Learning Objectives

By the end of this lesson, learners should be able to:

• Define financial misconduct and organizational fraud.
• Explain the relationship between fraud and corporate governance.
• Distinguish fraud from error and poor financial management.
• Identify common forms of financial misconduct.
• Explain the responsibilities of the board in preventing and responding to fraud.
• Examine the role of internal controls in preventing financial misconduct.
• Explain how organizational culture can contribute to fraud.
• Analyze governance failures that allow financial misconduct to occur.
• Evaluate appropriate responses to suspected fraud.
• Apply governance principles to cases involving financial misconduct.

1. Introduction to Financial Misconduct

Financial governance is intended to protect organizational resources and ensure that financial decisions are made responsibly.

However, organizations can experience financial misconduct when individuals deliberately misuse their authority, manipulate information, misappropriate resources or violate established financial controls.

Financial misconduct can involve:

• Fraud.
• Theft.
• Bribery.
• Corruption.
• Financial statement manipulation.
• Misappropriation of assets.
• Unauthorized transactions.
• Conflicts of interest.
• Fictitious transactions.
• Procurement manipulation.
• Concealment of financial information.

Financial misconduct is not simply a financial department problem.

It is a governance issue because it can indicate failures in:

• Leadership.
• Internal control.
• Risk management.
• Oversight.
• Accountability.
• Organizational culture.
• Board supervision.

2. Meaning of Financial Fraud

Fraud generally involves intentional deception designed to obtain an unauthorized or unlawful benefit or cause another party to suffer a loss.

Examples include:

• Creating fictitious suppliers.
• Stealing organizational funds.
• Manipulating financial records.
• Submitting false expense claims.
• Creating fictitious employees.
• Concealing liabilities.
• Overstating revenue.
• Manipulating expenses.
• Misusing organizational assets.

The key element distinguishing fraud from an ordinary mistake is intentional deception.

3. Fraud Versus Error

Not every financial irregularity represents fraud.

Error

An error is generally an unintentional mistake.

Example:

An accountant accidentally enters KSh 500,000 instead of KSh 50,000.

Fraud

Fraud involves deliberate deception.

Example:

An employee intentionally enters KSh 500,000 into the accounting system and creates false documentation to conceal the transaction.

Both situations require attention, but the governance response may differ significantly.

4. Financial Misconduct

Financial misconduct is broader than fraud.

It may include conduct that violates:

• Laws.
• Regulations.
• Financial policies.
• Accounting standards.
• Organizational procedures.
• Ethical requirements.

Examples include:

• Unauthorized borrowing.
• Deliberate misclassification of expenses.
• Improper use of company funds.
• Undisclosed related-party transactions.
• Bribery.
• Manipulation of financial results.
• Deliberate tax evasion.
• Concealment of material information.

Some misconduct may involve fraud, while other misconduct may involve serious negligence or regulatory violations.

5. Why Financial Misconduct Is a Governance Issue

The board is responsible for overseeing the organization’s financial integrity.

When serious financial misconduct occurs, the board should ask:

• How did this happen?
• Which controls failed?
• Who was responsible?
• Were warning signs ignored?
• Did management know?
• Was the board properly informed?
• Were internal audit findings ignored?
• Were conflicts of interest disclosed?
• Did organizational culture encourage inappropriate behavior?

The important governance question is therefore not only:

“Who committed the misconduct?”

It is also:

“What governance conditions allowed the misconduct to occur?”

6. The Fraud Triangle

A commonly used framework for understanding fraud is the Fraud Triangle.

It identifies three major conditions:

Pressure

An individual may experience financial or personal pressure.

Examples include:

• Debt.
• Financial difficulties.
• Performance pressure.
• Personal financial obligations.

Opportunity

Weak controls create opportunities to commit misconduct.

Examples include:

• Poor segregation of duties.
• Weak authorization.
• Inadequate supervision.
• Excessive access privileges.

Rationalization

The individual justifies the misconduct.

Examples:

“The organization owes me.”

“Everyone else is doing it.”

