The Fraud Triangle and Cressey's Model

Donald Cressey completed his doctoral research at Indiana University under sociologist Edwin Sutherland, whose differential association theory had already challenged simple explanations of criminal behaviour. Cressey's own question was more focused: why do people who occupy positions of trust, who have been given legitimate access to other people's money, cross the line and take it?

He interviewed 133 inmates at Joliet and Menard Correctional Centers in Illinois and Terre Haute Federal Prison in Indiana, all convicted of embezzlement. The interviews were open-ended and exploratory, not structured questionnaires, and Cressey was looking for patterns in the subjects' own accounts of their behaviour. His methodology would not satisfy modern standards for grounded theory research, but it was unusually direct: he was asking fraudsters themselves to explain what happened.

The pattern that emerged was remarkably consistent. Cressey found that every case involved a financial problem the person believed they could not share with others, access to the money or assets as a direct result of their trusted position, and a way of thinking about what they were doing that made it seem acceptable, at least temporarily. He published his findings as Other People's Money: A Study in the Social Psychology of Embezzlement in 1953.

Cressey called the first element a 'non-shareable financial problem'. The word non-shareable is the key. A person who faces a financial crisis and can ask family, friends, or an employer for help will usually do so. The person who commits fraud is one who believes, for whatever reason, that they cannot share the problem without unacceptable consequences. The consequence might be shame (gambling debts, an extramarital affair, a lifestyle they cannot explain on their salary), fear (threats from a loan shark, addiction they have hidden), or status anxiety (debt that would expose them as less successful than they appear).

• Personal financial pressure: gambling debts, addiction costs, divorce settlements, undisclosed financial losses, or personal debt exceeding legitimate income.
• Corporate or employment pressure: unachievable performance targets that threaten job security or bonus income; pressure from supervisors to meet financial forecasts.
• Perceived injustice: the belief that the organisation owes the person more than they are being paid, making the taking feel like corrective adjustment rather than theft.

In financial-statement fraud, as opposed to asset misappropriation, the pressure is often organisational rather than personal. An executive facing a market expectation they cannot meet legitimately faces a pressure analogous to the embezzler's non-shareable debt: they cannot disclose the earnings shortfall without destroying the company's stock price, their own position, and potentially their personal wealth. The psychology is structurally similar even when the actor and the fraud type are very different.

Opportunity is the element that internal controls directly address. The fraudster needs not just the access to commit the fraud but also a realistic belief that they can conceal it. A poorly designed payroll system that allows one person to add ghost employees, approve the payroll, and receive the corresponding bank transfers without any independent review creates exactly this opportunity. A well-designed system requiring multiple approvals and automatic reconciliation makes the same fraud far harder to execute and conceal.

The three most common opportunity conditions identified in the ACFE's research across its biennial Reports to the Nations are: lack of internal controls (cited in the largest share of cases), override of existing controls, and lack of management review. These are not exotic vulnerabilities. They are the ordinary failures of understaffed, overconfident, or complacent organisations.

Rationalization is the element with the most direct relevance to investigative interviews. Cressey found that his subjects uniformly adopted mental framings that allowed them to act dishonestly while preserving a self-image of basic honesty. These were not rationalizations invented after the fact to explain their actions to the researcher; Cressey concluded they were present at the time of the act, functioning as a necessary psychological precondition.

• 'I was only borrowing it': the person intends to repay and frames the act as a temporary loan rather than permanent theft. The repayment rarely materialises, and the framing is abandoned or adjusted as the fraud continues.
• 'I am underpaid and deserve this': the fraud is framed as a salary correction or compensation for perceived mistreatment, making it feel like justice rather than theft.
• 'The company can afford it' or 'nobody is really hurt': dehumanising the victim by treating them as an institution large enough to absorb the loss without real consequence.
• 'Everyone does it': normalising the behaviour by perceiving it as widespread, even when there is no evidence for that belief.

In an interview, rationalization often surfaces when a subject is asked open-ended questions about their role and their relationship with the organisation. Statements about being undervalued, about management hypocrisy, or about the organisation's financial capacity are often rationalizations in motion. A skilled interviewer recognises them as such and uses them to structure follow-up questions. The PEACE model interview framework (Preparation, Engage/Explain, Account, Closure, Evaluate) is particularly effective at drawing out this kind of account.

In a 2004 article in the CPA Journal, David Wolfe and Dana Hermanson proposed a fourth element: capability. Pressure, opportunity, and rationalization describe the conditions for fraud, but do not explain why, in an organisation where many employees face the same conditions, only one or a few actually act. Capability, they argued, is the difference: the specific combination of position, skills, and personal traits that allows a particular individual to execute and conceal a particular fraud.

The capability element has several components. Position matters because not every employee with motivation and rationalisation has the access to commit the specific fraud that would satisfy their need. Skills matter because complex financial-statement fraud requires accounting knowledge; a complex cyber-enabled fraud requires technical skills. Personal traits such as confidence, tolerance for risk, and the ability to maintain a convincing narrative under scrutiny all contribute to whether a person who meets the first three conditions will actually act.

In practice, the fraud diamond redirects the investigator's attention toward the specific individuals who were in a position to commit the detected fraud type. It is not enough to know that the billing department had weak controls (opportunity). The question becomes: of the people in that department, who had the accounting knowledge to construct the false invoices, the system access to approve them, and the seniority to avoid scrutiny?

Fraud risk assessment, as required by auditing standards (ISA 240, AU-C Section 240) and internal audit standards, uses Cressey's elements as a structuring framework. The risk assessment asks: where are the significant pressures in this organisation? Where are the opportunity gaps in the control framework? What signals are there about rationalising attitudes in the culture? The answers direct attention to the highest-risk areas without requiring specific allegations.

One practical caution: the model was built for occupational fraud (individual employees stealing from their employer). It applies less cleanly to management fraud or financial-statement fraud perpetrated by senior executives, where the pressure is often corporate rather than personal and the rationalization is often collective ('we are managing earnings, not committing fraud'). Investigators working on complex financial-statement cases use the triangle as a starting framework and then adapt it to the organisational dynamics of the specific case.