Financial statement fraud is the rarest branch of the fraud tree and the most expensive. The ACFE’s Occupational Fraud 2026: A Report to the Nations found it in 6 percent of its 2,402 cases, with a median loss of one million dollars, ten times the median for asset misappropriation, and a median duration of 24 months, twice the overall figure. The perpetrators are senior: executives and finance leaders, whose frauds cost a median of 475,000 dollars per case against 50,000 for staff, and who are also the people responsible for the controls that would otherwise catch them, which is why management override is a standing risk in every auditing standard. And the loss is borne by people outside the organisation: investors who paid for earnings that did not exist, lenders whose covenants were met on paper, employees whose pensions held the stock, and the auditors, boards and regulators whose credibility went with it. The cases that made the mechanisms famous, Enron, WorldCom, Toshiba, Steinhoff, Wirecard, Luckin Coffee, and the more modest and instructive Macy’s expense concealment of 2024, are the syllabus, and the mechanisms have not changed since the oldest of them.
This guide covers the five mechanisms of overstatement and their mirror images, who commits financial statement fraud and under what pressures, the cases with what each teaches, the red flags an auditor can see from inside the organisation, who is supposed to catch it and why they often do not, the ten-test program internal audit runs against management override every quarter, a worked example from Pennine Foods plc’s quarterly override program, and the findings that recur. It is the financial reporting branch of the fraud tree guide; the analytics it depends on are in the journal entry analytics catalog; and the engagement that tests the entries is how to audit journal entries.
In this guide
- The five mechanisms, and their mirror images
- Who commits it, and the pressures that produce it
- The pressure map: where to expect it
- The cases, and what each teaches
- The three questions to ask about any estimate
- Red flags visible from inside
- Who is supposed to catch it, and why they often do not
- Internal audit’s ten-test management-override program
- Worked example: Pennine Foods plc’s quarterly override program
- After the finding: materiality, restatement, control conclusion
- The findings that recur, and wording that lands
- Where to go next
The five mechanisms, and their mirror images
Every financial statement fraud in the record uses one or more of five mechanisms, because the accounts can only be misstated in five ways: by moving a real transaction to the wrong period, by inventing a transaction, by leaving out a cost or an obligation, by valuing something at more than the evidence supports, or by hiding something in the disclosures. The ACFE’s tree lists them as timing differences, fictitious revenues, concealed liabilities and expenses, improper asset valuations, and improper disclosures. Each has a mirror image used to understate results, for tax, royalties, earn-outs, regulatory ratios or the reserves for a future bad year. What makes them hard to find is that three of the five run through estimates and judgments that legitimately involve management’s discretion (reserves, allowances, impairments, capitalisation, revenue timing under contracts), so that the fraud is a matter of degree and intent rather than of a false document; and what makes them findable is that all five leave a trace in the journal, the estimate file, or the cut-off.
| Mechanism | How the numbers get cooked | The trace it leaves | The mirror image |
|---|---|---|---|
| Timing differences | Revenue recognised before it is earned (shipping early, bill-and-hold, side letters, channel stuffing); expenses pushed into the next period; cut-off moved to fit the quarter | Sales spikes in the last days of a period and reversals in the first days of the next; credit memos after the quarter; customer returns; shipments to warehouses rather than customers | Revenue deferred and expenses accelerated to move profit into a later period |
| Fictitious revenues | Sales to customers who did not order or do not exist; round-trip transactions with related parties; invoices raised and reversed after the audit | Receivables growing faster than sales; customers who never pay; sales with no shipment, contract or cash; confirmations routed through management | Real sales omitted, usually with the cash kept off the books |
| Concealed liabilities and expenses | Costs capitalised that should be expensed; invoices held unrecorded; accruals omitted; obligations parked in unconsolidated entities; warranty and legal exposures ignored | Capitalised balances rising against revenue; accrual balances falling while activity rises; post-close invoices; suppliers complaining of late payment; off-balance-sheet structures | Expenses accelerated or provisions built to depress a good year |
