Fraud Triangle: The Three Elements in Investigations

What the Fraud Triangle is

The fraud triangle is a model of why a trusted person commits fraud when perceived pressure, an opportunity and a justification come together. Each element describes a possible part of the person’s decision.

Pressure gives someone a reason to seek money. Opportunity gives them access and a way to avoid detection. Rationalisation makes the act seem acceptable to them.

The model helps explain risk and motive. It does not establish that a particular payment was dishonest, or that a person committed fraud. Someone can have debts and payment access while doing their job properly.

A useful distinction is between an investigative question and a finding. “Did debt repayments influence the timing?” is a question. “The business payment reached the employee’s account” is a finding supported by a traced transfer.

The Three Elements: Pressure, Opportunity and Rationalisation

The three fraud triangle elements describe the need a person perceives, the opening they see and the explanation they give themselves.

Element	Meaning	Workplace example	What helps test it
Pressure	A financial or other problem the person feels they must solve	A pressing debt repayment they cannot meet	Lawfully obtained statements and the timing of repayments
Opportunity	Access that lets the person take money and conceal the act	A bookkeeper can change a supplier’s bank details and release payments alone	Access permissions, payee changes and approval logs
Rationalisation	A justification that makes the conduct seem acceptable	The person believes the business owes them unpaid overtime or that they will repay the money	Messages, explanations and evidence of purported repayments

Opportunity is usually the element an organisation can see and control most directly. Managers can examine payment access and separate approval from release. They have less direct access to an employee’s private financial pressures or thoughts.

Consider a fictional Australian workplace. A bookkeeper faces overdue personal debts and controls supplier details as well as payment release. They divert A$300 and tell themselves they are borrowing unpaid overtime.

The first diversion attracts no query. Over the next six weeks, they divert A$1,200 and then A$2,400 through the same supplier record. The debt gives the perceived pressure, unchecked access supplies the opportunity and the borrowing story supplies the rationalisation.

Those facts explain the hypothetical conduct. In a real matter, you must establish the payee changes and destination account from evidence. A similar pattern alone cannot identify the person responsible.

Where the Theory Came From

Donald Cressey’s research on convicted embezzlers supplied the ideas later taught as the fraud triangle. He studied people who had violated positions of financial trust.

The Association of Certified Fraud Examiners’ account of Cressey’s research describes recurring explanations from those interviews. They included a problem the person felt unable to share, a perceived opportunity and reasons that made the conduct seem acceptable.

Cressey’s work appeared in Other People’s Money. The interviews concerned trust violations, so their findings need care when applied to other forms of fraud.

The triangle diagram is a later teaching form of those ideas. The Association of Certified Fraud Examiners (ACFE) teaches it through its training and public fraud resources. Its historical account identifies W. Steve Albrecht as one of the model’s creators, while John Gill explains that Cressey’s factors were later presented as a triangle.

That distinction preserves the contribution of the original research without treating the diagram as something Cressey necessarily drew himself.

Using the Fraud Triangle in Audits and Investigations

Auditors use the fraud triangle’s categories to identify risks of material misstatement and decide how to respond with audit procedures.

Appendix 1 of Australian Auditing Standard ASA 240 groups examples as “incentives/pressures”, “opportunities” and “attitudes/rationalisations”. This is the 2023 compilation of the standard. Its examples cover fraudulent financial reporting and misappropriation of assets.

An auditor considers the entity’s circumstances and uses professional judgement. An apparent pressure can lead to enquiries and tests of the affected transactions. It does not replace audit evidence or establish a legal finding of fraud.

An investigator uses the same categories to plan document requests and interviews. Suspected pressure suggests a chronology of debts and spending, where lawful access exists. Opportunity suggests requests for payment permissions, approval records and changes to payee details.

For rationalisation, ask the person to explain the payment and its business purpose. Compare the answer with invoices, messages and accounting entries. Keep plausible alternative explanations in the investigation until the evidence resolves them.

A fraud risk assessment turns these concerns into a wider organisational assessment. The triangle itself is a way to organise questions about a matter.