“I will return the money later.”

Effective governance should seek to reduce opportunities and create an environment in which misconduct is difficult to justify or conceal.

7. The Fraud Diamond

The Fraud Diamond expands the Fraud Triangle by adding:

Capability

The individual must have the ability or position necessary to commit and conceal the misconduct.

For example, a senior finance employee may have:

• System access.
• Knowledge of controls.
• Authority to approve transactions.
• Knowledge of audit procedures.

The governance implication is important.

Organizations should not assume that only junior employees present fraud risks.

Individuals with significant authority may have greater opportunities to commit sophisticated misconduct.

8. Common Forms of Financial Fraud

Financial fraud can take many forms.

Common examples include:

• Cash theft.
• Payroll fraud.
• Procurement fraud.
• Expense fraud.
• Revenue manipulation.
• Asset theft.
• False invoicing.
• Supplier fraud.
• Fictitious transactions.
• Financial statement manipulation.

The methods may differ, but the underlying governance problem often involves misuse of authority and weaknesses in control systems.

9. Procurement Fraud

Procurement is particularly vulnerable to fraud because it involves significant organizational expenditure.

Examples include:

• Fictitious suppliers.
• Inflated prices.
• Bid manipulation.
• Collusion.
• Conflicts of interest.
• False delivery documentation.
• Split purchases designed to avoid approval thresholds.
• Payments for goods that were never delivered.

For example:

A procurement officer secretly owns a supplier company and directs organizational contracts to that company without disclosure.

This represents both a conflict-of-interest issue and a potential financial misconduct concern.

10. Payroll Fraud

Payroll fraud occurs when individuals manipulate employee-related payments.

Examples include:

• Ghost employees.
• Inflated salaries.
• Unauthorized allowances.
• False overtime.
• Duplicate payments.
• Payments to former employees.
• Unauthorized changes to payroll records.

Strong controls should include:

• Employee verification.
• Segregation of duties.
• Payroll reconciliation.
• Approval procedures.
• Regular review of employee records.

11. Expense Fraud

Expense fraud involves deliberately submitting false or inappropriate expense claims.

Examples include:

• Claiming expenses that were never incurred.
• Inflating actual expenses.
• Submitting the same receipt more than once.
• Claiming personal expenses as business expenses.
• Using false documentation.

Organizations should have clear expense policies and appropriate review procedures.

12. Financial Statement Manipulation

Financial statement manipulation occurs when financial information is deliberately altered or presented misleadingly.

Possible forms include:

• Overstating revenue.
• Understating liabilities.
• Delaying recognition of expenses.
• Manipulating asset values.
• Concealing losses.
• Creating fictitious transactions.

The objective may be to create an inaccurate impression of organizational performance.

This can seriously damage:

• Investors.
• Creditors.
• Employees.
• Regulators.
• Customers.
• Other stakeholders.

13. Earnings Management and Misconduct

Not every form of earnings management is automatically fraudulent.

Some accounting judgments are legitimate when they comply with applicable accounting standards.

However, deliberate manipulation designed to mislead users of financial statements can become serious financial misconduct.

The board should therefore pay attention to:

• Unusual changes in financial results.
• Aggressive accounting judgments.
• Significant unexplained transactions.
• Pressure to meet financial targets.
• Sudden changes in accounting policies.
• Large end-of-period transactions.

14. Asset Misappropriation

Asset misappropriation occurs when organizational assets are taken or used improperly.

Assets may include:

• Cash.
• Vehicles.
• Equipment.
• Inventory.
• Computers.
• Company property.
• Intellectual property.

Examples include:

An employee takes organizational equipment for personal use.

Inventory is removed from a warehouse without authorization.

Company funds are transferred to a personal account.

Asset controls should include:

• Asset registers.
• Physical verification.
• Access restrictions.
• Authorization.
• Reconciliation.
• Monitoring.

15. Bribery and Corruption

Bribery involves offering, giving, receiving or soliciting an improper advantage to influence a decision.

