The Fraud Triangle and Cressey's Model

Donald Cressey's three-element model of occupational fraud, pressure, opportunity, and rationalization, emerged from empirical research in the 1950s and remains the central conceptual tool for understanding why trusted employees commit fraud.

Last updated: 10 Jun 2026

In the late 1940s, a young criminologist named Donald Cressey spent months interviewing people in American prisons, not murderers or armed robbers, but embezzlers: accountants, bookkeepers, and trusted employees who had stolen from employers or clients. He wanted to know what they all had in common. The answer, stripped to its elements, became the most influential model in the history of fraud investigation.

The fraud triangle holds that every case of occupational fraud involves three elements appearing together: a financial pressure the person felt they could not share with others, an opportunity in the control environment that made the theft look feasible, and a rationalization that let the person frame what they were doing as something other than dishonesty. Remove any one element and the fraud, at least according to Cressey, does not happen. Change the opportunity and you change the risk.

This topic reconstructs Cressey's original research, explains each element in depth, describes the fraud diamond extension that added capability as a fourth factor, and shows how investigators apply the model in practice: to assess risk, to direct interview questions, and to explain why a trusted employee became a fraudster. The model is not a prediction machine. It is a framework for structured thinking about motivation and control.

Key terms

Occupational fraud: The use of one's occupation for personal enrichment through the deliberate misuse or misapplication of the employing organisation's resources or assets. Cressey's model was built specifically for this category.
Non-shareable financial problem: Cressey's original phrase for what is now called pressure or incentive. The problem is non-shareable because the person believes they cannot disclose it without damaging their reputation, relationships, or position.
Rationalization: The internal justification that allows a person to commit fraud while maintaining a self-image as an honest individual. Common forms include 'I was only borrowing it', 'I was underpaid anyway', or 'the company can afford it'.
Fraud diamond: The four-element extension of the fraud triangle proposed by Wolfe and Hermanson (2004), adding capability to pressure, opportunity, and rationalization. Capability focuses on the specific skills and access needed to execute and conceal a particular fraud.
Control environment: The set of organisational policies, procedures, and cultural attitudes that collectively determine how much opportunity a fraudster has. Weak controls, missing segregation of duties, and absent oversight directly create opportunity.
Management override: The capacity of senior management to circumvent controls they themselves designed or approved, a particularly dangerous form of opportunity that audit and detective controls often fail to catch.

Cressey's research: how the model was built

The fraud triangle came from listening to convicted embezzlers describe exactly why they did it.

Donald Cressey completed his doctoral research at Indiana University under sociologist Edwin Sutherland, whose differential association theory had already challenged simple explanations of criminal behaviour. Cressey's own question was more focused: why do people who occupy positions of trust, who have been given legitimate access to other people's money, cross the line and take it?

He interviewed 133 inmates at Joliet and Menard Correctional Centers in Illinois and Terre Haute Federal Prison in Indiana, all convicted of embezzlement. The interviews were open-ended and exploratory, not structured questionnaires, and Cressey was looking for patterns in the subjects' own accounts of their behaviour. His methodology would not satisfy modern standards for grounded theory research, but it was unusually direct: he was asking fraudsters themselves to explain what happened.

The pattern that emerged was remarkably consistent. Cressey found that every case involved a financial problem the person believed they could not share with others, access to the money or assets as a direct result of their trusted position, and a way of thinking about what they were doing that made it seem acceptable, at least temporarily. He published his findings as Other People's Money: A Study in the Social Psychology of Embezzlement in 1953.

Pressure: the non-shareable financial problem

The pressure that drives fraud is almost always something the person felt they could not admit to anyone.

Cressey called the first element a 'non-shareable financial problem'. The word non-shareable is the key. A person who faces a financial crisis and can ask family, friends, or an employer for help will usually do so. The person who commits fraud is one who believes, for whatever reason, that they cannot share the problem without unacceptable consequences. The consequence might be shame (gambling debts, an extramarital affair, a lifestyle they cannot explain on their salary), fear (threats from a loan shark, addiction they have hidden), or status anxiety (debt that would expose them as less successful than they appear).

