The Fraud Triangle: Pressure, Opportunity and Rationalisation

Donald Cressey set out the fraud triangle in Other People's Money in 1953: pressure, opportunity and rationalisation, all three of which he found present where a trusted person took what was not theirs. The teaching point here is the split. Two of the three are facts about a person and one is a fact about a control, and an institution can only build against the one.

Most explanatory frames in risk work are comfortable to use because they ask nothing of the person using them. Cressey's frame is different, and the discomfort is where its value sits. The fraud triangleDonald Cressey's 1953 account of what he found present where a trusted person took what was not theirs: pressure, opportunity and rationalisation. is a three part account of what was present when somebody trusted did something they should not have done, and understanding it properly means understanding that two of its three parts are none of an institution's business. Leaving those two parts alone is not a defect in the frame. The frame is doing its job, and the job is to show where effort should be spent and, just as importantly, where it should not.

Vindhya Commercial Bank Limited, an invented bank, carries a twelve month record of operational incidents, and one event inside that record carries the whole argument. Investigation, discipline, employment consequences, reporting to any authority and recovery action against any individual are covered separately. The question is a design question, not a question about a person.

Where does the fraud triangle come from, and what was it built to explain?

The frame is not general knowledge and it has an author. Donald Cressey set it out in Other People's Money in 1953. Cressey was answering a narrow question, and forgetting exactly what the question was is where a great deal of loose use of the triangle begins. He was not asking what makes people dishonest. He was looking at people who had held a position of trust in good faith, who had then violated that trust, and he was asking what circumstances were present in the cases where that happened. The answer he arrived at has three parts that appear together: a problem the person felt unable to share, a belief that the position could be used to solve it without being seen, and an account the person could give themselves that made the act something other than what it was.

Notice the shape of that. Cressey's answer is an account of circumstances that were present, arrived at after the events, from people the events had already happened to. The account is not a forward-looking test, and Cressey did not offer it as one. The triangle is an explanation and never a prediction, and almost every misuse of it in practice comes from treating a description of what was present as a list of things to go looking for in people.

The same shape appears outside banking. A housing society collects maintenance money, and one person holds the book, writes the receipts, banks the cash and reconciles the account. There are forty flats and nobody wants the job. If money goes missing there, the three parts are easy to see afterwards: whatever private difficulty the person was in, the fact that one pair of hands did every step so nothing ever had to agree with anything else, and whatever the person told themselves about paying it back next month. Asked what it should do about that, a society's useful answer is never about the person. The answer is that one pair of hands should not do every step. A bank is the same arrangement at a larger scale, with the duties written down instead of assumed.

One term matters before going further. A trusted positionA role whose duties give access that the control environment assumes will not be misused, which is what makes the arrangement of duties decisive. is a role whose duties give access that the control environment simply assumes will not be misused. Every institution has many of them and it could not function otherwise. Trust is always being extended, so the interesting question is never whether it is. The question is which extra assumption sits on top of the trust in the way the duties are arranged, and whether anybody ever wrote that assumption down and looked at it.

What are the three legs, and what does each one actually mean?

The three legs are usually recited as three words, and the recitation is where the meaning gets lost. Each one has a qualifier inside it that does the actual work, and dropping the qualifier turns a precise idea into a vague one.

Pressure, and why the sharing part is the operative half

PressureA problem the person feels unable to share, which is what makes it operative rather than merely a difficulty. is not difficulty. Almost everybody carries difficulty, continuously, and almost nobody does anything wrong about it. Cressey described something narrower, and the qualifier is the whole point: a problem the person feels unable to share. The sharing is the operative half. A person with a large debt who can talk to somebody about it has a problem. A person with a large debt who believes that telling anybody would end their standing, their job or their marriage has something structurally different. Every ordinary route out of the problem has been closed off in their own mind before anybody else has even heard of it.

The qualifier is also exactly what makes the leg invisible. A non-shareable problem is, by construction, one nobody has been told about. An institution cannot observe pressure without inspecting the private circumstances of the people who work for it, and the moment it starts doing that it has taken on a cost and an intrusion in exchange for a signal that will not work. The practice of inspecting private circumstances is refused outright.

Opportunity, and why it is a fact about arrangements

OpportunityThe belief that the act can be done and not be seen, which is a fact about how the work is arranged rather than about the person. is the belief that the act can be done without being seen. Read that carefully too. The sentence describes how work has been arranged and not a person's character. If one role can both check something and release it, then the person holding that role has that opportunity, and so does every person who has ever held it and every person who ever will. Move the role to somebody else and the opportunity moves with the role, unchanged.

The portability of the opportunity is why this leg behaves completely differently from the other two. Opportunity is written down, usually in a procedure or a system entitlement. Opportunity can be listed. Opportunity can be tested. Opportunity can be changed this week by somebody with the authority to change a procedure. Opportunity is the only one of the three legs that exists as a property of the institution rather than a property of a person, and that single fact is what makes the frame useful instead of merely interesting.

Rationalisation, and why it usually has some truth in it

RationalisationThe account the person gives themselves for why it is not really what it is, which is usually partly true at the start. is the account the person gives themselves for why the act is not really what it is. The common picture of this is a flimsy excuse, and that picture is wrong in a way that matters. The accounts that actually sustain a long-running act are usually partly true when they start. Borrowing rather than taking, with repayment intended. Being owed it, after something that genuinely happened. Nobody being harmed, with the money coming back anyway.

