The fraud triangle is a three-part model that explains why otherwise honest employees steal from their employers. Criminologist Donald R. Cressey developed it in 1953 after interviewing incarcerated embezzlers, and he found that three conditions were present in every case: perceived pressure, perceived opportunity, and rationalization. When those three converge in the same person at the same time, occupational fraud becomes likely. The framework still anchors how auditors, compliance officers, and fraud examiners think about risk, and it is the reason organizations spend money on internal controls rather than only on background checks. According to the Association of Certified Fraud Examiners, the typical occupational fraud case causes a median loss of $145,000, a figure drawn from more than 1,900 real cases across 138 countries.1Association of Certified Fraud Examiners. 2024 ACFE Report to the Nations
Where the Model Came From
Cressey was a sociologist whose doctoral research focused specifically on people who had been entrusted with other people’s money and violated that trust. He wanted a common pattern, and he found one. Every subject described a financial problem they felt they could not share with anyone, access to funds combined with a belief they would not get caught, and a mental story that made the theft feel acceptable. He published the findings in his 1953 book Other People’s Money.
What made the model durable is that it shifted the conversation away from the idea that fraudsters are born criminals. Cressey’s subjects were trusted employees, often with clean records, who crossed a line when circumstances aligned. That framing is why the triangle still guides practitioners: it treats fraud as a situational risk an organization can influence, not just a character flaw to screen out during hiring.
Perceived Pressure: The Problem That Cannot Be Shared
The first element is what Cressey called the “non-shareable financial problem.” The word non-shareable does the heavy lifting. Plenty of employees face financial stress. What distinguishes the pressure element is that the person believes they cannot tell anyone about the problem and cannot solve it through legitimate channels. They feel cornered.
The pressures fall into recurring patterns:
- Personal financial distress. Crushing debt, unexpected medical bills, a divorce settlement, or an underwater mortgage. The common thread is urgency combined with shame.
- Addictions. Gambling, substance abuse, or compulsive spending create immediate cash needs the person wants to hide from family and coworkers.
- Work-related pressure. A sales manager about to be fired for missing targets may falsify numbers to survive the quarter. A controller under pressure to hit earnings forecasts may shift expenses between periods. The threat is career survival rather than personal need.
- Lifestyle maintenance. An employee who has been visibly living above their income faces a different trap. Scaling back would invite questions, so they keep spending and find a way to fund the gap.
Economic downturns intensify all of these. When layoffs are in the air, pay is frozen, and personal investments lose value at the same time, the pressure element sharpens across an entire workforce. Recessions do not cause fraud, but they create fertile conditions for it. Organizations that recognize this tend to expand monitoring during lean years rather than cutting audit budgets.
You cannot eliminate employees’ personal problems, but you can create a workplace culture where people feel safe asking for help. Employee assistance programs and financial counseling quietly address the pressure element, even when nobody uses that term.
Perceived Opportunity: The Opening in the Controls
The second element is the one an organization can most directly control, and it is where prevention dollars are best spent. Perceived opportunity means the employee believes they can commit the fraud and get away with it. That belief almost always traces back to a weakness in internal controls.
Segregation of Duties
The single most common source of opportunity is letting one person handle too many steps in a financial process. When the same employee can create a vendor in the system, approve payments to that vendor, and reconcile the bank account, check fraud becomes trivially easy. Sound internal controls separate those functions so that no single individual can initiate a transaction, approve it, record it, and handle the related assets.2Office for Victims of Crime Financial Management Resource Center. Internal Controls and Separation of Duties Guide Sheet
Small organizations struggle with this because they lack the staff to split every function. That constraint is real, but it does not eliminate options. Requiring a second signature on checks above a certain amount, having the owner personally open bank statements, and rotating duties quarterly all create friction that makes fraud harder to conceal. Perfect segregation is not always possible. Some segregation is always better than none.
Management Oversight and Tone
Controls on paper mean nothing if nobody enforces them. When managers skip transaction reviews, sign off on expense reports without reading them, or treat reconciliations as a formality, employees notice. That apathy signals that nobody is watching. An employee who might never have considered fraud starts to think about it because the door is so clearly open.