Personal financial pressure: gambling debts, addiction costs, divorce settlements, undisclosed financial losses, or personal debt exceeding legitimate income.
Corporate or employment pressure: unachievable performance targets that threaten job security or bonus income; pressure from supervisors to meet financial forecasts.
Perceived injustice: the belief that the organisation owes the person more than they are being paid, making the taking feel like corrective adjustment rather than theft.

In financial-statement fraud, as opposed to asset misappropriation, the pressure is often organisational rather than personal. An executive facing a market expectation they cannot meet legitimately faces a pressure analogous to the embezzler's non-shareable debt: they cannot disclose the earnings shortfall without destroying the company's stock price, their own position, and potentially their personal wealth. The psychology is structurally similar even when the actor and the fraud type are very different.

Opportunity: control weakness as the enabling condition

Motivation without opportunity is just a wish. The control environment is where fraud is permitted or prevented.

Opportunity is the element that internal controls directly address. The fraudster needs not just the access to commit the fraud but also a realistic belief that they can conceal it. A poorly designed payroll system that allows one person to add ghost employees, approve the payroll, and receive the corresponding bank transfers without any independent review creates exactly this opportunity. A well-designed system requiring multiple approvals and automatic reconciliation makes the same fraud far harder to execute and conceal.

The three most common opportunity conditions identified in the ACFE's research across its biennial Reports to the Nations are: lack of internal controls (cited in the largest share of cases), override of existing controls, and lack of management review. These are not exotic vulnerabilities. They are the ordinary failures of understaffed, overconfident, or complacent organisations.

Fraud triangle: three elements and corresponding control responses.

Rationalization: the honest dishonest person

Most fraudsters do not think of themselves as criminals. Rationalization is how they manage the contradiction.

Rationalization is the most psychologically interesting element of the model, and the one with the most direct relevance to how investigators conduct interviews. Cressey found that his subjects uniformly adopted mental framings that allowed them to act dishonestly while preserving a self-image of basic honesty. These were not rationalizations invented after the fact to explain their actions to the researcher; Cressey concluded they were present at the time of the act, functioning as a necessary psychological precondition.

'I was only borrowing it': the person intends to repay and frames the act as a temporary loan rather than permanent theft. The repayment rarely materialises, and the framing is abandoned or adjusted as the fraud continues.
'I am underpaid and deserve this': the fraud is framed as a salary correction or compensation for perceived mistreatment, making it feel like justice rather than theft.
'The company can afford it' or 'nobody is really hurt': dehumanising the victim by treating them as an institution large enough to absorb the loss without real consequence.
'Everyone does it': normalising the behaviour by perceiving it as widespread, even when there is no evidence for that belief.

In an interview, rationalization often surfaces when a subject is asked open-ended questions about their role and their relationship with the organisation. Statements about being undervalued, about management hypocrisy, or about the organisation's financial capacity are often rationalizations in motion. A skilled interviewer recognises them as such and uses them to structure follow-up questions. The PEACE model interview framework (Preparation, Engage/Explain, Account, Closure, Evaluate) is particularly effective at drawing out this kind of account.

The fraud diamond: adding capability

Wolfe and Hermanson's 2004 extension asks not just whether conditions are right, but whether the person can actually pull it off.

In a 2004 article in the CPA Journal, David Wolfe and Dana Hermanson proposed adding a fourth element to the fraud triangle: capability. Their argument was that pressure, opportunity, and rationalization describe the conditions for fraud, but they do not explain why, in an organisation where many employees face the same conditions, only one or a few actually commit it. Capability, they argued, is the difference: the specific combination of position, skills, and personal traits that allows a particular individual to execute and conceal a particular fraud.