Corruption is broader and may involve abuse of entrusted power for improper personal or organizational benefit.

Examples include:

• Paying officials to obtain contracts.
• Giving gifts in exchange for favorable decisions.
• Receiving secret commissions.
• Manipulating procurement processes.

Bribery and corruption can create significant:

• Legal risks.
• Financial risks.
• Reputational risks.
• Regulatory risks.

16. Conflicts of Interest and Financial Misconduct

A conflict of interest occurs when an individual’s personal interests could improperly influence their organizational responsibilities.

For example:

A director participates in approving a contract involving a company owned by a close family member without disclosing the relationship.

The existence of a conflict does not automatically prove fraud.

However, undisclosed conflicts can create opportunities for misconduct.

Strong governance requires:

• Disclosure.
• Documentation.
• Recusal where appropriate.
• Independent review.
• Transparent decision-making.

17. Related-Party Transactions

Related-party transactions require careful governance because they involve parties connected to organizational decision-makers.

Examples include transactions involving:

• Directors.
• Senior executives.
• Major shareholders.
• Related companies.
• Close family relationships where applicable under relevant rules.

The board should ensure that such transactions are:

• Properly identified.
• Disclosed.
• Independently evaluated.
• Conducted on appropriate terms.
• Approved according to applicable requirements.

18. Warning Signs of Financial Misconduct

Boards and executives should be alert to warning signs.

These may include:

• Unexplained financial discrepancies.
• Excessive management overrides.
• Unusual transactions.
• Repeated control failures.
• Missing documentation.
• Employees refusing to take leave.
• Excessive secrecy.
• Unexplained lifestyle changes among employees may sometimes warrant attention, but should not by itself be treated as evidence of misconduct.
• Frequent complaints about procurement.
• Repeated audit findings.
• Significant unexplained financial adjustments.
• Pressure to meet unrealistic targets.

A warning sign does not prove fraud.

It indicates that further examination may be appropriate.

19. Management Override of Controls

One of the most significant governance risks occurs when senior executives can bypass established controls.

For example:

A CEO instructs the finance department to process a major payment without normal approval procedures.

If employees believe that executives are exempt from controls, the organization’s control environment becomes weak.

Boards should therefore ensure that controls apply appropriately across organizational levels.

20. The Role of Internal Controls

Internal controls reduce opportunities for financial misconduct.

Important controls include:

Segregation of Duties

Different individuals perform different stages of a transaction.

Authorization

Important transactions require appropriate approval.

Reconciliation

Records are compared against independent evidence.

Access Controls

Only authorized individuals can access systems and assets.

Documentation

Transactions are supported by appropriate evidence.

Monitoring

Controls are regularly reviewed.

No control system can eliminate all fraud.

However, effective controls can significantly reduce opportunities and improve detection.

21. The Role of the Board in Fraud Prevention

The board should oversee the organization’s fraud risk management framework.

Its responsibilities may include:

• Ensuring appropriate internal controls.
• Reviewing significant fraud risks.
• Monitoring management’s response to fraud.
• Supporting ethical culture.
• Ensuring appropriate reporting mechanisms.
• Overseeing internal and external audit.
• Challenging management when necessary.

The board should not conduct day-to-day fraud prevention activities.

That remains primarily a management responsibility.

22. The Role of the Audit Committee

The audit committee can play an important role in fraud oversight.

It may review:

• Fraud risk assessments.
• Internal audit findings.
• Whistleblowing reports.
• Significant financial irregularities.
• External audit concerns.
• Internal control weaknesses.
• Management responses.

The audit committee should ensure that significant concerns are escalated appropriately to the full board.

23. Whistleblowing and Speaking Up

Employees can be an important source of information about misconduct.

An effective whistleblowing system should provide:

• Accessible reporting channels.
• Confidentiality where appropriate.
• Protection against retaliation.
• Independent assessment.
• Proper investigation.
• Appropriate escalation.

Possible reporting channels include:

• Dedicated reporting lines.
• Secure online platforms.
• Independent reporting channels.
• Audit committee reporting.
• Company secretary or compliance functions.