What Bank Records Show About Pressure

Bank records can show financial strain and its timing, but they rarely establish how a person felt about it. Read the whole account history before treating one transaction as a pressure indicator.

Examine the account history for the following patterns:

• Gambling payments that rise in amount or frequency.
• Repeated dishonoured payments and associated fees.
• Payday-loan repayments or several buy now pay later obligations falling close together.
• Persistent overdrawn balances.
• Payments to debt collectors alongside other overdue commitments.

A gambling merchant description needs enough detail to identify the recipient. Buy now pay later use can reflect ordinary budgeting. A dishonour might follow a delayed salary payment or an account transfer, so compare the surrounding credits and balances.

Personal statements require lawful access, such as the account holder’s consent or a valid subpoena under the relevant court process. Employment alone does not give an investigator access to an employee’s private accounts.

In Federal Court proceedings, a subpoena can require documents to be produced to the court. The Federal Court’s subpoena practice note explains that inspection requires a court order unless the judge or registrar permits otherwise. Production and permission to inspect are separate steps.

Build the chronology around the first suspect business payment. If gambling debits and missed repayments increase beforehand, the sequence supports a hypothesis of pre-existing pressure. If they begin afterwards, that same explanation needs reconsideration.

FinTrace saves forensic accountants hours of statement conversion and review by consolidating supplied PDFs into a searchable ledger and a clear findings report. Suspicious transactions and gambling activity are flagged with their source PDF filename and page, giving you the evidence alongside the chronology.

What Bank Records Show About Opportunity

Business bank records show payments and destinations, while banking permissions and audit logs show who could authorise or release them. You need both to explain an opportunity accurately.

Examine whether the same person approved and released suspect payments. Compare payee changes with the payments that followed. Repeated amounts just below an approval limit can suggest deliberate avoidance, once the actual limit and approval process are established.

A transfer to an account connected to a staff member needs verified account ownership. A familiar name in a transaction description is a lead. Bank confirmations or lawfully obtained receiving statements can establish the destination more firmly.

For a traced payment, match the business debit with the receiving credit using the amount and timing, then compare account identifiers and references. Account for processing delays, fees and any split payments. Record unresolved matches separately from confirmed ones.

In the fictional example, the A$1,200 business outflow appears as a credit in the bookkeeper’s personal account. The payee-change log records their user account changing the supplier details before payment. Together, those records establish a money movement and system activity to investigate.

The legal classification of a trusted person’s theft is addressed in embezzlement. Building the wider staff-fraud case belongs to employee fraud. For whole-ledger screening methods, use forensic data analytics.

Rationalisation: What Records Can and Cannot Show

Rationalisation is a state of mind, so bank records rarely prove it directly. A transaction tells you that money moved, while the person’s explanation helps establish why they say it moved.

Small early diversions that grow can fit a borrowing story. Part repayments can support a claim that the person treated the money as a loan. Entries labelled as reimbursements can show how a payment was presented in the accounts.

Each also has other explanations. Increasing amounts can reflect changing opportunities, and a part repayment can follow discovery. A reimbursement label can describe a genuine authorised expense.

Test a purported loan against the agreement, authorisation and repayment terms. Compare a reimbursement with its receipt and the employer’s approval. Record the explanation in the person’s own words without turning an accounting label into proof of their beliefs.

Limits of the Model and the Fraud Diamond

The fraud triangle has a weaker fit for organised or collusive fraud because a scheme can involve several people with different motives and roles. Planning around one trusted individual can miss those relationships.

Hindsight is another limitation. After discovering a theft, ordinary debts and access can appear to explain it too neatly. John Gill’s ACFE discussion stresses that Cressey’s interviews lacked control groups and that the triangle cannot explain every fraud.

The fraud diamond proposed by David T. Wolfe and Dana R. Hermanson adds capability. Their 2004 CPA Journal article distinguishes an available opportunity from the personal ability to exploit it and keep the scheme going.

Capability includes the person’s position and knowledge of systems. In the fictional matter, knowing how supplier records feed into payment batches explains how the bookkeeper could use their access. The diamond makes that ability an explicit question.

Use either model to direct the next evidence request. Keep the final account of the matter anchored in the payments, authorisations and explanations the records establish.