Internal fraud in the C-suite

AUTHORS

Is your organisation vulnerable to internal fraud at the executive level?

It can be difficult to imagine that someone entrusted to lead your organisation could commit occupational fraud. This is a person you have trusted with your organisation’s most significant decisions, assets, information and relationships.

However, internal fraud can occur at any level of an organisation. When white collar crime involves the C-suite, the very authority that enables them to be effective leaders also makes fraud controls easier to evade.

To be clear, the overwhelming majority of senior executives act with integrity.

This article is not about them. It also isn’t about discussing the salacious details of the high-profile corporate frauds that make media headlines. Sorry.

Rather, it is about the governance and organisational structures that enable occupational fraud. Because there is a simple principle that should sit at the centre of every governance framework: trust is not a control.

For boards and audit committees, it is critical to ensure that your organisation’s controls remain effective when applied to its most powerful people.

The challenge of preventing fraud at senior levels

Internal fraud (also known as occupational fraud) is when someone from inside an organisation abuses their access to internal systems for personal financial gain. This means that internal fraud always begins with trust. And the higher that trust sits, the more damage it can do when it is betrayed.

Organisations typically invest considerable effort in designing controls to prevent and detect fraud.

Common examples of these controls include:

segregation of duties
financial delegations
procurement controls
expense approvals
system access restrictions
independent review.

These controls are typically effective for the majority of your employees, because they don’t have the authority to circumvent the controls.
The question is, would they still work on your CEO, CFO, COO or another senior executive? If you’re not sure, then you may have a critical vulnerability in your fraud governance framework.

Management override and occupational fraud

Senior executives typically have broader access to systems, financial information and commercially sensitive data. They may hold higher transaction and approval limits and may even have the authority to approve an exception to established policies and procedures. Their position of authority also means they can exert pressure on the employees who are usually responsible for applying controls or challenging transactions.

This is called management override, and it is one of the reasons frauds involving senior management can be particularly difficult to prevent and detect.

Of course, you can and should continue to trust your senior executives. However, good governance requires that appropriate and proportionate checks and balances apply to every individual.

No one should be able to bypass these checks because of their seniority, reputation or length of service.

The biggest occupational frauds occur at the most senior levels

The Association of Certified Fraud Examiners (ACFE) report, Occupational Fraud 2026, identifies a positive correlation between a perpetrator’s seniority and the financial impact of occupational fraud.

The report found that although owners and executives only committed 16% of frauds, this group caused the largest median loss of USD $475,000.

Essentially, the higher a fraud perpetrator sits within an organisation, the greater the potential financial impact can be.
Our own experience conducting fraud and forensics investigations supports this finding. RSM Australia’s Fraud & Forensic Services team has investigated a range of allegations involving executives, owners and highly trusted senior employees. Four examples:

Code of conduct and policy breaches by the then CEO of a state government entity. The CEO was stood down following our investigation.
A former CFO of a property development company who diverted money owed to the business into a personal bank account and created fake supplier invoices to pay themselves.
A CEO of a national professional association who misused the corporate credit card, received anomalous remuneration and bought a vehicle without Board approval. The investigation led to a confession, repayment of the funds and benefits misappropriated, and the CEO’s dismissal.
A $5m fraud in a private family business, where the “trusted” CFO stole over several years to fund gold bullion and construction and renovation payments on multiple investment properties.

Although these cases were all different, they had one element in common: trust.

Long-serving executives and employees accumulate significant organisational knowledge, autonomy and influence. Their years of service builds their reputation within the organisation, understandably earning a high degree of trust.

Trust becomes risk when it weakens controls. Consider the most trusted people in your organisation and ask yourself if that position of trust translates into:

reduced scrutiny
weakened segregation of duties
excessive access
an assumption that controls are unnecessary for them.

If the answer is yes, your organisation may be exposed.

The longer somebody occupies a position of trust, the more important it can be to ensure that the controls surrounding that position remain effective.

