Revenue Loss or Fraud? How to Investigate Suspicious Financial Discrepancies

Revenue Loss or Fraud? How to Tell the Difference

Not every revenue discrepancy is fraud. Most revenue leakage is caused by process gaps, billing errors, and system limitations—honest mistakes that occur in the normal course of business. But some discrepancies are caused by intentional misconduct—embezzlement, skimming, fraudulent disbursements, or financial statement manipulation.

Distinguishing between honest errors and intentional fraud is essential. The investigation methods are different, the corrective actions are different, and the consequences are different. Treating an honest error as fraud can damage employee morale and customer relationships. Treating fraud as an honest error can allow the misconduct to continue.

This guide explains how to distinguish revenue loss from fraud, how to investigate suspicious discrepancies, and when to escalate.

What Is Revenue Loss?

Revenue loss is the unintentional reduction in collected revenue caused by process gaps, billing errors, payment failures, and system limitations. It is the focus of this knowledge base—the everyday leakage that occurs in most businesses.

Characteristics of revenue loss:

• Unintentional: No one meant to cause the loss
• Systematic: Caused by a process or system gap, not by individual actions
• Widespread: Typically affects multiple transactions, customers, or products
• Explained: Once investigated, the cause can be identified and understood
• Correctable: Fixing the underlying process prevents future loss

What Is Fraud?

Fraud is the intentional act of depriving a business of revenue through deception. The Association of Certified Fraud Examiners (ACFE) identifies three categories of occupational fraud:

1. Asset Misappropriation

The most common form of occupational fraud. An employee steals or misuses the business's assets. Common schemes include:

• Skimming: Stealing cash before it is recorded in the books
• Billing schemes: Creating fake invoices or paying personal expenses through the business
• Payroll schemes: Creating ghost employees or falsifying hours
• Expense reimbursement schemes: Submitting fraudulent expense reports

2. Corruption

An employee uses their position for personal gain through conflicts of interest, bribery, or extortion. Common schemes include:

• Kickbacks: Receiving payments from suppliers in exchange for favorable treatment
• Conflicts of interest: Having an undisclosed financial interest in a supplier or customer
• Bid rigging: Manipulating the procurement process to favor a specific supplier

3. Financial Statement Fraud

The least common but most expensive form of fraud. An employee intentionally misstates financial statements to deceive investors, lenders, or regulators. This includes overstating revenue, understating expenses, or hiding liabilities.

How to Distinguish Revenue Loss from Fraud

1. Pattern Analysis

Honest errors tend to follow patterns—they affect specific products, specific time periods, or specific process steps. Fraud tends to be more random or targeted—it affects specific individuals, specific accounts, or specific amounts that benefit the perpetrator.

Look for:

• Concentration: Are the discrepancies concentrated in one person's work, one customer, or one account?
• Timing: Do the discrepancies occur at specific times (when a particular person is working, at the end of reporting periods)?
• Amount: Are the amounts round numbers, or do they match specific thresholds (just below approval limits)?

2. Documentation Review

Honest errors usually have documentation—the invoice, the work order, the adjustment record—but the documentation contains errors. Fraud often involves missing, altered, or fabricated documentation.

Look for:

• Missing documentation: Transactions with no supporting documents
• Altered documentation: Documents that appear to have been modified
• Fabricated documentation: Documents that do not match other system records
• Photocopied documents: Originals that are consistently "lost" and only copies remain

3. Behavioral Indicators

Fraud is often accompanied by behavioral signs that honest errors are not:

• An employee who is reluctant to take vacation or sick leave
• An employee who insists on handling certain tasks personally
• An employee who resists changes to processes or systems
• An employee whose lifestyle exceeds their known income

These signs do not prove fraud, but they are risk factors that warrant closer scrutiny.

4. Control Override

Honest errors occur within the control system—the controls were not designed to prevent that specific error. Fraud often involves overriding or circumventing controls. If you find that controls were bypassed—approvals were skipped, access restrictions were ignored, reconciliation was not performed—the discrepancy is more likely to involve intentional conduct.

How to Investigate Suspicious Discrepancies

Step 1: Gather the Evidence

Collect all documentation related to the discrepancy: invoices, work orders, payment records, adjustment records, email communications, and system logs. Do not alter or destroy any documents.

