Occupational fraud costs the median organization an estimated 5% of revenue every year, and the typical scheme runs for about 12 months before anyone catches it. What's worth noticing is where the risk actually concentrates: asset misappropriation (theft, billing schemes, expense fraud) shows up in 90% of cases but is comparatively the least costly, with a $100,000 median loss. Financial statement fraud is the opposite: it shows up in only 6% of cases, but carries a $1,000,000 median loss. A business that only watches for the common scheme can still get blindsided by the rare, expensive one.
Three controls show up again and again in the data as genuinely effective, not just theoretically sound: regular management review, surprise (unannounced) audits, and proactive data monitoring are each linked to meaningfully lower losses and faster detection when they're actually in place. And detection itself has a clear pattern worth building around: 43% of frauds are caught by a tip, nearly three times any other method, and more than half of those tips come from employees. A working, confidential reporting channel does more than most technology spend.
What you can do
Put at least one of the three proven controls in place if you don't already have it: regular management review, surprise audits, or ongoing proactive monitoring. Each is independently linked to lower losses and faster detection.
Set up (and actively promote) a confidential reporting channel: email and web-based tips now outperform telephone hotlines, and employees are your single biggest source of tips.
Don't over-index on the most dramatic scenario. Your most likely exposure is a smaller, longer-running scheme in a function like accounting or operations, where cases concentrate, not a single dramatic theft.
Need help applying this to your workplace?
Discuss your situation