The board should receive appropriate information about significant whistleblowing matters.

24. Organizational Culture and Fraud

Controls alone cannot prevent all misconduct.

Culture also matters.

A culture that rewards results at any cost may increase misconduct risks.

For example:

“Meet the target regardless of how you achieve it.”

Such messaging can create dangerous incentives.

A healthier culture emphasizes:

• Ethical performance.
• Responsible risk-taking.
• Transparency.
• Accountability.
• Speaking up.
• Long-term value.

The board plays an important role in setting expectations for organizational culture.

25. Executive Incentives and Fraud Risk

Poorly designed incentive systems can create financial misconduct risks.

For example:

An executive receives a large bonus if annual revenue exceeds a particular target.

If the target is unrealistic, the executive may face pressure to manipulate:

• Revenue recognition.
• Expenses.
• Contracts.
• Financial estimates.

The board should therefore ensure that remuneration structures encourage sustainable performance rather than inappropriate short-term behavior.

26. Governance Failure

A governance failure occurs when governance structures, responsibilities or oversight mechanisms fail to prevent, detect or respond appropriately to significant organizational problems.

Governance failure may involve:

• Weak board oversight.
• Lack of independence.
• Poor risk management.
• Ineffective controls.
• Conflicts of interest.
• Weak ethical culture.
• Management dominance.
• Ignored warning signs.
• Inadequate disclosure.

Governance failure does not necessarily mean that fraud occurred.

However, fraud can expose underlying governance weaknesses.

27. The Difference Between Fraud and Governance Failure

Consider the following situation:

An employee steals KSh 2 million.

If the employee bypassed several well-designed controls through sophisticated deception, the incident may primarily represent individual misconduct.

However, suppose:

• The employee had unrestricted access.
• No segregation of duties existed.
• Management ignored previous warnings.
• Internal audit had identified the weakness.
• The board never followed up.

The issue is now broader.

It represents both:

Individual misconduct + Governance failure

The board must examine both dimensions.

28. Case Study: Enron

The collapse of Enron is a major example used in corporate governance education.

The case involved serious concerns regarding:

• Financial reporting.
• Complex transactions.
• Conflicts of interest.
• Executive incentives.
• Board oversight.
• Auditor independence.
• Organizational culture.

The governance lesson is that sophisticated financial structures and formal governance institutions do not guarantee effective oversight.

The board must understand what management is doing and challenge information when necessary.

29. Case Study: WorldCom

WorldCom became associated with major accounting fraud involving the improper treatment of expenses.

The case demonstrated the importance of:

• Accurate financial reporting.
• Independent oversight.
• Internal controls.
• Auditor responsibility.
• Board challenge.
• Ethical leadership.

The broader lesson is that financial reporting can be manipulated when organizational pressure and weak controls interact.

30. Case Study: Satyam

The Satyam scandal in India involved significant manipulation of financial information.

The case raised governance concerns involving:

• Financial reporting.
• Board oversight.
• Audit.
• Management integrity.
• Transparency.
• Stakeholder confidence.

The case demonstrates that a company’s size and reputation do not protect it from governance failure.

Strong governance must operate in practice.

31. Case Study: Wells Fargo

The Wells Fargo sales-practices scandal demonstrated how organizational incentives and performance pressure can influence employee behavior.

The case raised important governance questions concerning:

• Incentive structures.
• Organizational culture.
• Risk oversight.
• Customer treatment.
• Executive accountability.
• Board oversight.

The broader lesson is that boards must examine not only financial results but also how those results are achieved.

32. Board Response to Suspected Financial Misconduct

When significant misconduct is suspected, the board should ensure that the matter is handled appropriately.

A general response may involve:

Step 1: Recognize the Concern

Determine the nature and seriousness of the allegation.

Step 2: Protect Evidence

Ensure relevant records and information are preserved.

Step 3: Protect the Investigation

Avoid inappropriate interference.

Step 4: Establish Appropriate Independence

Where necessary, use independent investigators or advisers.