Step 2: Trace the Transaction

Trace the transaction from source to deposit. At each step, verify that the documentation matches the system record. Any gap—missing documentation, altered amounts, unauthorized approvals—is a finding.

Step 3: Interview Personnel

Interview the people involved in the transaction. Ask open-ended questions about the process they followed. Do not accuse—ask for their understanding of what happened. Inconsistencies between interviews and documentation are significant.

Step 4: Look for Patterns

Search for similar transactions involving the same personnel, customers, or accounts. If you find a pattern of similar discrepancies, the likelihood of intentional conduct increases.

Step 5: Consult Professionals

If the evidence suggests fraud, consult with a certified fraud examiner (CFE), a forensic accountant, or legal counsel before taking action. They can guide the investigation, preserve evidence, and ensure that the investigation does not compromise potential legal proceedings.

When to Escalate

Escalate the investigation to professional investigators or law enforcement if:

• The amount involved is significant
• The evidence suggests a coordinated scheme
• Multiple employees may be involved
• The fraud may extend to other organizations
• There is a risk of evidence destruction

Do not confront a suspected fraudster directly without professional guidance. A premature confrontation can alert the perpetrator, leading to evidence destruction or retaliation.

Prevention

The same internal controls that prevent revenue leakage also help prevent fraud. The key controls are:

1. Segregation of duties: No single person controls all steps in a process
2. Mandatory vacations: Require all staff to take annual leave, during which their work is reviewed by others
3. Rotation of duties: Periodically rotate assignments so that different people handle the same process
4. Authorization thresholds: Require approval for transactions above defined amounts
5. Reconciliation: Regular reconciliation catches discrepancies early
6. Access controls: Restrict access to systems and data based on job requirements
7. Whistleblower policy: Provide a confidential channel for employees to report suspected fraud

See our guide to internal revenue controls for more on these controls.

Related Topics

• Internal revenue controls: Preventing billing errors and unauthorized adjustments
• Revenue anomaly detection: How to spot financial patterns that deserve investigation
• Accounting errors: How general ledger mistakes hide lost revenue
• What is revenue leakage?: The foundational guide

Summary

Not every revenue discrepancy is fraud. Most revenue leakage is caused by honest errors—process gaps, billing mistakes, and system limitations. But some discrepancies are caused by intentional misconduct. Distinguishing between the two requires pattern analysis, documentation review, behavioral indicators, and control override assessment.

If you suspect fraud, gather evidence, trace transactions, interview personnel, look for patterns, and consult professionals before taking action. Do not confront a suspected fraudster without professional guidance. The same internal controls that prevent revenue leakage—segregation of duties, mandatory vacations, authorization thresholds, reconciliation, access controls, and whistleblower policies—also help prevent fraud.

The Recoupant revenue assessment can help you identify whether discrepancies in your revenue may be caused by process gaps or may deserve deeper investigation.

Frequently Asked Questions

What is the difference between revenue loss and fraud? Revenue loss is unintentional—caused by process gaps, billing errors, and system limitations. Fraud is intentional—deliberate acts of deception designed to deprive the business of revenue. The key difference is intent.

How do I know if a discrepancy is fraud? Look for concentration in specific personnel, customers, or accounts; timing that correlates with specific individuals; amounts that match approval thresholds; missing or altered documentation; and behavioral indicators like reluctance to take vacation or lifestyle exceeding income.

What should I do if I suspect fraud? Gather all documentation, trace the transaction from source to deposit, interview personnel without accusing, look for patterns, and consult a certified fraud examiner or legal counsel before taking action. Do not confront the suspected fraudster directly without professional guidance.

What are the most common types of occupational fraud? The three categories are asset misappropriation (stealing cash or assets), corruption (kickbacks, conflicts of interest, bribery), and financial statement fraud (intentionally misstating financial statements). Asset misappropriation is the most common.

How do I prevent fraud? Implement the same internal controls that prevent revenue leakage: segregation of duties, mandatory vacations, rotation of duties, authorization thresholds, regular reconciliation, access controls, and a whistleblower policy. No single control is sufficient—use a combination.