Article by Prof. Hernan Huwyler, MBA, CPA, CAIO
AI GRC Director | AI Risk Manager | Quantitative Risk Lead
Speaker, Corporate Trainer and Executive Advisor
Top 10 Responsible AI and Risk Management by Thinkers360
Collusion Fraud: Why Standard Controls Fail And How To Build
Detection And Prevention Capabilities That Address Multi-Party Schemes
Why Collusion Deserves Specific Attention In Fraud Risk Assessment
Risk
specialists and internal auditors frequently underestimate or overlook
collusion in their fraud risk assessments. This oversight is
consequential because collusion, defined as the secret cooperation
between two or more individuals to defraud an organization, is among the
most damaging and most difficult to detect forms of occupational fraud.
It bypasses the controls that are designed to prevent single-actor
fraud, it persists for longer periods before detection, and it produces
significantly larger financial losses.
The Association of Certified Fraud Examiners
publishes the most comprehensive empirical data on occupational fraud
through its biennial Report to the Nations. The most recent edition,
published in 2024, confirms the pattern that has been consistent across
multiple reporting cycles: fraud schemes involving multiple perpetrators
produce substantially higher median losses than those involving a
single perpetrator. In the 2024 report, the median loss for schemes
involving collusion between two or more individuals was approximately $200,000, compared to approximately $50,000
for single-perpetrator schemes, representing a ratio of roughly four to
one. The data also confirms that collusive schemes have a longer median duration
before detection, typically lasting eighteen months compared to twelve
months for single-perpetrator fraud, because the participants actively
cover for each other, manipulate records from multiple organizational
positions, and exploit their combined knowledge of the control
environment to avoid triggering detection mechanisms.
Despite this
evidence, many organizations continue to design their fraud prevention
and detection frameworks primarily around the assumption that fraud is
committed by individual actors. Segregation of duties, authorization
controls, and access restrictions are all essential controls, but they
are inherently designed to prevent or detect the actions of a single individual
who attempts to circumvent controls unilaterally. When two or more
individuals coordinate their actions, they can distribute the steps of a
fraudulent scheme across roles that are segregated precisely to prevent
any single person from completing the full transaction cycle. The
segregation of duties control remains intact on paper while being
rendered ineffective in practice.
The COSO Fraud Risk Management Guide,
published in 2016, provides a structured framework for conducting fraud
risk assessments. It emphasizes the importance of considering the opportunity, pressure, and rationalization elements of the fraud triangle, originally developed by Donald Cressey, and extends the analysis to include the capability
dimension added by David Wolfe and Dana Hermanson in their 2004
articulation of the fraud diamond. Collusion directly amplifies the
capability dimension because the combined access, knowledge, and
authority of multiple participants creates opportunities for fraud that
no individual participant could exploit alone. A fraud risk assessment
that does not explicitly consider collusion scenarios is incomplete
regardless of how thoroughly it addresses single-actor fraud risks.
How Collusion Bypasses Standard Controls
Understanding
why collusion is effective requires understanding the specific
mechanisms through which it defeats the controls designed to prevent
fraud.
Segregation of duties bypass is the most
fundamental mechanism. When one employee has authority to initiate a
transaction and another has authority to approve it, the segregation of
duties control assumes that the approver will exercise independent
judgment and reject unauthorized or fraudulent transactions. When the
initiator and the approver are colluding, this assumption fails. The
approver knowingly approves the fraudulent transaction, and the control
produces the same evidence of proper authorization that it would produce
for a legitimate transaction. The audit trail appears complete and
compliant. The documentation satisfies the reviewer. The fraud is
invisible to any detection method that relies on the integrity of the
approval process.
Knowledge exploitation
compounds the effectiveness of collusion. Insiders who participate in
collusive schemes typically possess detailed knowledge of the
organization's control environment, including which controls are
automated and which are manual, which transactions are subject to review
and which fall below review thresholds, which time periods attract
heightened scrutiny and which do not, and which data fields are
monitored by exception reporting and which are not. This knowledge
allows the participants to design their scheme to avoid the specific
detection mechanisms that would identify the same behavior if
perpetrated by an outsider or a less knowledgeable insider.