| Improper asset valuations | Inventory, receivables, goodwill, capitalised development, fair-value assets or cash balances carried above what evidence supports; reserves managed to the quarter | Estimates that move against their drivers; impairment tests that always pass; allowances unchanged despite aging deterioration; cash confirmations obtained by management rather than by the auditor | Assets written down early or reserves overbuilt to create a cushion |
| Improper disclosures | Related-party transactions, guarantees, contingencies, going-concern doubts, subsequent events or accounting policy changes omitted or buried | Counterparties connected to executives; legal matters absent from the checklist; side letters; management reluctance on going-concern language | Over-disclosure to obscure, or disclosure timed to a favourable moment |
Who commits it, and the pressures that produce it
Financial statement fraud is committed by the people who can direct the accounting: chief executives, chief financial officers, controllers, divisional finance heads and, in the smaller cases, a single accountant who started with an error. The pressures are the fraud triangle’s first leg written large. Market and financing pressure: an earnings target the company will miss, a covenant that will breach, a financing round or listing that depends on a growth story, a share price that supports acquisitions and executive wealth. Compensation pressure: bonuses and equity vesting on reported results, which turns every estimate into a personal decision. Contractual pressure: an earn-out, a royalty, a regulatory capital ratio or a licence condition that depends on the numbers. And concealment pressure, which produces the smaller and more common frauds: an error made and hidden, then hidden again, until a series of concealing entries has become a fraud with no beneficiary, which is what the Macy’s case of 2024 appears to have been and what a surprising share of restatements turn out to be. The opportunity is management’s own authority over the ledger, the estimates and the people who post to them; the rationalisation is almost always “it will come right next quarter”. The auditor’s practical conclusion is that the risk is concentrated where the pressure is: in the units that must hit a number, in the quarter before a financing, in the estimates that a single executive owns, and in the entities integrated for revenue but not for controls.
The pressure map: where to expect it in your own organisation
Because the mechanism follows the pressure, an auditor can predict which mechanism a given organisation would use if it were going to, and put the program’s weight there. The table is the map the fraud risk assessment in the assessment guide uses for the financial reporting scenarios.
| Pressure | Mechanism it usually produces | Where to look |
|---|---|---|
| Growth story for a listing, a financing round or an acquisition currency | Fictitious revenues; timing differences; related-party round trips | Receivables versus sales; new customers with no cash; period-end shipments; counterparties connected to insiders |
| Earnings target or analyst consensus | Timing differences; estimate management (reserves released, accruals trimmed); capitalisation | Last-week revenue; reserve movements against drivers; capitalisation rates; top-side entries to margin |
| Debt covenant or credit rating | Concealed liabilities; classification games (operating versus financing); improper disclosures | Off-balance-sheet structures; lease and guarantee treatment; covenant definitions applied loosely |
| Bonus and equity vesting | Whatever the bonus measures: adjusted profit invites adjustment; cash flow invites payment timing; revenue invites cut-off | The bonus plan’s metric, in the units and quarters where it is close |
| Earn-out, royalty, tax or regulatory ratio | Understatement: deferred revenue, accelerated expense, cookie-jar reserves | Reserves built without drivers; results below plan in good years; effective rates that fall |
| An error already made | Concealed expenses through concealing entries, growing quarter by quarter | Accruals by type against volume; one person’s entries to one account over years |
| Divisional targets set from the top | Timing and valuation games at unit level, invisible in consolidation | Unit-level cut-off and estimates; units that never miss |
The cases, and what each teaches
The cases below are chosen because each is the canonical example of a mechanism, and because between them they show every way a financial statement fraud gets found: a journalist, a short seller, a whistleblower, a regulator, an external auditor who finally refused to sign, an internal audit team, and, in the most recent, the company’s own review of an accrual. Figures are the ones the companies and their investigators disclosed; some were revised over time and the orders of magnitude are what matter.
