such losses and should better protect themselves from fraud.

The loss caused by occupational fraud is directly related to the position of the perpetrator. Frauds committed by owners and executives caused a median loss of $900,000, which was six times higher than the losses caused by managers, and 14 times higher than the losses caused by employees. Despite this fact, organizations were less likely to take legal action against owners and executives who had committed fraud than they were against employees and managers. This may remove a useful deterrent and unnecessarily expose such organizations to additional high-dollar frauds.

Most occupational fraudsters are first time offenders. Only 12 percent of the fraudsters in our study had a previous conviction for a fraud-related offense. Criminal background checks can help organizations make informed hiring decisions, but they will not weed out all fraudsters because most frauds are committed by apparently honest employees.

The most cost-effective way to deal with fraud is to prevent it. According to our study, once an organization has been defrauded it is unlikely to recover its losses. The median recovery among victim organizations in our study was only 20 percent of the original loss. Almost 40 percent of victims recovered nothing at all.