Mutual concealment
extends the duration of collusive schemes. In a single-perpetrator
fraud, the perpetrator must conceal the scheme alone and is vulnerable
to detection whenever a colleague, supervisor, or auditor examines the
affected transactions or accounts. In a collusive scheme, the
participants actively protect each other by corroborating false
explanations, covering for absences during which fraudulent activities
occur, suppressing complaints or inquiries that might expose the scheme,
and ensuring that the documentary record appears consistent and
unremarkable. This mutual protection is the primary reason that
collusive schemes persist for significantly longer than single-actor
fraud.
Escalation patterns are characteristic of
many collusive schemes. The participants typically begin with small test
transactions to confirm that the scheme can be executed without
detection. When the initial transactions succeed and no investigation is
triggered, the participants increase the frequency and magnitude of the
fraudulent transactions. This escalation is often visible in
retrospective data analysis as an acceleration in the volume or value of
transactions with specific vendors, account categories, or transaction
types, but it is difficult to detect in real time without dedicated
monitoring tools.
Common Collusion Schemes By Business Process
Collusive
fraud manifests in characteristic patterns across different business
processes. Understanding these patterns is essential for designing
detection and prevention controls that address multi-party schemes
specifically.
Procurement And Vendor Fraud
Procurement
is one of the highest-risk areas for collusion because it involves
transactions between the organization's employees and external parties
who may share financial interests. The most prevalent procurement
collusion schemes involve the creation of fictitious vendors or shell companies
through which fraudulent payments are processed. In this scheme, one
participant creates or maintains the vendor master record while another
processes invoices or approves payments against that record. The
payments are directed to an entity controlled by one or both
participants, and the fictitious vendor provides no goods or services,
or provides them at inflated prices with the excess shared between the
colluders.
Kickback schemes involve an employee
who influences the organization's purchasing decisions in favor of a
particular vendor in exchange for payments, gifts, or other benefits
provided by that vendor. The vendor may inflate prices to fund the
kickback, provide inferior goods or services, or receive preferential
treatment in competitive bidding processes. Red flags include employees
who resist changes to established vendor relationships, who insist on
directing purchases to specific suppliers without competitive
justification, or who maintain personal relationships with vendor
representatives that extend beyond normal business interactions.
Bid rigging
is a form of collusion that occurs between external parties, often with
the participation or knowledge of an insider who manages the
procurement process. Bid rigging schemes include complementary bidding,
in which cartel members submit deliberately high or non-competitive
bids to ensure that the designated winner receives the contract; bid rotation, in which cartel members take turns submitting the winning bid across successive procurement rounds; and bid suppression,
in which one or more qualified bidders refrain from bidding to reduce
competition. Academic research on public procurement fraud, including
studies of construction and infrastructure procurement in multiple
jurisdictions, has demonstrated that these patterns are detectable
through statistical analysis of bidding data, including the analysis of
price similarity among bids, the frequency of subcontracting
relationships between ostensible competitors, and the rotation of
winning bidders across successive contracts.
Accounts Payable And Payment Processing Fraud
Collusion
in accounts payable typically involves one participant who creates or
modifies vendor records, invoices, or payment instructions and another
who approves or processes the payments. Schemes include duplicate payment processing, where the same legitimate invoice is paid multiple times with the excess directed to the colluders; false invoice creation, where invoices for goods or services never received are submitted and approved; and payment redirection,
where legitimate payments are diverted to accounts controlled by the
colluders through modification of bank details in the vendor master
record.
Payroll And Human Resources Fraud
Collusive
payroll fraud typically involves one participant in human resources who
creates or maintains employee records and another in payroll processing
who ensures that payments are generated against those records. Ghost employee schemes involve the creation of fictitious employees whose salary payments are collected by the colluders. Referral bonus fraud
involves the submission and approval of fictitious referral claims by
participants who control both the submission and the approval steps.
These schemes exploit control gaps that allow the same individual or a
small group to manage the end-to-end process from record creation
through payment without independent verification of the underlying
reality.