| Case | Mechanism | Scale | How it came out | What it teaches |
|---|---|---|---|---|
| Enron (2001) | Concealed liabilities and improper disclosures: debt and losses parked in special-purpose entities that were not consolidated; aggressive mark-to-market valuations | Restatements in late 2001 and bankruptcy in December 2001, then the largest in US history | Analyst and journalist questions about the cash flows behind the earnings; an internal whistleblower memo to the chairman; the restatement that followed | Earnings without cash are the oldest red flag; off-balance-sheet structures exist to be asked about; the auditor’s independence was the control that failed |
| WorldCom (2002) | Concealed expenses: operating line costs capitalised as assets | About 3.8 billion dollars disclosed in June 2002, later found to total about 11 billion | The company’s own internal audit team, examining capital expenditure entries and refusing to be waved off | Internal audit can find the largest fraud in the building by looking at the entries; capitalisation is the mechanism to trend |
| Toshiba (2015) | Timing differences and improper valuations: percentage-of-completion manipulation, deferred costs, channel stuffing across divisions under top-down profit targets | Profits overstated by roughly 150 billion yen over about seven years | A regulatory inquiry and then an independent investigation committee | Pressure from the top produces fraud at every level below it; “challenges” that cannot be met are met on paper |
| Steinhoff (2017) | Fictitious and irregular transactions with related parties inflating profits and asset values | An independent investigation reported about 6.5 billion euros of fictitious or irregular transactions over eight years | The auditor’s refusal to sign the 2017 accounts, then the investigation | Related-party counterparties are where fictitious transactions live; group complexity is a mechanism, not an accident |
| Wirecard (2020) | Fictitious revenues and improper asset valuation: cash said to be held in trustee accounts did not exist | About 1.9 billion euros of cash missing; insolvency in June 2020 | Years of reporting by a newspaper, denied by the company and doubted by its regulator, until the auditor could not confirm the cash | Confirm cash yourself, from the bank, never through management; a regulator that protects a company from its critics has stopped supervising it |
| Luckin Coffee (2020) | Fictitious revenues: sales fabricated through related entities | About 2.2 billion yuan of fabricated sales in 2019; a 180-million-dollar SEC settlement in December 2020 | An anonymous short-seller report early in 2020, then the company’s own special committee | Store-level data and third-party evidence (foot traffic, receipts) can contradict reported revenue; growth stories attract fabrication |
| Macy’s (2024) | Concealed expenses: a single accounting employee understated small-package delivery expense accruals to hide an initial error | About 151 million dollars over nearly three years, against 4.36 billion of delivery expense; no personal gain | The company’s own identification during its quarter-end close, followed by an investigation and a conclusion that its internal control over financial reporting could not be relied on | One person, one accrual, one control gap: the most common financial statement fraud is small, concealing, and found by the accrual analytics nobody ran |
The three questions to ask about any estimate
Three of the five mechanisms run through estimates, and the auditor’s difficulty is that an estimate has no right answer, only a supportable range. Three questions turn that difficulty into a test. What is the driver, and did the estimate move with it? Every estimate has an observable driver: an allowance moves with the aging, a rebate accrual with promotional volumes, a warranty reserve with sales and claims, an inventory reserve with aging and margin; an estimate that moved against its driver, in the direction the quarter needed, is the first thing to examine, and the eight-quarter trend is the fastest way to see it. Who decided, and could they have decided otherwise? An estimate owned by one executive, reviewed by a subordinate, with a methodology that permits a wide range, is an estimate that will be managed under pressure whether or not anyone intends fraud; the control is a methodology that narrows the range, a reviewer who is independent, and a committee that sees the movement. And what would the number be if the assumptions were the ones used last year? Recomputing the estimate on the prior period’s assumptions isolates the effect of the change in judgment from the change in the business, and when the difference is the amount by which the quarter was made, the conversation with the CFO has a number in it. None of the three questions requires the auditor to say the estimate is wrong; they require management to show why it is right, which is the burden the standards place where it belongs.