Five controls to mitigate C-suite occupational fraud

Managing executive fraud risk does not mean treating senior leaders with suspicion. It means ensuring authority does not remove accountability.

In Australia, AS 8001:2021 Fraud and Corruption Control provides a recognised framework to prevent, detect and respond to fraud and corruption risks. It asks organisations to keep their policies current and to make sure controls operate as intended, not just as written.

For internal fraud at senior levels, boards should focus on five areas.

Design controls that withstand management override

Who approves an exception when the person requesting it sits at or near the top? A control that can be routinely overridden by the person it is meant to oversee provides limited protection.

Independent oversight should cover:

executive expenses and corporate credit cards
executive remuneration and changes to employment benefits
related-party transactions
procurement decisions and conflicts of interest
creation of new vendors and changes to vendor bank account details
significant or unusual journal entries
changes to financial delegations
transactions or decisions outside established policy.

Give boards and audit committees real visibility

Boards can only challenge what they can see. Reporting should surface unusual transactions, repeated control overrides, unmanaged conflicts of interest and related-party dealings. It should also come from a source sufficiently independent of the executives being reported on.

If the CEO or CFO is involved, who is independently checking?

Know who you are appointing and keep knowing them

Workforce screening protocols should extend to senior executives and other high-trust roles. Depending on the role and risk profile, this could include:

qualification and employment checks,
directorship searches,
conflict-of-interest enquiries,
adverse media reviews,
scoped open-source intelligence
where appropriate and legally permissible, consent-based criminal history or other background checks.

For particularly high-risk positions, you may wish to consider periodically refreshing forensic due diligence and open-source intelligence checks. This ensures your information is up-to-date rather than treating screening as a pre-employment exercise. This enables you to identify conflicts and integrity risks that may need to be managed.

Make it safe to speak up

Employees are often the first to notice unusual behaviour, unexplained transactions or attempts to bypass controls. One effective detection method is fit-for-purpose whistleblower reporting mechanisms. In the ACFE report shared above, 52% of fraud in the Asia-Pacific region is first detected by a tip.

Whistleblower channels should allow confidential and, where appropriate, anonymous reports. You also need escalation protocols for allegations involving senior management, so a concern about the CEO does not end up on the CEO’s desk.

Watch for patterns, not single red flags

No single indicator proves fraud, and one may have an entirely innocent explanation. A pattern is different. Watch for combinations of:

repeated override of established controls
unwillingness to delegate or share duties
resistance to internal audit, scrutiny or independent review
unusually close relationships with particular suppliers or customers
unmanaged or undisclosed conflicts of interest
unusual or inadequately supported executive expenditure
transactions with no clear commercial rationale
excessive control over financial information or reporting
unexplained departures from procurement or approval procedures
intimidation or marginalisation of employees who question decisions.

The ACFE also reports the personal red flags most often seen in occupational fraud cases:

living beyond one’s means (39% of cases)
financial difficulties (29% of cases).

Trust is essential, but it is not a control

C-suite fraud is not a new phenomenon and there is no single control that will eliminate the risk.

Effective prevention and detection instead rely on a combination of governance, internal controls, organisational culture, appropriate scrutiny, speak-up arrangements and the willingness to challenge unusual activity irrespective of the seniority of the individual involved.

Strong governance requires appropriate accountability at every level of an organisation.

Controls should apply proportionately to everyone. Employees should be equipped to identify and challenge management override. Boards should have visibility over relevant exceptions. Employees should feel safe to speak up. And concerns involving senior executives should be assessed independently and objectively.

Ultimately, authority should never remove accountability.

Could executive fraud be a blind spot in your organisation?

To discuss executive fraud risk, fraud and corruption controls, whistleblower arrangements, forensic due diligence or concerns about suspected executive misconduct, contact Tony Grieves, Partner, or Milind Sheth, Director, from RSM Australia’s Fraud & Forensic Services team.