Corporate fraud costs UK businesses billions of pounds each year. According to research by KPMG and the Chartered Institute of Internal Auditors, the majority of significant fraud cases involve an employee or manager exploiting weak internal controls — and in most cases, the fraud goes undetected for months or years before it is discovered.
The good news is that the overwhelming majority of corporate fraud is preventable. Strong internal controls — the systems, policies, and procedures that govern how financial transactions are authorised, processed, and recorded — are the most effective tool available to businesses of all sizes for fraud prevention. This guide explains how internal controls work, which controls matter most, and how to implement them in a proportionate, practical way.
How most corporate fraud is committed |
| Research consistently shows that most corporate fraud is committed by employees or managers exploiting one of three weaknesses: the absence of segregation of duties (one person has too much control over a financial process), the absence of oversight (no one checks the work of the person committing the fraud), or the exploitation of trust (the fraudster is a trusted, long-serving employee who is not subject to the same controls as others). Strong internal controls address all three. |
The Most Important Internal Controls for Fraud Prevention
-
Segregation of Duties
Segregation of duties is the most fundamental fraud prevention control. It requires that no single individual has complete control over an entire financial process — the person who authorises a payment should not be the same person who raises the purchase order, processes the invoice, and reconciles the bank account. By dividing financial processes between multiple people, segregation of duties ensures that committing fraud requires collusion between two or more employees — significantly reducing the risk.
In practice, small businesses often struggle with segregation of duties because they do not have enough staff to divide financial responsibilities effectively. In these cases, compensating controls — such as owner/director review of bank transactions and regular independent bank reconciliations — can partially substitute for full segregation.
-
Authorisation Limits and Approval Hierarchies
Every financial commitment — purchase orders, expense claims, invoice payments, contract renewals — should require authorisation at a level appropriate to the value and nature of the transaction. An authorisation matrix specifying who can approve transactions up to different values, and what approval levels are required for different types of expenditure, prevents individuals from making unauthorised financial commitments without oversight.
-
Bank Reconciliation and Independent Review
Regular bank reconciliation — comparing the business’s accounting records against its bank statements — is a fundamental control that identifies unexplained transactions, duplicate payments, and unauthorised withdrawals. To be effective as a fraud prevention control, bank reconciliation must be performed by someone independent of the person who processes payments — and the reconciled statements must be reviewed by a senior manager or director.
-
Payroll Controls
Payroll fraud is one of the most common forms of employee fraud. Controls to prevent it include: regular payroll reconciliation comparing the current payroll run against the previous month and investigating variances, independent authorisation of all new starters, leavers, and salary changes, separation of the HR function (which creates employee records) from the payroll function (which makes payments), and periodic payroll audits comparing payroll data against HR records.
-
Expense and Procurement Controls
Expense fraud — submitting false or inflated expense claims — is pervasive and, in aggregate, costly. Effective controls include: a clear expense policy specifying what is and is not reimbursable, a receipts requirement for all expense claims above a de minimis threshold, management review and approval of all expense claims, and periodic analytical review of expense patterns to identify anomalies. For procurement, controls include: requiring multiple quotes for significant purchases, independent authorisation of supplier onboarding, and regular review of the approved supplier list.
-
Whistleblowing Framework
A credible, confidential whistleblowing mechanism is one of the most effective fraud detection tools available to organisations. Research consistently shows that more fraud is detected through tip-offs from employees than through any other mechanism — including internal audit and management review. A whistleblowing framework must be genuinely confidential (employees must believe their identity will be protected), must cover financial irregularities explicitly, and must be supported by a culture in which reporting concerns is positively valued rather than stigmatised.
-
Access Controls for Financial Systems
Restricting access to financial systems based on role is an increasingly important control as businesses move to cloud-based accounting software. Controls include: user access reviews (periodically checking that each user’s access rights are appropriate to their current role), prompt removal of access for leavers, multi-factor authentication for financial systems, and segregation of administrative access from operational access.
