Fraud red flags: decide what to verify and escalate
A fraud indicator is an anomaly that needs context and corroboration. Preserve relevant evidence, assess the exposure, and follow the authorized escalation process. Do not treat a pattern as proof, alert a suspected actor unnecessarily, or begin an investigation beyond your authority and competence.
Indicator to verification, not indicator to accusation
| Decision | How to apply it | Mistake to avoid |
|---|---|---|
| Repeated payments just below approval limits | Test whether related invoices were split and examine business explanations. | Assuming every small invoice is fraudulent. |
| Shared employee and vendor bank details | Validate identities and relationships through appropriate records and specialists. | Ignoring legitimate explanations or disclosing sensitive information widely. |
| Missing records or management override | Preserve the access history and raise the concern through authorized channels. | Letting the person involved choose which evidence will be retained. |
Repeated payments just below approval limits
Test whether related invoices were split and examine business explanations.
Avoid: Assuming every small invoice is fraudulent.
Shared employee and vendor bank details
Validate identities and relationships through appropriate records and specialists.
Avoid: Ignoring legitimate explanations or disclosing sensitive information widely.
Missing records or management override
Preserve the access history and raise the concern through authorized channels.
Avoid: Letting the person involved choose which evidence will be retained.
A decision path you can use
- 1Preserve the observation
- 2Corroborate within authorized work
- 3Escalate with facts and uncertainty
Understand the method
Work through the reasoning
Treat a red flag as a question to investigate
A red flag is a pattern or event that may be consistent with fraud, such as unusual overrides, duplicate bank details, unexplained adjustments, or transactions just below an approval threshold. Its significance depends on context. A shared address might indicate related entities, a service provider, poor master data, or a fictitious supplier. The indicator narrows the inquiry; it does not decide the answer.
Describe the observation before attaching a label. Record the fields matched, the period, the source data, and any limitations in the detection rule. This makes the signal reproducible and allows another person to challenge its meaning. A vague statement that transactions “look suspicious” is much less useful than a documented pattern linked to a plausible risk mechanism.
Corroborate using evidence that can distinguish explanations
Choose follow-up work that would differ under competing explanations. For repeated invoices, compare invoice identifiers, services received, payment records, supplier details, and user activity. If a legitimate recurring service explains the pattern, supporting contracts and delivery evidence should exist. If the pattern reflects duplicate processing, the payment trail and reversal history may reveal it.
Consider data quality before scaling up an allegation. Formatting differences, merged supplier accounts, and incomplete exports can create misleading matches. Validate important fields and preserve the original extraction. Independent corroboration is stronger than asking a potentially involved person to explain the anomaly and accepting the answer without examination.
Prioritize response by exposure, urgency, and evidence risk
Not every indicator needs the same sequence of work. Consider whether funds are still at risk, whether activity is continuing, whether records may be lost, and whether the matter involves senior personnel. A credible signal of ongoing diversion may require prompt communication under the organization’s response protocol while the evidence is preserved.
Act within the mandate and involve appropriate specialists or authorities through established channels. Avoid improvising covert investigations, confronting a suspected person without a plan, or promising a witness complete confidentiality regardless of applicable obligations. The purpose of triage is to protect the organization and the integrity of the response while maintaining fairness about facts that remain unproven.
Report the observation, assessment, and next action separately
A useful communication distinguishes what has been observed from what is inferred. State the pattern, its potential significance, corroboration obtained, unresolved questions, and proposed next steps. Recipients should understand whether they are seeing an unvalidated alert, a supported control weakness, or a matter referred for specialist investigation.
Keep an appropriate record of who received the matter and how it was handled. Closing an alert because an explanation was offered is different from closing it because the explanation was verified. Where the investigation belongs to another function, internal audit can track the implications for its engagement and controls assessment without taking over responsibilities outside its role.
Original teaching example
Apply the method to a decision
The scenario
A supplier has eight invoices of $4,900 submitted on one day; additional approval begins at $5,000. The descriptions all refer to the same installation.
The decision
Investigate whether the invoices represent one purchase split to avoid approval, while keeping alternative explanations open.
The timing, amounts, and common description create a testable hypothesis. Obtain the purchase order, contract, delivery evidence, and approval trail. The observed pattern alone does not establish intent or identify who caused it.
Independent hypothetical case. It is not an official IIA question, an actual investigation, or a scoring prediction.
A second application
Threshold splitting or a legitimate purchasing pattern?
The situation
An analytics routine finds five purchases at 9,900 each when additional approval begins at 10,000. They share a supplier and were entered over two days by the same employee.
Reason through it
The pattern is consistent with possible threshold avoidance, but does not establish intent. Examine the business requirement, order timing, related invoices, receipt evidence, and applicable approval criteria. Determine whether the purchases formed one requirement and whether the employee had an authorized reason for the separate orders.
Take the decision
Preserve and corroborate the pattern, then communicate the supported facts through the response process. Do not describe five proven frauds merely because five alerts were generated.
Original hypothetical teaching case.
Check your understanding
Choose the best answer, then check the reasoning for each alternative. These short learning checks are not a full exam simulation. Answers are not saved or sent.
Questions about this topic
Should a red flag immediately be discussed with the suspected employee?
Follow the investigation and escalation protocol first. Unplanned confrontation can compromise evidence or an authorized investigation. Report the facts to the appropriate responsible party.
Should the auditor confront the person named in a red flag immediately?
Not automatically. Follow the authorized response process, consider evidence preservation and ongoing exposure, and involve appropriate specialists. An improvised confrontation may compromise the inquiry or unfairly imply that an unverified indicator proves misconduct.
Sources and syllabus scope
Prepared by MiloPrep editorial team. Source links checked 2026-10-10. These notes and cases are independent teaching material; the IIA sources do not verify or endorse them.
- IIA expanded syllabus
Establishes the examined topics. Primary domain: Fraud Risks (15% of Part 1). This is a domain allocation, not a separate weight for this lesson.
- Global Internal Audit Standards reference
- Locator: Standards 4.3, 5.2, and 13.2. Supports the professional requirements cited here; our scenarios and solution steps are original applications. Current IIA Standards resources.
Part 1: Internal Audit Fundamentals. Selected learning notes, not complete curriculum coverage. Browse all CIA topics.