The capability element has several components. Position matters because not every employee with motivation and rationalisation has the access to commit the specific fraud that would satisfy their need. Skills matter because complex financial-statement fraud requires accounting knowledge; a complex cyber-enabled fraud requires technical skills. Personal traits such as confidence, tolerance for risk, and the ability to maintain a convincing narrative under scrutiny all contribute to whether a person who meets the first three conditions will actually act.

In practice, the fraud diamond redirects the investigator's attention toward the specific individuals who were in a position to commit the detected fraud type. It is not enough to know that the billing department had weak controls (opportunity). The question becomes: of the people in that department, who had the accounting knowledge to construct the false invoices, the system access to approve them, and the seniority to avoid scrutiny?

Applying the model in fraud risk assessment and investigation

The triangle is most useful not as an explanation of the past but as a tool for directing where to look next.

Fraud risk assessment, as required by auditing standards (ISA 240, AU-C Section 240) and internal audit standards, uses Cressey's elements as a structuring framework. The risk assessment asks: where are the significant pressures in this organisation? Where are the opportunity gaps in the control framework? What signals are there about rationalising attitudes in the culture? The answers direct attention to the highest-risk areas without requiring specific allegations.

Model element	Risk-assessment questions	Investigation application
Pressure	Which roles or individuals face unachievable targets, financial distress, or debt?	Interview focuses on financial circumstances, lifestyle, and recent stresses
Opportunity	Where are segregation of duties absent? Where does management override exist?	Transaction testing targets periods of weakest control; IT access logs reviewed
Rationalization	What is the cultural attitude toward expense claims, policy compliance, and reporting?	Interview uses open-ended questions to draw out self-justifying language
Capability (diamond)	Who in the identified risk area has the skills and access to commit this specific fraud type?	Narrows the suspect population by position, access rights, and relevant expertise

One practical caution: the model was built for occupational fraud (individual employees stealing from their employer). It applies less cleanly to management fraud or financial-statement fraud perpetrated by senior executives, where the pressure is often corporate rather than personal and the rationalization is often collective ('we are managing earnings, not committing fraud'). Investigators working on complex financial-statement cases use the triangle as a starting framework and then adapt it to the organisational dynamics of the specific case.

Worked example

A payroll fraud reconstructed through the triangle

How pressure, opportunity, and rationalization combined in a real-world pattern of ghost employees.

A mid-sized logistics company discovers during an HR audit that sixteen employees on the payroll have not badged into any company facility in over a year. An investigation reveals that a payroll administrator with twelve years of service has been receiving the salaries of these ghost employees through a network of accounts belonging to family members. The fraud has been running for three years and amounts to approximately $890,000.

Applying the triangle retrospectively is straightforward. On pressure: the administrator had accumulated significant personal debt following a medical crisis in her family, a non-shareable problem that she believed would cost her her job and marriage if disclosed. On opportunity: the payroll system allowed a single administrator to add employees, set bank account details, and approve payroll runs without any second-person authorisation, and management review of the payroll exception report had been discontinued three years earlier due to staff reductions. On rationalization: interview transcripts showed repeated references to her belief that she was owed back pay for years of inadequate raises and that the company was financially healthy enough to absorb the cost without affecting anyone.

The fraud diamond adds the fourth perspective: capability. The administrator had been in the payroll function for over a decade, understood exactly how the system processed new employee records, knew which fields triggered exception reports and which did not, and had built enough trust with her manager that she could work without supervision. Without that specific combination of tenure, technical knowledge, and trusted-employee status, the same pressure and opportunity would not have produced this particular fraud.

The investigation's recommendations mapped directly back to the model: mandatory dual-authorisation for new employee additions (opportunity control), anonymous employee assistance programme advertised to all staff (pressure reduction channel), tone-at-the-top communication about what the company considers misconduct (rationalization reduction), and periodic rotation of duties for sensitive payroll functions (capability disruption).

Check your understanding

Question 1 of 4· 0 answered

Cressey described the first element of his model as a 'non-shareable financial problem'. Why is the word 'non-shareable' significant?