The reverse holds too. Managers who visibly review reports, ask follow-up questions about unusual transactions, and hold people accountable for documentation errors create an environment where perceived opportunity drops sharply. Fraud prevention is partly a performance management issue.
Digital Access and Privilege Creep
In modern workplaces, physical access to a vault matters less than logical access to financial systems. One of the more insidious risks is privilege creep: an employee changes roles but retains system access from a previous position. In one documented case, an employee who moved to a new department kept payroll system privileges and used that access to steal personal data for 1,500 workers, resulting in over 100 identity theft cases and more than $1 million in damages.3The Institute of Internal Auditors. GTAG 13 – Fraud Prevention and Detection in an Automated World
Routine access reviews, prompt deactivation of credentials when employees change roles, and logging of activity in sensitive systems all reduce this risk. The principle is the same as segregation of duties, applied to technology: nobody should have more access than their current job requires.
Rationalization: The Story the Perpetrator Tells Themselves
The third element is the hardest for outsiders to understand and the hardest to detect from outside. Before the fraud happens, the perpetrator constructs a justification that lets them preserve their self-image as a decent person. This is not post-hoc excuse-making. It is a prerequisite. Most occupational fraudsters have no prior criminal record. They need to believe what they are doing is somehow acceptable before they will cross the line.
The most common rationalizations follow predictable scripts:
- “I’m just borrowing it.” The perpetrator tells themselves the money will be returned before anyone notices. This shows up early in a scheme and almost never turns out to be true. The “loan” grows, and repayment becomes impossible.
- “I deserve this.” An employee who feels underpaid, overworked, or passed over reframes the theft as compensation the company owes them. In their mind, they are correcting an injustice.
- “They’ll never miss it.” Large organizations invite this rationalization. The perpetrator minimizes the harm by telling themselves the company earns millions and will not feel a relatively small loss.
- “Everyone does it.” If the employee has seen other ethical shortcuts in the workplace, from inflated expense reports to executives bending the rules, they may conclude their own actions are simply part of the culture.
That last script is why tone at the top matters so much. When senior leadership cuts ethical corners, it does more than set a bad example. It supplies ammunition for every employee looking for a reason to justify dishonest behavior. Research involving nearly 1.2 million financial advisers found that those who received more extensive ethics training early in their careers were roughly one-fourth less likely to commit misconduct later, but the effect weakened significantly at firms where misconduct was already widespread. Culture overwhelmed training.
Once a scheme succeeds the first time, rationalization gets easier. The initial theft was the hard one psychologically. After that, the perpetrator has proof that the system did not catch them, the organization kept running, and nobody visibly got hurt. The mental barrier drops, the amounts tend to grow, and the fraud continues until something external stops it.
Using the Triangle for Prevention
The triangle’s real value is not academic classification. It is a practical diagnostic for identifying where your organization is vulnerable. Internal auditors structure fraud risk assessments around the three elements, evaluating each one systematically.4The Institute of Internal Auditors. Internal Auditing and Fraud – Assessing Fraud Risk Governance and Management at the Organizational Level 3rd Edition
Opportunity is where you get the most return on investment. Strengthening segregation of duties, conducting surprise audits, requiring mandatory vacations for employees in sensitive roles, running regular access reviews on financial systems, and building real management review procedures all make fraud harder to commit and easier to catch. The COSO Internal Control framework organizes these efforts into five components: the control environment, risk assessment, control activities, information and communication, and monitoring. Organizations that work through all five tend to have fewer and smaller fraud incidents.
