Red flags: behavioural and financial

Internal fraud is rarely invisible in hindsight. After the event, colleagues almost always recall signs that were explained away at the time. Knowing the common red flags helps you notice them while they still matter. A red flag is not proof of anything. It is a reason to look closer.

Behavioural red flags

• Never taking a proper holiday, or only ever taking odd days. Many frauds need constant maintenance: invoices to intercept, records to adjust, questions to deflect. Two unbroken weeks away means someone else covers the role, and cover is how many frauds are discovered. An employee who refuses to be away from their duties for long, year after year, may simply be dedicated. It is still a pattern worth noticing, and it is why many financial institutions mandate a two-week block of leave for staff in sensitive roles.
• Refusing to delegate or share duties, and resisting cross-training, especially around payments, suppliers, or reconciliations.
• Unusually close relationships with particular suppliers or customers, or defensiveness when those relationships are discussed.
• Hostility to audit, to questions, or to new controls that would touch their area.
• Noticeable lifestyle change with no obvious explanation: a car, holidays, or spending that sits oddly with the person's salary. There may be an innocent explanation, and often there is. The point is that unexplained wealth is one of the most consistent features of discovered frauds.

Financial and process red flags

• Overrides of controls: approvals skipped, limits exceeded, or a manager routinely pushing transactions through outside the normal process. Management override is one of the hardest fraud risks to control, precisely because seniority discourages challenge.
• Unexplained adjustments, write-offs, or journal entries, especially near period end.
• Duplicate payments, round-sum invoices, or invoices just below approval thresholds.
• Missing documentation, suppliers with PO box addresses, or supplier details matching an employee's.
• Reconciliations that are always late, always done by the same person, or never independently checked.

One flag alone usually means nothing. Several together, around the same person or process, mean it is time to raise a concern through the proper route, which Section 4 covers.