Red flags visible from inside
An internal auditor sees things a short seller cannot, and the red flags that matter are the ones inside the building. Results that meet targets with suspicious precision, quarter after quarter, especially in one unit. Manual and top-side journal entries at period-end, posted or approved by senior finance staff, to revenue, reserves or accruals, with descriptions that explain nothing. Estimates that move in the direction the quarter needed: an allowance released, a reserve trimmed, a useful life extended, a capitalisation rate that climbed. Cash that lags earnings: operating cash flow persistently below net income, receivables and inventory growing faster than sales. Customers, suppliers or counterparties connected to executives, or entities that appear only at period-end. Cut-off that is a negotiation: shipments held open, side letters, bill-and-hold, credits in the first week of the next quarter. A finance function that is short-staffed, dependent on one person, or led by someone who cannot be questioned; an executive who takes a personal interest in specific entries. Confirmations, bank letters and legal letters that management insists on handling. And the cultural signals that the culture audit guide catalogues: targets described as non-negotiable, bad news punished, and an audit committee that hears only from the CFO. Quantitative screens exist (the Beneish M-score is the best known, an eight-variable model of the likelihood of earnings manipulation), and they are useful as prompts; they are not evidence, and a function that runs them should also run the journal entry analytics that produce it.
Who is supposed to catch it, and why they often do not
Five parties stand between a misstatement and the market, and the case record shows each failing for a characteristic reason. External auditors are required by their standards (AS 2401 in the United States, ISA 240 elsewhere) to presume a risk of fraud in revenue recognition and to test journal entries for management override, and they miss frauds when they accept management’s evidence in place of their own, as Wirecard’s cash confirmations show. Audit committees own the oversight and miss frauds when they hear only from management, meet quarterly, and treat the CFO’s explanation as the evidence. Regulators see the filings and miss frauds when they are late, under-resourced, or, as with Wirecard, aligned with the company against its critics. Whistleblowers and journalists find a large share of the biggest cases, because they are outside the pressure and inside the information, and are ignored for years when the company’s reputation outweighs their evidence; the SEC’s whistleblower program and the equivalent channels elsewhere exist because of that pattern. And internal audit, the party with the most access and the least attention in the case record, catches frauds when it looks at the entries and the estimates without asking permission, which is what WorldCom’s team did, and misses them when it is kept away from financial reporting on the ground that the external auditor covers it, or when it reports to the CFO whose entries it should be testing. The Global Internal Audit Standards address the last point directly: functional reporting to the board under Standard 7.1, and the consideration of fraud in every engagement’s risk assessment under Standard 13.2.
Internal audit’s ten-test management-override program
The program below is what a function runs each quarter, or at least each year-end, against the five mechanisms, independently of what the external auditor does; the overlap is deliberate, because the two parties test from different positions and the fraud the external auditor misses is usually one the internal team could have seen. It draws its analytics from the journal entry catalog and its sampling from the standard conventions, and its results go to the audit committee directly, not through the CFO.
- Top-side and manual journal analytics. Full population of manual and top-side entries for the period: by poster and approver seniority, by timing (last three days and post-close), by account (revenue, reserves, accruals, capitalised costs), by description quality and round amounts; every entry above a threshold posted or approved by senior finance staff examined to source.
- Cut-off analytics. Revenue in the last five days of the period against the daily average; credits and returns in the first ten days of the next; shipments to warehouses, agents or related parties; bill-and-hold and side-letter enquiries with sales staff, not only finance.
- Estimate movement analysis. Every significant estimate (allowances, rebate and returns accruals, warranty, inventory reserves, impairment, useful lives, capitalisation rates) trended against its driver for eight quarters; any movement against the driver explained from evidence, not from the estimate’s owner.
- Capitalisation review. Capitalised costs by project against policy: internal time supported by timesheets, eligibility of the phase, treatment of maintenance and training; the capitalisation rate trend by unit.
- Accrual completeness. Post-close invoices, open purchase orders and contracts against accruals; accrual balances trended against activity; the Macy’s test, which is an accrual by type against volume.
- Cash and receivable confirmation. Bank balances and significant receivables confirmed by the function directly, on a sample, with the confirmations obtained without management’s involvement; unusual cash arrangements (trustees, escrow, restricted balances) verified to source.
- Related-party and counterparty screening. Customers, vendors and counterparties matched against the related-party register, executives’ disclosures and public records; period-end transactions with new or unusual counterparties examined.