Financial And Banking Operations Fraud
In
financial institutions, collusion between employees in different
operational roles can enable the reactivation of dormant accounts, the
creation of unauthorized transactions, and the diversion of funds. A
characteristic scheme involves a back-office employee who reactivates or
creates accounts and a front-office employee who processes transactions
against those accounts. The segregation between front-office and
back-office functions, which is a fundamental control in financial
services, is defeated when participants from both sides of the
segregation coordinate their actions.
Management-Level Collusion And Override
Collusion
that involves management or executive-level participants is
particularly dangerous because these individuals often have the
authority to override controls, direct subordinates to execute
transactions without standard approvals, and suppress inquiries or
investigations that might expose the scheme. Management-level collusion
is frequently associated with control environment weaknesses
where the tone at the top tolerates or encourages aggressive financial
management, where oversight mechanisms lack independence, and where
subordinate employees feel unable to challenge or report the
instructions of senior leaders. The ACFE data consistently shows that
fraud committed by owners and executives produces the highest median
losses of any perpetrator category, and when these individuals
participate in collusive schemes, the losses are compounded by the
authority and access they bring to the conspiracy.
Building A Multi-Layered Detection Framework
Because collusion defeats the controls designed to prevent single-actor fraud, detection requires a multi-layered approach
that combines proactive data analytics, behavioral monitoring,
reporting channels, and audit procedures designed specifically to
identify the signatures of multi-party schemes.
Proactive Data Analytics And Continuous Monitoring
The
ACFE Report to the Nations consistently identifies proactive data
analytics as one of the most effective detection methods for
occupational fraud, and its value is particularly significant for
collusive schemes because analytics can identify patterns that are
invisible to manual review and that collusion participants cannot easily
eliminate.
Effective analytical procedures for collusion detection include the correlation of transaction execution data with communication records.
When an individual who initiates a transaction communicates by email,
telephone, or messaging platform with the individual who approves that
transaction shortly before or after the transaction is processed, the
coincidence of communication and transaction creates a data point that
warrants further investigation. This cross-system correlation requires
the integration of ERP transaction logs with communication metadata,
which in turn requires appropriate data governance, privacy compliance,
and legal authorization.
Vendor-employee relationship analysis
examines connections between employees and vendors through shared
addresses, telephone numbers, bank accounts, corporate registrations, or
social media connections. Modern entity resolution tools and network
analysis software can identify these connections across large datasets
that would be impossible to review manually.
Approval pattern analysis
identifies anomalies in the distribution of approvals, such as a
specific approver who consistently authorizes transactions from a
specific initiator, an approver who processes approvals outside normal
business hours, or approval patterns that consistently fall just below
the threshold that would require additional authorization.
Transaction anomaly detection
flags transactions that exhibit characteristics associated with
fraudulent schemes, including round-dollar amounts, transactions
processed at unusual times, sequential invoice numbers from the same
vendor, payments to vendors in jurisdictions unrelated to the
organization's operations, and transactions that match known fraud
typologies. The earlier post on detecting illegal payments in accounting
records provided a detailed framework for these monitoring queries, and
many of the same techniques apply to collusion detection.
Network analysis
identifies clusters of users whose transaction activities are
interconnected in ways that suggest coordination rather than independent
action. This technique, which has been validated in academic research
on fraud detection, uses graph-theory-based methods to map relationships
between individuals based on their shared transaction patterns, shared
counterparties, and communication connections.
To be effective, these analytical techniques must link data across multiple organizational systems, including the ERP
system, email and communication platforms, human resources records,
vendor master databases, corporate directories, and external data
sources such as corporate registries and sanctions databases.
Analytics that operate within a single system can identify anomalies
within that system's data but cannot detect the cross-system patterns
that characterize collusion.
Behavioral Red Flags
While
data analytics provides the quantitative foundation for collusion
detection, behavioral observation provides qualitative signals that can
complement and contextualize analytical findings. The ACFE data
identifies several behavioral red flags that are frequently associated
with fraud perpetrators, including living beyond apparent means,
maintaining unusually close or secretive relationships with vendors or
counterparties, exhibiting reluctance to take vacations or to delegate
duties, resisting organizational changes that would alter their
responsibilities or access, and displaying defensive or evasive behavior
when questioned about specific transactions or relationships.