Key Takeaways

Donald Cressey built the fraud triangle from interviews with 133 convicted embezzlers, making it an empirically grounded model of occupational fraud motivation rather than a theoretical construct.
The three elements are pressure (a non-shareable financial problem), opportunity (a control environment that makes the fraud feasible and concealable), and rationalization (an internal justification that preserves the person's self-image as honest).
The fraud diamond (Wolfe and Hermanson, 2004) adds a fourth element, capability, directing attention to who specifically had the position and skills to execute the particular fraud type.
In practice, the model is used in fraud risk assessment to identify high-risk areas, in investigation to structure interviews and direct transaction testing, and in reporting to explain why a trusted employee committed the fraud.
The triangle describes conditions associated with fraud, not a prediction of individual behaviour; it guides where to look, but does not generate probabilities.

What are the three elements of the fraud triangle?

Pressure (or incentive), opportunity, and rationalization. Cressey argued that all three must be present for a trusted employee to commit occupational fraud. Pressure is the financial or personal motive. Opportunity is the ability to commit and conceal the fraud given the control environment. Rationalization is the internal justification that allows the person to see themselves as not truly dishonest.

Where did Cressey's model come from?

Donald Cressey was a criminologist who studied trust violators while a graduate student at Indiana University in the late 1940s. He conducted extensive interviews with people imprisoned for embezzlement and developed his model empirically from those accounts. His doctoral research was published as Other People's Money in 1953.

What is the fraud diamond and how does it extend Cressey's model?

The fraud diamond, proposed by David Wolfe and Dana Hermanson in 2004, adds a fourth element: capability. They argued that even with pressure, opportunity, and rationalization, fraud requires someone with the specific skills and position to actually execute and conceal the scheme. The capability element directs attention to who in an organisation has both the access and the competence to commit the particular fraud type under investigation.

Can the fraud triangle be used in a live investigation?

Yes. Investigators use it as a structuring tool to assess which employees or roles present elevated risk, to direct interview questions (particularly rationalization, which often emerges in interview), and to frame the narrative in a report that explains why a specific individual committed the fraud. It is also used in risk assessments to identify where controls are weakest (opportunity) and where financial pressure is highest.

Test yourself on Forensic Accounting and Financial Forensics with free, timed mocks.

Practice Forensic Accounting and Financial Forensics questions

Found this useful? Pass it along.

Spotted an error in this page? Report a correction or read our editorial standards.

Model element

Risk-assessment questions

Investigation application

Pressure

Which roles or individuals face unachievable targets, financial distress, or debt?

Interview focuses on financial circumstances, lifestyle, and recent stresses

Opportunity

Where are segregation of duties absent? Where does management override exist?

Transaction testing targets periods of weakest control; IT access logs reviewed

Rationalization

What is the cultural attitude toward expense claims, policy compliance, and reporting?

Interview uses open-ended questions to draw out self-justifying language

Capability (diamond)

Who in the identified risk area has the skills and access to commit this specific fraud type?

Narrows the suspect population by position, access rights, and relevant expertise

Key Takeaways

Donald Cressey built the fraud triangle from interviews with 133 convicted embezzlers, making it an empirically grounded model of occupational fraud motivation rather than a theoretical construct.

The three elements are pressure (a non-shareable financial problem), opportunity (a control environment that makes the fraud feasible and concealable), and rationalization (an internal justification that preserves the person's self-image as honest).

The fraud diamond (Wolfe and Hermanson, 2004) adds a fourth element, capability, directing attention to who specifically had the position and skills to execute the particular fraud type.

In practice, the model is used in fraud risk assessment to identify high-risk areas, in investigation to structure interviews and direct transaction testing, and in reporting to explain why a trusted employee committed the fraud.

The triangle describes conditions associated with fraud, not a prediction of individual behaviour; it guides where to look, but does not generate probabilities.

What are the three elements of the fraud triangle?

Where did Cressey's model come from?

What is the fraud diamond and how does it extend Cressey's model?

Can the fraud triangle be used in a live investigation?

Your journey to becoming a forensic professional starts here.

Key Takeaways

Key Takeaways