- Consolidation and intercompany. Consolidation adjustments and eliminations reviewed for entries that create profit; intercompany balances that do not agree; entities acquired or restructured in the period examined for what they contributed.
- Disclosure and legal. Legal letters, contingency schedules and subsequent-events reviews compared with what the function knows from its own work; going-concern assessments examined for evidence rather than assertion.
- Pressure and culture indicators. Target-setting, bonus triggers and covenant headroom reviewed against the units and quarters where the analytics found the most activity; the function’s own reading of whether finance staff can raise concerns, informed by the culture audit method.
Worked example: Pennine Foods plc’s quarterly override program
Pennine Foods plc is the 900-million-pound UK food manufacturer used in the UK Corporate Governance Code guide, with a December year-end and a first Provision 29 declaration built on 42 material controls, twelve of them in the financial reporting group (group consolidation review, revenue cut-off and rebate accrual review, impairment and going-concern assessment, manual journal approval by an independent reviewer, monthly balance sheet reconciliations among them). The declaration made the override program a standing quarterly engagement of about 120 hours, run by a senior and the analytics specialist and reported to the audit committee chair. Nothing in the program’s first year was fraud. What it found is the reason the program exists, and the table gives one quarter.
| Test | Population | What it found | Where it went |
|---|---|---|---|
| 1. Top-side and manual journals | 9,400 manual journals; 118 top-side entries | 22 top-side entries posted by the group financial controller with the description “adj” and approved by the deputy; all supported on examination; three posted after the close deadline to rebate accruals | Finding, Medium: description and timing standards for top-side entries; approval by the CFO above a threshold |
| 2. Cut-off | Last five days of the quarter; first ten of the next | Sales in the last three days 1.4 times the daily average, explained by month-end retailer order patterns evidenced in prior years; credits in the next period within the norm; no bill-and-hold | No finding; pattern documented as a baseline |
| 3. Estimate movements | Eleven estimates, eight quarters | Customer rebate accrual released by 1.4 million pounds in the quarter against a driver (promotional volumes) that had risen; on challenge, 1.0 million was supported by settled claims and 0.4 million was reinstated | Finding, Medium: rebate accrual methodology and evidence standard; the reinstatement reported to the committee |
| 4. Capitalisation | Six projects, 5.8 million pounds capitalised | A 2.1-million-pound systems project capitalised 640,000 pounds of internal staff time on estimates rather than timesheets | Finding, Medium: timesheet requirement; the amount within tolerance and supported after reconstruction |
| 5. Accrual completeness | Post-close invoices; open orders; accruals by type against volume | Logistics accrual per tonne shipped stable across eight quarters; two post-close invoices of 90,000 pounds unaccrued | Observation |
| 6. Cash and receivable confirmation | All 41 bank accounts; 20 receivables | Confirmed; one restricted balance (a customs guarantee) not disclosed as restricted in the management accounts | Observation to the group treasurer |
| 7. Related parties | Counterparty file against the register and disclosures | A packaging supplier part-owned by a non-executive director’s family trust, disclosed and approved, transacting at list prices | No finding; disclosure confirmed |
| 8. Consolidation | Adjustments and eliminations | Eliminations agreed; one adjustment reclassifying 300,000 pounds of intercompany margin supported | No finding |
| 9. Disclosure and legal | Legal letters; contingencies; subsequent events | One product-quality claim known to internal audit from the plant visits absent from the contingency schedule; added | Finding, Low |
| 10. Pressure indicators | Targets, bonus triggers, covenant headroom | Annual bonus 60 percent weighted to adjusted operating profit; covenant headroom as reperformed in the treasury audit smaller than reported; both noted as pressure context for the year-end program | Reported to the committee as context, not as a finding |
Three things about Pennine’s quarter generalise. The rebate accrual release was the finding that mattered, and it was found by trending the estimate against its driver rather than by reading the reconciliation, which balanced; the 400,000 pounds reinstated was not fraud, but it was the mechanism of fraud operating at the scale of ordinary optimism, and the committee understood the distinction. The top-side entries were all supported, and the finding was still right: an entry described as “adj” and approved by a deputy is an entry that would look identical if it were not supported. And the pressure indicators were reported without a finding attached, which is the correct way to tell an audit committee where to look next quarter without accusing anyone of anything.