These
behavioral indicators are not proof of fraud, and their absence does
not guarantee integrity. However, when behavioral red flags coincide
with analytical anomalies, the combined signal significantly increases
the probability that a collusive scheme exists and warrants
investigation.
Whistleblower And Reporting Mechanisms
The
ACFE data consistently identifies tips as the most common method of
fraud detection, accounting for approximately 43 percent of all detected
cases in the 2024 Report to the Nations. Organizations with established
hotlines and reporting mechanisms detect fraud earlier and experience
lower median losses than those without such mechanisms. The ACFE data
indicates that the presence of a hotline reduces median losses by
approximately fifty percent and accelerates detection by approximately six months.
For
collusion detection specifically, reporting channels are critical
because colleagues, subordinates, and business partners who observe
suspicious relationships or unusual patterns of behavior between
potential colluders may provide the initial intelligence that triggers
an investigation. The effectiveness of reporting channels depends on
their accessibility, confidentiality protections, perceived
credibility, and the organization's demonstrated willingness to
investigate and act on reports, as discussed in the earlier post on building a sustainable risk and compliance culture.
Audit Procedures Designed For Collusion
Traditional
audit procedures are effective at detecting many forms of fraud, but
they must be specifically designed and supplemented to address
collusion. The ACFE data indicates that internal audits detect
approximately fifteen to twenty percent of occupational
fraud cases, making them the second most common detection method after
tips. However, standard audit procedures that rely on the integrity of
the approval chain, the completeness of documentation, and the accuracy
of management representations may fail to detect collusive fraud
precisely because the colluders have ensured that these elements appear
to be in order.
Audit procedures that are more effective against collusion include surprise audits that do not follow predictable schedules, mandatory rotation of auditors across audit areas to prevent auditors from developing relationships with the individuals they audit, substantive testing that goes beyond documentation review to include direct verification of the existence and delivery of goods and services, cross-functional analysis
that traces transactions across organizational boundaries to identify
coordination between individuals in different departments, and explicit consideration of collusion scenarios during the audit planning and risk assessment phase.
The PCAOB Auditing Standard AS 2401,
which addresses the auditor's consideration of fraud in a financial
statement audit, requires the external auditor to consider the risk that
management may override internal controls, which is the most common
form of management-level collusion. The IIA Standards require the
internal audit function to evaluate the potential for fraud as part of
its risk assessment and engagement planning processes, and this
evaluation should explicitly address collusion scenarios given their
disproportionate financial impact.
Prevention: Designing Controls That Address Multi-Party Schemes
While
detection is essential, prevention is preferable. Designing the control
environment to reduce the opportunity and incentive for collusion
requires measures that go beyond standard single-actor fraud prevention.
Enhanced Segregation Of Duties With Rotation
Segregation of duties remains the foundational preventive control, but for collusion prevention it must be supplemented with mandatory job rotation and periodic reassignment
of individuals in high-risk positions. Rotation disrupts established
collusive relationships by changing the combination of individuals who
control different steps of a transaction cycle. It also brings new
perspectives to each role, increasing the probability that a new
incumbent will notice irregularities left by their predecessor. As
discussed in the earlier post on segregation of duties conflicts in SAP,
the SoD matrix should be designed to prevent the assignment of
incompatible access to single users, but for collusion prevention, the
organization must also consider the combination of access across users who could coordinate their actions.
Vendor And Relationship Disclosure Requirements
Employees and directors should be required to disclose any financial interests, family relationships, or other connections
with the organization's vendors, customers, agents, and other business
counterparties. These disclosures should be collected at onboarding,
refreshed annually, and verified against available data sources
including vendor master records, corporate registries, and social media.
Undisclosed relationships between employees and vendors are among the
strongest predictive indicators of procurement fraud and kickback
schemes.
