FEI Dallas
The community for forward‑thinking finance leaders in North Texas.
The Association of Certified Fraud Examiners studied 2,402 occupational fraud cases across 143 countries and territories for its 2026 report. The cases were drawn from a survey of Certified Fraud Examiners run between July and September 2025, covering investigations that took place from January 2024 onward. Collectively those cases caused more than $3.4 billion in losses, with a median loss of $104,000 per case.
One finding in it deserves more attention than it usually gets: more than half of all cases involved either a lack of internal controls or an override of existing controls.
The ACFE reports those two together and its 2026 release does not publish a split between them, so there is no basis for saying which is more common. They are worth separating anyway, because they are different problems. One is a control that was never built. The other is a control that existed, worked as designed, and was set aside.
A controls project addresses the first. Build the control, document the policy, separate the duties. That work is necessary, and it is also the work that tends to get done, because it produces something you can show a board or an auditor. An environment where a control cannot quietly be set aside produces no comparable artifact, which is part of why it lags behind.
The ACFE reports that smaller businesses have the highest median losses of any organization size, with organizations above 10,000 employees a close second. Since those are the top two, every size in between sits below both.
That is a useful thing to know and an easy thing to misread. A company in the middle of the range is not safer than one at either end. It has a lower median, and the median is not where the risk sits.
The composition of perpetrators has moved over three decades, and the direction is worth knowing when you design a control.
In 1996 the ACFE recorded staff-level employees committing 58 percent of frauds, managers 30 percent, and owners or executives 12 percent. In its 2026 report, employees and managers each accounted for 41 percent of cases and owners or executives for 16 percent. Both of the senior categories grew while the staff-level share fell. The ACFE also found that median losses caused by owners and executives were more than nine times greater than those caused by employees.
The report does not say who overrode controls, so what follows is an inference rather than a finding. A control built to constrain staff-level employees, and no one above them, is a control aimed at the category of perpetrator whose cases cost the least. That is worth something. It is not worth what it appears to be worth on an org chart.
The same report records corruption rising from 10 percent of cases in 1996 to 45 percent today. The ACFE counts bribery and conflicts of interest within corruption, and both of those describe someone using a position rather than working around one.
These are patterns worth checking rather than findings from the study. Each one describes a control that was correct when it was written and was never revisited:
• Segregation of duties that worked when one person handled a manageable volume, and silently stopped working when the volume multiplied and the person did not change
• Approval thresholds set when the amount felt significant, now cleared routinely without thought
• Review that was genuine at twenty transactions a month and became a signature at two hundred
• Vendor master and banking detail access that was given to whoever needed it, and never taken back
• A standing exception for the founder or owner, which made sense when they knew every transaction personally
That last one deserves its own sentence. The exception that exists because the owner used to know everything is the exception that persists long after they stopped knowing everything.
The median fraud scheme in the study lasted 12 months before detection. Twenty percent of cases exceeded $1 million in losses, and while the median loss was $104,000, the average was $1,457,000, roughly fourteen times the median.
That gap is the part worth planning around. A distribution where the average sits fourteen times above the median has a long tail, and a plan built around the median leaves the expensive end of that distribution unplanned.
Tips were the most frequently used detection method in the study, accounting for 43 percent of cases, and more than half of those tips came from employees.
That is an argument for funding a reporting channel properly rather than treating it as a compliance nicety. It is not an argument that controls do not matter. The ACFE also reports that the presence of anti-fraud controls, including management review, surprise audits and proactive data monitoring, is associated with lower fraud losses and quicker detection. The two findings point in the same direction: detection is the variable you can most readily move.
The report also found that 84 percent of perpetrators displayed at least one behavioral red flag before detection. A displayed signal needs somebody positioned to notice it, which is an argument for the people around a role as much as for the controls over it.
Three questions, answerable in an afternoon:
• Which approval thresholds have not been revisited since the company was materially smaller, and what would they be if set today?
• Who can override a control, what is logged when they do, and who reviews that log?
• If an employee suspected someone two levels above them, what exactly would they do, and would they believe it was safe?
The third question tends to produce silence in the room, and it is the one the detection data speaks to most directly.
Controls and risk come up regularly in our programming, often raised by members working through exactly this transition. Join us at an upcoming session: https://feidallas.org/events-calendar/
Leave a Reply