Step 5: Determine the Facts

Conduct a properly authorized investigation.

Step 6: Take Appropriate Action

Correct control weaknesses and address misconduct.

Step 7: Consider Reporting Obligations

Determine whether laws, regulations, auditors or other authorities require notification.

Step 8: Learn From the Incident

Identify the governance weaknesses that allowed the problem to occur.

33. Board Should Not Conduct Informal Investigations

Directors should avoid turning serious allegations into informal personal investigations.

For example, a director should not independently:

• Interview suspected employees without authorization.
• Delete or alter records.
• Promise confidentiality beyond their authority.
• Accuse individuals before facts are established.
• Interfere with investigators.

Serious matters should be handled through appropriate governance and investigation procedures.

34. Investigation Independence

An investigation should be sufficiently independent to establish facts objectively.

Independence becomes especially important where allegations involve:

• Senior executives.
• Directors.
• Major shareholders.
• Audit personnel.
• Members of the finance function.

If the CEO is accused of misconduct, for example, the investigation should not be controlled by the CEO.

The board or an appropriate independent committee should determine the appropriate investigation arrangements.

35. Presumption of Fairness

Suspected misconduct should be investigated fairly.

An allegation is not automatically proof of wrongdoing.

Organizations should seek to:

• Establish facts.
• Preserve evidence.
• Avoid premature conclusions.
• Give appropriate parties an opportunity to respond.
• Follow applicable laws and procedures.
• Maintain confidentiality appropriately.

Fair investigation protects both the organization and individuals involved.

36. Regulatory and Legal Considerations

Financial misconduct may create legal and regulatory obligations.

Depending on the organization and jurisdiction, matters may need to be considered in relation to:

• Company law.
• Securities regulation.
• Tax law.
• Anti-corruption legislation.
• Employment law.
• Data protection.
• Accounting requirements.
• Financial-sector regulation.

Boards should obtain appropriate professional advice where necessary.

Directors should not assume that every misconduct matter can be resolved internally.

37. Financial Misconduct and Reputation

Financial misconduct can significantly damage organizational reputation.

Stakeholders may lose confidence in:

• Management.
• Directors.
• Financial statements.
• Products and services.
• Organizational ethics.

Reputational damage may lead to:

• Loss of customers.
• Loss of investors.
• Regulatory scrutiny.
• Employee departures.
• Increased costs.
• Difficulty obtaining financing.

The financial consequences of misconduct can therefore extend far beyond the original loss.

38. Financial Misconduct and Stakeholder Trust

Trust is difficult to build and easy to lose.

Stakeholders expect organizations to:

• Use resources responsibly.
• Provide accurate information.
• Follow applicable laws.
• Treat stakeholders fairly.
• Respond appropriately to misconduct.

When organizations conceal problems, the eventual damage can be greater than if the issue had been addressed transparently and promptly.

39. Board Oversight of Fraud Risk

The board should periodically ask:

1. What are our greatest fraud risks?
2. Which controls address those risks?
3. How effective are those controls?
4. What fraud incidents have occurred?
5. Are there recurring patterns?
6. What whistleblowing mechanisms exist?
7. Are employees protected when raising concerns?
8. Does internal audit assess fraud risks?
9. Are executive incentives creating inappropriate pressure?
10. What lessons have been learned from previous incidents?

These questions help keep fraud on the governance agenda.

40. Fraud Risk Assessment

A fraud risk assessment can examine:

Risk

What could be stolen, manipulated or misrepresented?

Opportunity

Where are controls weak?

Incentive

What pressures could encourage misconduct?

Capability

Who has access and authority?

Detection

How would the organization discover the misconduct?

Response

What would happen if misconduct were identified?

This approach allows boards and management to move from reactive investigation to proactive risk management.

41. Governance Lessons From Financial Misconduct

Several recurring lessons emerge from major corporate scandals.

Lesson 1: Strong controls matter

Weak controls create opportunities for misconduct.

Lesson 2: Culture matters

Employees respond to the behaviors and expectations of leadership.