Mandatory Vacation And Duty Sharing Policies
Requiring
employees in high-risk positions to take consecutive days of leave
during which their duties are performed by another individual is one of
the oldest and most effective anti-fraud controls. Many collusive
schemes require the active participation of a specific individual on an
ongoing basis, and their absence creates a window during which the
substitute may detect irregularities that the regular incumbent has been
concealing. Employees who resist or repeatedly defer mandatory vacation
should be identified for heightened monitoring.
Vendor Due Diligence And Ongoing Monitoring
Pre-engagement
vendor due diligence, as discussed in the earlier post on FCPA audit
procedures, should include verification of the vendor's beneficial
ownership, operating history, physical presence, and any connections to
the organization's employees. For ongoing vendor relationships, periodic
re-verification and monitoring of payment patterns, pricing trends, and
the vendor's continued legitimacy should be conducted as a routine
compliance activity.
Tone At The Top And Control Environment Quality
The most effective prevention against collusion, as against all forms of fraud, is a strong control environment
supported by genuine tone at the top and consistent enforcement of
ethical standards across all levels of the organization. The ACFE data
demonstrates that organizations with weak control environments,
characterized by management override, tolerance of policy violations,
and inadequate accountability, experience significantly higher rates of
fraud including collusive fraud. The earlier posts on GRC culture and on
compliance culture developed the conditions under which strong control
environments are built and sustained.
Anonymous Reporting And Retaliation Protection
The
effectiveness of tips as the primary detection mechanism for fraud
means that organizations must invest in the accessibility, credibility,
and legal protection of their reporting mechanisms. Whistleblower
protections under EU Directive 2019/1937, Ley 2/2023 in Spain, and the Dodd-Frank Act
in the United States provide legal frameworks for protecting reporters,
and organizations should ensure that their internal policies meet or
exceed these legal requirements. Employees who observe indicators of
collusion will report them only if they believe the report will be taken
seriously, investigated impartially, and handled without retaliation
against the reporter.
The Role Of Technology: Beyond Simple Transaction Monitoring
The
original post referenced business intelligence tools that match
transaction codes with communication records, and this approach remains
relevant but has evolved significantly with advances in technology.
Process mining tools
such as Celonis, SAP Signavio, and similar platforms can analyze the
actual execution of business processes by extracting event logs from the
ERP system and visualizing the complete process flow. For collusion
detection, process mining can identify deviations from the intended
process sequence, unusual routing of approvals, and patterns of
interaction between specific users that differ from the standard process
model. These tools provide a data-driven view of how processes are
actually executed rather than how they are designed, which is precisely
the analytical perspective needed to detect collusion-driven deviations.
Entity resolution and network analytics platforms
can identify hidden relationships between individuals and entities
across multiple data sources, including ERP master data, HR records,
corporate registries, social media, and external databases. These
platforms use probabilistic matching, graph database technology, and
machine learning algorithms to detect connections that manual review
cannot identify at scale.
Natural language processing and text analytics
can be applied to email archives, messaging records, and document
repositories to identify communications that contain indicators of
collusive coordination, including references to concealment, urgency
related to transaction timing, and language patterns associated with
conspiratorial communication. These tools must be deployed within the
legal and regulatory constraints governing employee communications
monitoring in each jurisdiction, including GDPR requirements in Europe
and applicable privacy laws in other jurisdictions.
Continuous auditing platforms
that integrate with the ERP system and execute predefined analytical
tests on a daily or real-time basis can provide the ongoing monitoring
capability needed to detect collusion patterns as they develop rather
than discovering them months or years later during periodic audits.
These platforms, including SAP GRC Process Control, ACL (now Galvanize),
and similar tools, automate the execution of the analytical procedures
described above and generate exception reports for investigation.
The effectiveness of all these technologies depends on their integration across data sources.
A monitoring tool that examines only ERP transaction data without
access to communication records, HR data, and vendor databases will miss
the cross-system patterns that are the defining characteristic of
collusion. The technology architecture for collusion detection must be
designed for cross-system correlation from the outset.
