Embezzlement is the theft of money or property by someone who was trusted with it, usually an employee, officer or volunteer treasurer. In audit terms it is asset misappropriation, one of the three categories of occupational fraud in the ACFE taxonomy, alongside corruption and financial statement fraud. It is the form of fraud most likely to turn up in a small-entity audit, because small entities have few people, thin segregation of duties and an owner who trusts the bookkeeper.
This guide covers how the main schemes work, which tests expose them, how the auditor's responsibility under AU-C 240 frames the work, and what to do when something looks wrong. It is written for audit teams. Finance teams can use the same list to see where their own controls are thin.
How common is embezzlement, and how long does it run?
The ACFE's Occupational Fraud 2024: A Report to the Nations analyzed cases investigated by Certified Fraud Examiners. Asset misappropriation appeared in 89% of the cases, with a median loss of $120,000. Across all categories the median loss was $145,000, the median scheme ran 12 months before detection, and the ACFE estimated that a typical organization loses 5% of revenue a year to fraud. Tips were the most common detection method at 43% of cases; internal audit detected 14% and external audit 3%.
Two lessons follow. First, a financial statement audit is not a fraud-detection engagement, and the 3% figure is a reminder of why. Second, active controls and a reporting channel do more than annual testing. Anonymous hotlines were present at 71% of victim organizations in the 2024 report, and the Report found losses were roughly half as large where a hotline existed.
What the auditor is responsible for
AU-C 240 requires the auditor to obtain reasonable assurance that the financial statements are free of material misstatement, whether from fraud or error. Misappropriation that is immaterial to the financial statements as a whole may never be found by a properly performed audit. Embezzlement does matter to the audit when it is material, when it involves management, or when it points to a control environment the auditor cannot rely on.
Every audit includes the required procedures that catch some misappropriation as a by-product: the engagement team discussion, inquiries of management and others, journal entry testing, and evaluation of significant unusual transactions. See fraud risk assessment under AU-C 240 for the required framework. This guide adds the targeted tests that fit each scheme.
The main embezzlement schemes
| Scheme | How it works | Where it shows |
|---|---|---|
| Skimming | Cash is taken before it is recorded, such as unrecorded cash sales or unrecorded customer payments | Lower revenue or gross margin than expected, unrecorded sales found by reconciling third-party data to the books |
| Cash larceny | Cash is taken after it has been recorded | Voids, no-sale entries, reversed receipts, deposits that do not match receipts |
| Lapping | A customer's payment is stolen and hidden by applying a later customer's payment to the first account | Old receivables that never age past a certain point, payments applied to the wrong customer, delayed deposits |
| Billing schemes | Payments to a fictitious vendor, an inflated invoice, or personal purchases paid by the entity | Vendors with no physical footprint, vendor details matching an employee, invoices just under an approval limit |
| Check tampering | A check is forged, altered or redirected to the wrong payee | Cancelled checks with a different payee or endorsement, missing check numbers, voided checks that cleared |
| Payroll schemes | Ghost employees, falsified hours, or paychecks to terminated staff | Employees with no tax withholding records, duplicate bank accounts, pay after termination |
| Expense reimbursement | Personal costs, duplicate claims or invented receipts | Round amounts, receipts that repeat, claims from the same person near the approval limit |
Procedures that expose each scheme
Bank and cash. Obtain the bank statements directly and reconcile them yourself for at least one month, or test the client's reconciliation for the whole year. Check who prepared and who reviewed it, and whether the same person writes checks, records them and reconciles. Trace deposits to cash receipts records and to the customer account credited. A proof of cash for the full year, which reconciles receipts and disbursements, covers the gaps a single-month reconciliation leaves. See bank reconciliation.
Vendor master file. Compare vendor names, addresses, phone numbers and bank account details to the employee master file. Look for vendors with a post office box address, no tax identification number, or an address that matches an employee. Sort payments by vendor and look for amounts clustered just under an approval threshold. Scan for duplicate invoice numbers and sequential invoice numbers from the same vendor, which suggest an entity that bills nobody else.
Disbursements. Examine a sample of cancelled checks, front and back, including endorsements. Check the numerical sequence of checks for gaps and for voided checks that cleared. Review payments to officers and related parties; see related party transactions.