Lesson 3: Incentives matter

Poor incentives can encourage inappropriate behavior.

Lesson 4: Independence matters

Boards and assurance functions must be capable of challenging management.

Lesson 5: Transparency matters

Problems should not be concealed.

Lesson 6: Warning signs matter

Repeated control failures should receive board attention.

Lesson 7: Accountability matters

Those responsible for misconduct and governance failures should be appropriately held accountable.

42. The Board’s Role in Creating an Anti-Fraud Culture

Boards can influence organizational culture by:

• Demonstrating ethical leadership.
• Supporting whistleblowing.
• Asking difficult questions.
• Ensuring accountability.
• Reviewing incentive structures.
• Supporting independent assurance.
• Responding consistently to misconduct.
• Avoiding tolerance for unethical behavior.

The board’s behavior communicates expectations throughout the organization.

43. Best Practices for Preventing Financial Misconduct

Organizations should consider implementing:

1. Clear financial policies.
2. Strong segregation of duties.
3. Appropriate authorization controls.
4. Independent internal audit.
5. Effective external audit.
6. Fraud risk assessments.
7. Whistleblowing mechanisms.
8. Conflict-of-interest declarations.
9. Related-party transaction controls.
10. Regular reconciliation.
11. Access controls.
12. Employee training.
13. Ethical codes of conduct.
14. Appropriate executive incentives.
15. Regular board oversight.

These mechanisms should work together rather than operate independently.

44. Executive Application Exercise

Financial Governance and Fraud Risk Assessment

Select an organization you are familiar with and assess its exposure to financial misconduct.

1. Identify Risks

Identify five potential financial misconduct risks.

2. Identify Opportunities

For each risk, identify the control weakness that could enable it.

3. Identify Controls

What controls currently exist?

4. Evaluate Internal Audit

How does internal audit provide assurance over these risks?

5. Evaluate Whistleblowing

Can employees report suspected misconduct safely?

6. Evaluate Incentives

Could organizational targets encourage inappropriate behavior?

7. Evaluate Board Oversight

How does the board monitor financial misconduct risks?

8. Identify Governance Gaps

Identify three weaknesses.

9. Recommend Improvements

Provide three practical recommendations.

10. Board Action

Prepare five questions that you would ask management if you were a director.

Lesson Summary

Financial misconduct and fraud represent significant risks to organizational financial integrity and stakeholder trust.

Fraud involves intentional deception, while financial misconduct encompasses a broader range of unethical, illegal or inappropriate financial behavior.

Common forms include:

• Procurement fraud.
• Payroll fraud.
• Expense fraud.
• Asset misappropriation.
• Financial statement manipulation.
• Bribery.
• Corruption.
• Undisclosed conflicts of interest.
• Related-party abuse.

The board has an important oversight role in ensuring that organizations maintain effective systems for preventing, detecting and responding to financial misconduct.

However, the board should not take over management’s operational responsibilities.

Effective governance requires:

• Strong internal controls.
• Independent assurance.
• Appropriate audit oversight.
• Ethical leadership.
• Effective whistleblowing mechanisms.
• Appropriate incentives.
• Transparent reporting.
• Clear accountability.

Financial misconduct can also expose deeper governance failures.

When misconduct occurs, the board should therefore ask not only:

“Who committed the misconduct?”

but also:

“What weaknesses in governance, controls, culture or oversight allowed it to happen?”

The ultimate objective is not merely to respond to individual incidents.

It is to strengthen the governance system so that similar failures are less likely to occur in the future.

References

• The Institute of Internal Auditors — Global Internal Audit Standards
• The Institute of Internal Auditors — Three Lines Model
• G20/OECD Principles of Corporate Governance 2023
• Committee of Sponsoring Organizations of the Treadway Commission (COSO) — Internal Control Framework
• International Finance Corporation (IFC) — Corporate Governance Methodology
• Financial Reporting Council — UK Corporate Governance Code
• Association of Certified Fraud Examiners — Occupational Fraud Resources