After the finding: materiality, restatement and the control conclusion
A financial statement finding does not end with the report, and the auditor should understand the decisions that follow well enough to stay out of them and to preserve the evidence they need. The first is materiality, which is quantitative and qualitative: a misstatement that is small against revenue can still be material if it turned a loss into a profit, met a covenant or a target, affected a bonus, or was intentional, which is why intent is itself a materiality factor in the SEC staff’s long-standing guidance and why a fraud is rarely immaterial. The second is the restatement decision: whether prior periods must be restated and previously issued statements declared unreliable (in the United States, an Item 4.02 disclosure and a “Big R” restatement), or whether the error can be corrected in the current period with prior figures revised; that decision belongs to management, the audit committee and the external auditor, on counsel’s advice, and the internal auditor’s contribution is the evidence file and the quantification. The third is the internal control conclusion: a fraud that reached the financial statements almost always means a control that failed or did not exist, and in a SOX environment the question of whether the deficiency is a material weakness follows the logic in the control deficiency evaluation guide; Macy’s disclosed that its prior conclusion on internal control over financial reporting should no longer be relied upon, which is the standard consequence. The fourth is the regulatory and legal track, covered in the first-48-hours guide, which starts on the day of predication rather than the day of the restatement. And the fifth is the function’s own position: the CAE reports to the audit committee on what the function knew, when, and why its program did or did not find it earlier, because that question will be asked by the regulator and the plaintiffs’ lawyers, and the honest answer given first is worth more than the defensive one given later.
The findings that recur, and wording that lands
Financial reporting findings are the ones most likely to be argued with by the people who approved the accounts, so they land only in five-Cs form with the evidence attached. Top-side governance (“22 of 118 top-side entries in the quarter were posted by the group financial controller with the description ‘adj’ and approved by a direct report; the manual journal policy requires a description sufficient for an independent reviewer and approval by someone senior to the poster above 250,000 pounds”). Estimate evidence (“the customer rebate accrual was released by 1.4 million pounds in the quarter while promotional volumes rose 8 percent; 400,000 pounds of the release was not supported by settled claims and has been reinstated”). Capitalisation (“640,000 pounds of internal staff time was capitalised to the systems project on estimates rather than timesheets; the capitalisation policy requires contemporaneous time records”). Cut-off (“16 December invoices for January shipments to one distributor were recognised in the year; the revenue policy recognises on shipment”). And disclosure (“a product-quality claim known to plant management was not on the contingency schedule provided to the auditors”). Write the cause as the incentive or the missing standard rather than as a person’s judgment, and follow the root cause guide; where the cause is a person’s judgment, the matter has left the report and entered the protocol.
Where to go next
Test the entries, trend the estimates, confirm the cash yourself, read the counterparties, and report to the committee directly. The analytics are in the journal entry analytics catalog and the engagement in how to audit journal entries; the receivables and inventory estimates in the receivables guide and the inventory guide; the cash confirmation discipline in the bank reconciliation guide; the taxonomy in the fraud tree guide; and the assessment that places financial reporting scenarios in the register in the fraud risk assessment guide.
Related guides
- The journal entry analytics catalog — the management-override tests in full
- How to audit journal entries — the engagement that tests the entries
- The ACFE fraud tree explained — the financial statement branch in context
- How to run a fraud risk assessment — financial reporting scenarios in the register
- When internal audit finds fraud: the first 48 hours — when a finding becomes a referral
- UK SOX and Provision 29 — Pennine’s material controls and declaration
- SOX 404 explained — internal control over financial reporting in the US regime
- Control deficiency evaluation — rating what the override program finds
- Management review controls — the estimate reviews as controls
- How to audit revenue recognition — timing differences and fictitious revenue at process level
- How to audit accounts receivable — the allowance and cut-off tests
- Auditing corporate culture and ethics — the pressure indicators
- Audit committee presentation template — reporting the program’s results
- All fraud risk guides and all internal controls guides
Leave a Reply