Pressure is harder to address directly because it lives in employees’ personal lives, but it is not entirely outside your influence. Employee assistance programs, financial wellness resources, and a management culture where people feel comfortable raising problems all reduce the isolation that drives the pressure element. Unrealistic performance targets deserve scrutiny too. When the only way to meet a quota is to bend the rules, the organization has engineered its own fraud risk.4The Institute of Internal Auditors. Internal Auditing and Fraud – Assessing Fraud Risk Governance and Management at the Organizational Level 3rd Edition
Rationalization is primarily a culture problem. A strong code of ethics, visible enforcement when violations occur, and leadership that models the behavior it expects all make it harder for an employee to tell themselves that fraud is justified. An organization where senior leaders bend rules, play favorites, or tolerate minor ethical lapses is handing rationalizations to every employee who is watching.
How Fraud Actually Gets Caught
The single most effective fraud detection mechanism is not a sophisticated audit procedure. It is a tip. Forty-three percent of occupational fraud cases are detected because someone spoke up, making tips the number-one detection method by a wide margin.1Association of Certified Fraud Examiners. 2024 ACFE Report to the Nations Internal audit comes in second at roughly 15%. Management review and accidental discovery account for smaller shares.
Organizations with anonymous reporting hotlines detect fraud faster and lose less money. ACFE data shows a median fraud loss of $100,000 at organizations with hotlines compared to $198,000 at organizations without them, with schemes caught in 12 months versus 18. Nearly half of all fraud at organizations with hotlines is detected through tips, compared to about a third at organizations without one. Give people a safe, anonymous way to report concerns, and they will.
Behavioral Red Flags
While tips lead detection, knowing what to look for helps managers and coworkers recognize problems earlier. ACFE research identifies the most common behavioral warning signs displayed by fraudsters:5Association of Certified Fraud Examiners. Behavioral Red Flags of Fraud – Report to the Nations 2020
- Living beyond means, cited in 42% of cases. This has been the number-one red flag in every ACFE study since 2008. A sudden upgrade in cars, clothes, or vacations that does not match a known raise or inheritance is worth questioning.
- Financial difficulties, cited in 26% of cases. The visible side of the pressure element, showing up in conversations about debt, creditor calls at work, or garnishment notices.
- Unusually close ties to a vendor or customer, cited in 19% of cases. An employee who socializes frequently with a specific vendor and also controls purchasing decisions is a classic conflict of interest.
- Unwillingness to share duties, cited in 15% of cases. Fraudsters need to maintain control over their scheme. An employee who refuses to cross-train, insists on handling everything personally, or never takes vacation may be protecting a hidden process.
- Defensiveness or irritability, cited in 13% of cases. When routine questions about transactions provoke disproportionate pushback, that is worth noting.
None of these flags prove fraud on their own. People live beyond their means for innocent reasons, and some employees resist delegation because they are perfectionists. But when multiple indicators cluster in the same person, especially one with access to financial systems, the situation warrants a closer look.
Extensions: The Fraud Diamond and Fraud Pentagon
Cressey’s original model has held up well, but researchers have extended it to address gaps they observed in practice. These extensions layer onto the triangle rather than replacing it.
In 2004, David Wolfe and Dana Hermanson introduced the Fraud Diamond by adding a fourth element: capability. Their argument was straightforward. Pressure, opportunity, and rationalization can all be present, but if the person in that position lacks the skills, intelligence, or organizational authority to actually pull off the fraud, it will not happen. A junior clerk with no system access cannot manipulate financial statements no matter how motivated they are. Capability asks whether the specific individual has the traits and position needed to exploit the opportunity, which makes the model more useful for assessing risk around particular people rather than only situations.
In 2010, Jonathan Marks of Crowe Horwath extended the model further into the Fraud Pentagon by adding arrogance as a fifth element. Arrogance captures the trait where someone in a position of power believes the rules do not apply to them and that they will not face consequences. This element shows up most clearly in executive-level fraud, where the perpetrator has enough authority to override controls and enough ego to believe they are untouchable. The large accounting scandals that led to Sarbanes-Oxley tend to involve this kind of arrogance alongside the original three elements.
The triangle remains the starting point for virtually all fraud risk assessment. The diamond and pentagon are most useful when evaluating specific high-risk individuals or designing controls around senior leadership, where capability and arrogance carry real weight beyond the base model.