From Individual Controls To Systemic Fraud Resilience
Collusion
fraud will never be entirely eliminated because it exploits the
fundamental trust that organizations must extend to their employees in
order to function. No control environment can be designed on the
assumption that every combination of employees might conspire to defraud
the organization. The goal is not to create an environment of universal
suspicion but to build a fraud-resilient organization
in which the probability of successful collusion is minimized by layered
preventive controls, the duration of undetected collusion is shortened
by proactive monitoring and analytical capabilities, the incentive to
collude is reduced by a strong ethical culture and meaningful
accountability, and the channels through which collusion is reported are
accessible, credible, and protected.
The organizations that
achieve this resilience are those that design their fraud risk
assessments to explicitly address collusion scenarios, that invest in
the cross-system analytical capabilities required to detect multi-party
schemes, that maintain reporting mechanisms that employees trust and
use, and that build the culture of integrity that makes collusion the
exception rather than the undetected norm.
Traditional audit
procedures remain essential, but they are insufficient by themselves.
The ACFE data is clear that audits alone detect approximately one-fifth
of occupational fraud cases. The remaining four-fifths are detected
through tips, management review, accident, and proactive data analytics.
A comprehensive anti-collusion framework integrates all of these
mechanisms into a multi-layered detection and prevention architecture
that addresses the specific characteristics that make collusion both
more damaging and more difficult to detect than single-actor fraud.
Why Segregation Of Duties Alone Is Not Enough
Segregation
of duties remains a foundational anti fraud control, but it is not
sufficient on its own. In fact, collusion is the precise scenario in
which segregation of duties can fail despite being designed correctly on
paper.
If one employee can create or influence a transaction and
another can approve it, the control works only if the approval is
independent and meaningful. Where the approver is compromised,
disengaged, or cooperating, the process may still look compliant while
the fraud proceeds.
That is why mature fraud risk programs treat
segregation of duties as necessary but not complete. They reinforce it
with monitoring, escalation, exception review, data analytics, rotation,
access governance, management challenge, and independent review of
unusual activity. The real objective is not simply to split duties. It
is to make collusion harder, costlier, and more visible.
Where Collusive Fraud Commonly Appears
Collusive
fraud often concentrates in areas where one person can create economic
value and another can validate, release, or conceal it.
Procurement
and accounts payable are particularly exposed. An employee may collude
with a vendor to inflate invoices, create fictitious suppliers, rotate
purchase volumes, override sourcing discipline, or approve services that
were never delivered. Kickback arrangements, bid rigging, and invoice
manipulation often rely on a combination of insider access and external
cooperation.
Payroll and HR can also be vulnerable. Ghost
employees, referral bonus schemes, overtime inflation, or unauthorized
compensation adjustments may occur when onboarding, payroll processing,
and approval functions do not challenge each other effectively.
Banking
and treasury environments face different variants. Dormant accounts can
be reactivated, payment instructions changed, or reconciliations
manipulated if front office, back office, and cash operations do not
remain truly independent.
Sales and customer refunds can also be
at risk, especially where customer master data, credit memos, pricing
overrides, and cash application processes are weakly monitored.
The broader point is that collusion tends to emerge where process authority, economic value, and weak challenge intersect.
What A Strong Fraud Risk Assessment Should Ask
A
stronger fraud risk assessment should move beyond the question of
whether controls exist and examine whether those controls would remain
effective if two or more actors cooperated.
This means evaluating
where the same transaction flow depends on trust between initiator and
approver, where process owners and control owners have personal or
economic ties to counterparties, where one reviewer could routinely
validate another’s activity without substantive challenge, and where
high volume or repetitive processing creates cover for coordinated
manipulation.
It also means including third party relationships in
the assessment. Many collusive frauds depend on vendors, distributors,
subcontractors, consultants, or customers who cooperate with insiders to
create the appearance of legitimacy. A fraud risk model that considers
only internal employee behavior will often miss the most material
pathways.
What Prevention Looks Like In Practice
The
original draft was right to point to segregation of duties,
relationship disclosures, and monitoring. Those remain important, but a
stronger prevention framework should be broader.
