Fraud Prevention and Controls: What the Evidence Actually Shows

Tips catch more fraud than audits do. Mandatory leave is linked to much smaller losses

Fraud in a not-for-profit is rarely the dramatic, sudden theft boards imagine when they think about the risk. Global research on occupational fraud consistently shows it hiding in plain sight inside ordinary operations, undetected for about a year in the typical case (a median of 12 months in the ACFE's Occupational Fraud 2026 study), and it thrives specifically in exactly the conditions many smaller associations already operate under: a small team, trust between colleagues, and limited capacity to separate financial duties across multiple people.

What The Global Evidence Actually Shows

The Association of Certified Fraud Examiners' Occupational Fraud 2026 study, based on 2,402 investigated cases from 143 countries and territories, is one of the most extensive recurring global studies of occupational fraud. Not-for-profits were about 10% of victim organisations in that study and had the lowest median loss (US$69,000). But a loss of that size can do disproportionate damage, against a restricted program budget, a public annual return, and often a much smaller team available to prevent or catch it in the first place. In about a third of cases, a lack of internal controls was the main weakness that allowed the fraud, and in about another fifth, existing controls were overridden. Asset misappropriation, someone simply taking money or assets rather than more complex financial statement manipulation, accounts for about 90% of cases.

The Control With The Strongest Evidence Behind It

Segregation of duties, ensuring no single person can both create and approve a payment, is the control every guide recommends, and the evidence supports it. But the global research points to a second, specific, less commonly implemented control with strong evidence behind it: job rotation and mandatory leave. In the ACFE's 2026 study, organisations with job rotation or mandatory leave had median losses about 49% lower (US$65,000 compared with US$128,000) and schemes detected about a third sooner (8 months compared with 12). These figures show association rather than proof of cause, but the control is low cost. The mechanism is straightforward. Many fraud schemes require the person committing them to remain continuously present to keep covering their tracks, and an unwillingness to ever take leave or rotate duties is itself one of the most consistently identified behavioural red flags in the research. A staff member who has not taken a break in years, or who resists any change to how a specific financial process runs, is not necessarily doing anything wrong. But the evidence is specific enough that a board serious about fraud prevention should treat mandatory leave as a real control, not merely a wellbeing nicety.

Why The Whistleblower Discipline From Earlier In This Series Matters Here Specifically

The single most common way fraud is detected is not an audit, and it is not a sophisticated financial control catching an anomaly. It is a tip, most often from an employee who noticed something and said so. In the ACFE's 2026 study, 43% of frauds were detected by a tip, and more than half of those tips came from employees. This is why the whistleblower protection discipline discussed earlier in this series is not a separate compliance topic sitting apart from fraud prevention. It is one of the most evidence-supported fraud detection mechanisms available, and an organisation with a functioning, trusted reporting channel is meaningfully better positioned to catch fraud early than one relying purely on formal financial controls.

Building Practical Controls At The Scale Your Association Actually Has

• Require a second, independent person to approve every payment before it leaves the organisation, connecting directly to the delegations of authority discipline discussed earlier in this series, since independent approval before payment is a core preventive control, particularly for small teams.
• Build job rotation or mandatory leave into financial roles specifically, even in a small team, since the evidence behind this specific control is unusually strong relative to how rarely smaller organisations actually implement it.
• Treat an ever-present, never-taking-leave financial staff member or volunteer treasurer as worth a quiet, respectful conversation, not automatic suspicion, but a governance blind spot if the pattern is simply left unexamined indefinitely.
• Ensure your whistleblower reporting channel, discussed earlier in this series, is known and trusted by staff, since tips remain the most common way fraud is detected.
• Accept honestly that true segregation of duties is difficult on a small team, and where it cannot be fully achieved, compensate with more frequent board-level review of transactions rather than assuming the gap simply does not matter at your organisation's size.
• Ask to see the evidence: monthly bank reconciliations, changes to supplier or payee bank details and who approved them, credit card statements, and approval records for a sample of payments. If fraud is suspected, preserve records, seek advice, notify your insurer, and consider reporting to police and, for a registered charity, notifying the ACNC.

Fraud prevention in a resource-constrained association is not about building the same control environment a large corporation would. It is about being honest about where the gaps are, given real staffing constraints, and putting the specific, evidence-supported controls in place that do the most protective work for the least resourcing cost, rather than assuming good character alone is sufficient protection.

This is one of the practical governance topics built into our Board Director course, alongside the papers, tools and frameworks that turn the principle into your board's actual practice. Explore the course →

Annie Gibbins

General education, not legal, financial, tax, clinical or governance advice. Confirm specifics at the relevant primary source or with your own qualified adviser. Nexus Leadership is operated by Lipstick Consulting Pty Ltd · ABN 15 619 120 482.