The ACFE Occupational Fraud Taxonomy

Classification is an analytical necessity, not an administrative formality. Different fraud categories leave different evidence trails, are detected by different analytical methods, and are addressed by different control responses. An investigator who treats a procurement fraud as an expense reimbursement fraud will look at the wrong records. One who treats a financial-statement fraud as an asset-misappropriation case will interview the wrong people and apply the wrong accounting standards as the baseline for comparison.

The Fraud Tree is also a communication tool. When a forensic accountant says 'we are investigating a billing scheme in the accounts-payable function', the taxonomy makes that description precise and shared. Everyone in the investigation, whether they are a CFE, a CPA, an attorney, or a law-enforcement agent, understands what kind of scheme is alleged, what the evidence profile is, and what a successful investigation needs to establish.

The taxonomy was developed by Joseph T. Wells, drawing on his FBI investigative experience and the ACFE's growing case database. It has been refined across successive editions of the Report to the Nations and is now integrated into the CFE examination curriculum, the AICPA's forensic accounting guidance, and many corporate fraud-risk frameworks worldwide.

Asset misappropriation accounts for approximately 86% of all occupational fraud cases in the ACFE's most recent reports, with a median loss in the $100,000 to $200,000 range, compared to millions for financial-statement fraud. It divides into two main sub-branches: cash schemes and non-cash schemes.

Cash schemes subdivide into theft of cash on hand and fraudulent disbursements. Cash-on-hand theft includes skimming (taking cash before it is recorded) and cash larceny (taking cash after it has been recorded). The distinction matters for detection: skimming leaves no accounting entry to query, so it is typically caught by comparing expected receipts to recorded receipts using external data, not by examining the accounting records themselves. Cash larceny, by contrast, leaves a recorded receipt with a subsequent deficiency, which shows up in reconciliation.

Fraudulent disbursements are the largest sub-category within asset misappropriation, and billing schemes are the single most commonly identified scheme type. A billing scheme involves a fraudster causing the organisation to issue a payment for fictitious goods or services, inflated invoices, or personal purchases run through a company account. The fraudster typically creates a shell vendor or uses a real vendor account to which they have redirected payment, and the payment flows to an account they control.

Corruption appeared in approximately 50% of cases in the ACFE's 2022 Report to the Nations. Because cases can involve multiple fraud types, percentages across branches do not sum to 100. Corruption schemes involve an employee misusing their position for personal benefit, almost always in collaboration with an external party: a vendor, customer, regulator, or competitor.

The four primary sub-categories within corruption are bribery, kickbacks, conflicts of interest, and economic extortion. Bribery involves offering, giving, receiving, or soliciting something of value to influence a business decision. Kickbacks are a specific form of bribery in procurement: a vendor pays a percentage of a contract back to the employee who awarded the contract, typically in cash or through an intermediate entity. Conflicts of interest arise when an employee has an undisclosed personal or financial interest in a transaction they are making on behalf of the organisation.

Financial-statement fraud represents fewer than 10% of cases in the ACFE's data but produces the highest median losses, in the range of $500,000 to several million dollars per case in recent editions, compared to $100,000 to $200,000 for asset misappropriation. It is typically perpetrated by senior management or executives, who have both the capability to execute the scheme and the authority to direct the accounting treatment that conceals it.

Financial-statement fraud subdivides into schemes that overstate financial performance and schemes that understate it. Overstatement is far more common: inflating revenues, understating expenses or liabilities, and overstating assets. Each of these has multiple scheme variants documented in the taxonomy. Revenue fraud includes fictitious sales, premature revenue recognition, and channel-stuffing. Expense fraud includes capitalising operating costs (WorldCom's core technique), suppressing accounts payable, and off-balance-sheet liabilities (Enron's SPE structure).

Understatement fraud, where an organisation deliberately underreports its performance, occurs less often but is not rare. It appears in tax-fraud contexts, in situations where an executive wants to depress a target company's price before a buyout, or where a controlling shareholder is diverting profits to related parties not reflected in the financial statements.

• Revenue overstatement: recognising revenue before it has been earned or fabricating it outright (Xerox, HealthSouth).
• Expense suppression: capitalising operating costs, not accruing known liabilities, or reclassifying expenses to avoid income-statement impact (WorldCom).
• Asset overstatement: inflating inventory values, recording fictitious receivables, or misvaluing acquired assets (Satyam Computer Services).
• Off-balance-sheet manipulation: structuring special-purpose entities or lease arrangements to keep liabilities out of the consolidated balance sheet (Enron).

Every two years, the ACFE publishes its Report to the Nations on Occupational Fraud and Abuse, analysing data from thousands of actual fraud cases investigated by CFEs across multiple countries. The data are gathered from the investigators, not the organisations, which reduces underreporting bias. The resulting frequency and loss figures are the most concrete available benchmarks for fraud risk management decisions.

The consistent finding across editions is an inversion: asset misappropriation is the most frequent branch by a large margin (85 to 90% of cases) but produces the lowest median losses. Financial-statement fraud is the least frequent (9 to 10% of cases) but produces median losses often five to twenty times higher. Corruption sits in the middle on both dimensions. This pattern holds across industries, countries, and organisation sizes.

For an organisation deciding how to allocate its fraud-prevention budget, the frequency-versus-loss relationship has a direct implication. If the goal is to prevent the largest number of cases, resources go toward asset-misappropriation controls: segregation of duties, surprise audits, and cash controls. If the goal is to prevent the largest financial impact, resources go toward financial-statement fraud detection: strong audit-committee oversight, management-override controls, and whistleblower channels that give employees a safe route to report concerns about how the organisation is reporting its results.

When an allegation arrives, placing it in the taxonomy early is a high-value investigative step. The categorisation is a hypothesis, not a conclusion, and will be tested and possibly revised as evidence accumulates. It immediately directs the investigation toward the right data sources, interview sequence, and control-failure narrative.

1. Receive and categorise the allegation
   Place the initial allegation in one of the three branches, even if the evidence is thin. A complaint that 'a manager is receiving gifts from a preferred supplier' points to corruption, specifically kickbacks or conflicts of interest, before any transaction has been reviewed.
2. Identify the evidence profile for the scheme type
   Each scheme has a characteristic evidence trail. A billing scheme requires vendor records, invoice files, bank account registration data, and payment approvals. A kickback scheme requires the vendor relationship, the contract award process, and the financial relationship between the employee and the vendor.
3. Preserve relevant records
   Issue a legal hold targeted to the records that the scheme type requires. Over-preservation is wasteful; under-preservation risks losing key evidence. The taxonomy guides what is targeted.
4. Apply the relevant analytical techniques
   Asset-misappropriation investigations lean on data analytics: duplicate payment detection, gap analysis of document sequences, Benford's Law testing on payment amounts. Corruption investigations lean on relationship analysis and interview. Financial-statement fraud investigations lean on accounting-standard analysis and professional scepticism applied to judgment areas.
5. Test and revise the classification
   As evidence accumulates, be prepared to reclassify. An apparent billing scheme may reveal an underlying conflict of interest. A suspected asset-misappropriation may be masking a larger financial-statement fraud. The taxonomy is a working hypothesis, not a verdict.