Conflict of
interest and relationship disclosure is essential. Directors, officers,
and employees should disclose personal, family, and economic
relationships with vendors, customers, agents, and other counterparties
where those relationships could affect business decisions.
Approval
design should also be strengthened. An approval is not a meaningful
control simply because it exists in workflow. Management should examine
whether approvers are reviewing evidence, challenging anomalies, and
documenting rationale, especially in high risk processes such as
procurement, payments, refunds, master data changes, and payroll.
Mandatory
vacations, role rotation, and independent review can also be powerful.
Collusive schemes often depend on stable patterns and uninterrupted
control over key steps. Rotation and temporary reassignment can break
that continuity.
Hotlines and speak up mechanisms are especially
important because many collusive schemes are detected through tips
rather than through routine control activity. This is one of the reasons
effective reporting channels remain among the highest value anti fraud
controls in practice.
How Data Analytics Can Improve Detection
The
original post correctly pointed to business intelligence and data
mining tools, but the concept should be framed more precisely.
Modern
fraud detection is increasingly data driven. Analytics can identify
suspicious patterns in approvals, invoice timing, vendor setup, payment
routing, access logs, communications metadata where legally and
ethically permissible, and transaction behavior that departs from normal
relationships.
For example, organizations can monitor duplicate
or near duplicate payments, unusual round value disbursements, split
invoices below approval thresholds, repeated use of the same approver
and requestor pair, sudden spikes in vendor activity, bank account
changes followed by rapid payment release, dormant account reactivation,
abnormal referral or bonus patterns, and price similarity in bidding
behavior.
The highest value analytics often come from linking
systems rather than reviewing each one in isolation. ERP data, vendor
master records, HR data, access management records, case management, and
where appropriate and lawful, communication metadata can reveal
patterns that are invisible in a single application.
That said,
organizations should be careful not to overstate the technology.
Analytics do not prove collusion on their own. They identify patterns
that warrant investigation. Human judgment, case development, and legal
discipline remain critical.
Why Behavioral Indicators Still Matter
Data
is important, but collusion is also a human behavior problem.
Behavioral indicators can provide early warning when interpreted
carefully.
Employees involved in collusive schemes may resist duty
sharing, avoid rotation, discourage review, push for the same vendors
repeatedly, maintain unusual secrecy around relationships, or display
unexplained defensiveness when questioned about routine transactions.
They may also appear indispensable because they have built the process
around personal control and limited transparency.
These indicators
are not evidence of fraud by themselves, but they become more relevant
when they appear together with transactional anomalies.
What Internal Audit Should Do Differently
Internal
audit can play a significant role here, but only if it explicitly
includes collusion scenarios in fraud risk assessment, planning, and
testing. Too many audit programs test whether segregation of duties
exists but do not test whether collusion could defeat it in practice.
A
more mature audit approach examines whether approvals are substantive,
whether related party and conflict disclosures are credible, whether
exception reporting is challenged independently, whether key processes
rely too heavily on trusted individuals, and whether analytics are being
used in high risk areas such as procurement, payroll, treasury, and
customer refunds.
Internal audit should also challenge management
if fraud risk assessment assumes independence where no meaningful
independence exists.
Final Perspective
Collusive
fraud is one of the most dangerous forms of misconduct because it
exploits the very structure of internal control. It is harder to detect,
often more costly, and more likely to remain hidden when organizations
rely too heavily on formal separation of duties without testing whether
those separations are actually independent.
The practical
implication is clear. Fraud risk assessments should not focus only on
what one person can do. They should also examine what two or more
people, or an insider and an external party, could do together.
In the current environment, that is not an advanced fraud topic. It is a basic requirement for credible risk management.
References
Association of Certified Fraud Examiners. Occupational Fraud Reports
Committee of Sponsoring Organizations of the Treadway Commission. Internal Control Integrated Framework
Institute of Internal Auditors guidance relevant to fraud risk and internal control limitations
Leading market practice in anti fraud analytics, procurement integrity, and collusion detection
Selected forensic and academic literature on collusive fraud, bid rigging, and fraud network analysis
Get the latest in corporate governance, risk, and compliance on Twitter
