Most frauds give warning. The ACFE's 2026 study shows the cost of waiting.

The Association of Certified Fraud Examiners published Occupational Fraud 2026: A Report to the Nations in May. It is the fourteenth edition, thirty years after the first, and covers 2,402 cases investigated by Certified Fraud Examiners in 143 countries and territories. Together the cases caused more than US$3.4 billion in losses. The median loss was US$104,000 and the average US$1,457,000, and one case in five exceeded US$1 million. CFEs estimate that organisations lose 5% of revenue to fraud each year.

Time drives the cost. The typical fraud ran for 12 months before it was found. Schemes detected within six months had a median loss of US$40,000, while those that ran for more than five years had median losses above US$1.1 million. Seniority matters as well: losses caused by owners and executives were more than nine times those caused by employees.

The finding that should change how organisations watch for fraud is behavioural. 84% of perpetrators displayed at least one red flag before detection. The red flags linked to the highest median losses were excessive pressure from within the organisation (US$532,000), past legal problems (US$400,000) and an unusually close relationship with a vendor or customer (US$300,000).

What the controls data says

The ACFE reports that management review, proactive data monitoring and surprise audits had the strongest association with lower losses and quicker detection. Training made a measurable difference. Employees who had fraud-awareness training produced more than twice as many tips, and organisations that trained both staff and management had median losses of US$84,000 per case, against US$150,000 where nobody was trained. Tips were again the leading way frauds came to light, in 43% of cases, and more than half of them came from employees.

The mix of schemes has shifted over thirty years. Asset misappropriation appeared in 90% of cases and financial statement fraud in 6%, though the latter carried the highest median loss at US$1 million. Corruption appeared in 45% of cases, against 10% in the first study in 1996.

Turning red flags into controls

Line managers, colleagues and procurement teams see red flags long before an auditor arrives. Each of the costliest ones has a matching control:

• An unusually close vendor relationship: test vendor masters and purchase data against declared interests, and rotate who approves the largest suppliers.
• Pressure from within the organisation: look harder at units whose targets can only be met by bending a rule, and at sudden turnarounds.
• Refusal to take leave: make leave and rotation mandatory in roles that control cash, stock or vendor approvals.
• Past legal problems: verify backgrounds at hiring and again at promotion into sensitive roles.

Most frauds are seen before they are found. Losses grow in the gap between the two.

Questions for the board

• Which of our controls would find a fraud in six months rather than eighteen?
• Do we run proactive data monitoring, or rely on audit samples and tips?
• When did our managers last have fraud-awareness training that covered behavioural red flags?
• When did we last run a surprise audit, and where?