Receivables and revenue. Confirm receivables on a sample that includes old balances and credits (external confirmations). Look at cash receipts after year-end to see whether payments are applied to the customer who sent them. Compare reported unit sales or service hours to an independent source such as a point-of-sale log, a ticketing system or utility use.
Payroll. Agree a sample of paid employees to personnel files and to the quarterly payroll tax returns. Compare employee bank account numbers for duplicates. Check that no one was paid after the termination date.
Data analytics. Test the full population of disbursements for round amounts, duplicates, weekend postings and amounts below approval limits. The Benford's Law analyzer helps with first-digit patterns, though a fabricated invoice series designed to stay under a limit can pass a digit test, so use it with the threshold test, not instead of it. See audit data analytics.
Unpredictability. AU-C 240 requires an element of unpredictability in the selection of procedures. A surprise cash count, a change in the month tested, or a call to a vendor chosen from the master file at random all serve it. See element of unpredictability.
Worked example: a shell vendor under the approval limit
Illustrative numbers. A dental practice's office manager records payables, prints checks and reconciles the bank account. The owner signs checks in a stack at month end. Any invoice over $5,000 requires the owner's written approval.
The auditor sorts the year's disbursements by vendor and finds one vendor, "Apex Dental Supply LLC," paid $4,800 every month for 14 months across two fiscal years. No other vendor has a fixed monthly amount just under the threshold. The vendor master shows a mailing address that matches the office manager's address on the payroll file.
Total paid across the 14 months: 14 x $4,800 = $67,200. Of that, 12 payments, or $57,600, fall in the year under audit; the other two payments, $9,600, belong to the prior year.
The auditor expands the work: confirms with the owner that the vendor is unknown, inspects the invoices (all lack a purchase order and delivery document), and checks the check images, which show a deposit to an account in the office manager's name. Whether the $57,600 is a material misstatement of supplies expense depends on materiality set under AU-C 320. Communication does not wait for that answer: fraud by an employee with a significant role in internal control is communicated to those charged with governance whatever the amount.
What to do when you find it
- Stop and gather facts without alerting the suspect. Preserve the evidence and avoid discussing it with the person under suspicion.
- Escalate at the right level. AU-C 240 requires timely communication to an appropriate level of management. Fraud involving senior management, employees with significant roles in internal control, or fraud causing a material misstatement goes to those charged with governance. If management is involved, go to governance.
- Reconsider the audit. Reassess the risk assessment, the reliability of management representations, and the scope of procedures. See management override of controls.
- Consider reporting obligations. There may be duties to report to outside parties under law, to a regulator, or to a funder, and the auditor's duty of confidentiality limits what can be said. Take advice from counsel before any outside disclosure.
- Document. Record the evidence, the communication and the effect on the audit.
Whether to refer the matter to law enforcement, and whether the loss is a crime under a particular state statute, are legal questions for the client and its counsel.
Common mistakes
- Treating a small, repeated amount as immaterial without asking why it repeats.
- Testing the bank reconciliation prepared by the suspect without reperforming any part of it.
- Using the same sample months every year, which a long-running scheme can plan around.
- Relying on management inquiry in an entity where the person asked is the person who handles the cash.
Frequently asked questions
What is the difference between embezzlement and fraud?
Embezzlement is a legal term for theft by someone entrusted with the property; the elements vary by state. Fraud is the broader term. AU-C 240 does not use the word embezzlement; it calls this type of fraud misappropriation of assets, which involves the theft of an entity's assets.
Will an audit find embezzlement?
Not necessarily. An audit provides reasonable assurance about material misstatement. The ACFE's 2024 report attributed 3% of detected cases to external audit and 43% to tips.
What are the red flags for embezzlement?
Common behavioral and control flags include an employee who never takes vacation, one person handling cash from receipt to reconciliation, living beyond apparent means, reluctance to share duties, and missing or altered documents. See fraud risk factors and the fraud triangle.
Which controls prevent embezzlement in a small business?
Separation of the duties of authorizing, recording, custody and reconciling; an owner who reviews the bank statements directly; mandatory vacations or job rotation; and a way for staff to report concerns. See segregation of duties.
Sources
- ACFE, Occupational Fraud 2024: A Report to the Nations, acfe.com/report-to-the-nations
- AICPA, AU-C Section 240, Consideration of Fraud in a Financial Statement Audit, in AICPA Professional Standards
- AICPA, AU-C Section 320, Materiality in Planning and Performing an Audit
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error