Fraud Risk in Specific Business Contexts
Care Homes and Care Providers
Care businesses face specific fraud risks including: theft of petty cash and resident funds, ghost employee schemes (fictitious employees on the payroll), payroll fraud by care managers with access to payroll systems, and supplier fraud involving fictitious or inflated invoices. The combination of large numbers of part-time and bank staff, complex payroll arrangements, and often limited finance function resource creates particular vulnerability.
Charities
Charities are particularly vulnerable to fraud because of their governance structure (reliance on volunteer trustees who may have limited financial oversight capability), restricted fund misapplication (using restricted funds for unrestricted purposes), and grant fraud (submitting inflated or fictitious expenditure claims to funders). The Charity Commission regularly publishes serious incident reports involving financial fraud — the problem is real and prevalent.
SMEs
SMEs are disproportionately affected by employee fraud because they typically have fewer controls, less oversight, and place greater trust in individual employees. The most common SME frauds are: payment diversion (changing supplier bank account details to divert payments to a fraudster’s account), expense fraud, and cash theft. Invoice fraud by external parties — sending fraudulent invoices that resemble genuine supplier invoices — is also a growing threat for SMEs.
The Fraud Triangle: Understanding Why Fraud Occurs
The ‘fraud triangle’ is a model developed by criminologist Donald Cressey that explains why individuals commit fraud. It identifies three conditions that must be present simultaneously:
- Pressure: A financial or personal pressure that motivates the individual — debt, gambling, lifestyle inflation, or personal financial difficulty.
- Opportunity: A weakness in controls that makes it possible to commit fraud without detection — absence of segregation of duties, inadequate oversight, or excessive trust.
- Rationalisation: A way of justifying the behaviour to oneself — ‘I’ll pay it back’, ‘the company owes me’, ‘nobody will notice’.
Businesses cannot easily control pressure or rationalisation — but they can control opportunity. Strong internal controls eliminate or significantly reduce the opportunity for fraud, regardless of the individual’s motivations.
How Elberra Consulting Supports Fraud Prevention
Elberra Consulting’s compliance and control team helps UK businesses design and implement fraud prevention controls proportionate to their size, sector, and risk profile. Our services include internal control framework design, anti-fraud policy development, payroll audit, procurement controls review, and whistleblowing framework implementation. Where fraud has already occurred, our forensic accounting team provides investigation and loss quantification services.
Strengthen your fraud prevention controls |
| Elberra Consulting can review your current internal controls, identify your key fraud risk areas, and design proportionate, practical controls that genuinely reduce your fraud exposure. |
| Book your free consultation → elberraconsulting.co.uk/free-consultation/ |
Frequently Asked Questions
How much does corporate fraud cost UK businesses?
Estimates of the total cost of fraud to UK businesses vary, but the Association of Certified Fraud Examiners (ACFE) Report to the Nations consistently finds that organisations lose approximately 5% of their revenue to fraud annually. For a business with £2m turnover, this implies a potential fraud loss of £100,000 per year — a significant sum that strong internal controls can substantially reduce.
What is the most common type of employee fraud in the UK?
According to KPMG and ACFE data, the most common forms of employee fraud in UK businesses are: asset misappropriation (theft of cash, physical assets, or data), payroll fraud (including ghost employees and unauthorised pay adjustments), and expense fraud. Payment fraud — redirecting payments to fraudulent accounts — is a rapidly growing category, particularly for SMEs.
Should I tell my employees I have introduced new fraud prevention controls?
Yes — transparency about the existence of fraud prevention controls is generally recommended. Communicating clearly that the organisation takes fraud seriously, that controls are in place, and that violations will be investigated and prosecuted, has a deterrent effect on opportunistic fraud. However, the specific details of controls (for example, exactly which transactions trigger an automated review) can be kept confidential to avoid circumvention.
Can internal controls prevent all fraud?
No set of internal controls can prevent all fraud — sufficiently determined fraudsters can circumvent controls, particularly through collusion. However, strong internal controls significantly raise the cost and complexity of committing fraud, dramatically reduce the opportunity for most forms of opportunistic fraud, and improve the speed and likelihood of detection when fraud does occur. The goal is not to make fraud impossible but to make it significantly harder and more likely to be detected quickly.