An account that is partly true is durable in a way an invented one is not, and it has a second property that is worse. The account can stop being true without anything announcing the change. Nobody sends a notice on the day the repayment stops being realistic or the day the goods stop existing. The account carries on being used long after the fact that supported it has gone, and the person using it has no particular moment at which they were asked to notice. The dangerous rationalisation is not the absurd one, it is the one that was accurate at the start and quietly stopped being accurate while it was still in use.

Which of the three can an institution do anything about?

Put the three legs side by side and ask two questions of each, in this order. Can the institution see it? And if it can see it, can it change it? The answers do not come out three ways. The answers come out one way once and the other way twice, and that asymmetry is the finding.

Pressure fails the first question. A non-shareable problem is invisible by construction, and the only route to seeing it runs through the private circumstances of a member of staff. Rationalisation fails the first question too, and fails it harder. A rationalisation has no existence in the world at all until somebody has already begun using it. Neither leg reaches the second question at all. There is nothing an institution could act on even if it somehow saw it, and against what, exactly, would the action be taken?

Opportunity answers both. Opportunity can be seen. A procedure and a set of system entitlements are documents, and the opportunity is written into both. Opportunity can be changed. A procedure is a decision somebody made, and it can be made again differently. The two to one split converts a three part explanation into a one part instruction, and that conversion is the reason for using the frame at all.

There is a second reason to like the instruction, and it has nothing to do with efficiency. Acting on opportunity changes the role, so it treats everybody in that role identically. Acting on pressure treats people differently on the basis of guesses about their private lives. One of those is a control and the other is a judgement about individuals dressed up as a control, and an institution that cannot tell them apart will eventually do the second while believing it is doing the first.

What does the triangle look like on a real internal fraud?

The bank's twelve month record carries thirteen operational incidents numbered I1 to I13, and two of them sit in the first of the seven event categories, internal fraudOne of the seven event categories, covering acts intended to defraud involving at least one internal party., covering acts intended to defraud involving at least one internal party. The larger of the two is incident I13, and it is the largest net loss in the whole year.

The facts of it, as the record holds them, are these. A trade finance officer and an external party issued 9 letters of credit against forged shipping documents, over fourteen months ending in month 8. The scheme was discovered when a beneficiary bank claimed. Letters of credit, and how they pay, belong to another subject area entirely. Here they are simply the instruments that were issued.

Every figure belongs to one invented bank. Rs 15.4 crore here is the net loss of incident I13 and is a different object from the Rs 15.6 crore value at risk figure that appears elsewhere in this same invented case, so the meaning is attached to the figure every time it is used.

Now Cressey's three legs, in the order he set them out in Other People's Money in 1953. Each leg lands on this event as a specific, checkable finding, and exactly one of the three findings produces an action.

The pressure leg on incident I13

The record states that the officer carried a personal borrowing the bank knew nothing about. The borrowing is the classic form of the leg: a private financial obligation that has not been shared. The second half of that sentence is doing more work than it looks. The bank knew nothing about it, and there was nothing it could properly have done to know. A borrowing taken privately is a private matter, and a bank that set out to enumerate the private borrowings of its trade finance staff would be doing something it has no business doing and would still miss most of them.

So the honest finding on the pressure leg is that it explains and produces nothing to act on, and any account pretending otherwise would be inventing a control that cannot exist. None of that is a failure of the analysis. The analysis is instead showing that there is nothing further to look for here.

The opportunity leg on incident I13

Here the record is precise, and the precision is what makes the leg useful. The same person could both check the shipping documents and release the instrument. Read that as a sentence about a job description rather than about a person. A job description is exactly what it is. One role held two duties that should not sit together, and the consequence is that a document set never had to satisfy anybody except the person presenting it.

The consequences of that arrangement matter. The finding would have been exactly as true if somebody else had held that job. The two duties sat together before this officer joined the role, and they stayed together until the arrangement changed. The pairing is also written down, in a procedure and in a system entitlement, and could have been read off that record by anybody who went looking. Segregation of duties as a control, meaning which pairs of duties are incompatible, what separating them costs and where separation is impossible, is set out under segregation of duties. The opportunity leg turned out to be a design finding, and the design finding is the only one of the three that came with an action attached.

The rationalisation leg on incident I13

The goods existed, so the account the officer could give themselves was that the bank was going to be paid anyway. And here the record does something unusually useful: it states how long that was true. The account was true for eleven of the fourteen months, or 78.6 per cent of the run.

The eleven months are the most instructive number in the case, and the number is not a money figure. For most of the time this went on, the account the person was giving themselves was not a lie. The account was a description of the situation. The account only became false somewhere in the last stretch, and nothing about that stretch looked different from the inside. A rationalisation that is true when it starts does not have to be believed against the evidence, it only has to be left unrevisited, and the record shows this one holding for more than three quarters of the run.

One caution about how the figure below is drawn, and it matters. The record states the count and not the position: it says eleven of the fourteen months and it does not say which eleven. So the bar below is drawn as a share of the run and never as a place inside it. Nothing in the record marks the day the account stopped being accurate, and that absence is itself the point.

Why is it not a tool for identifying people?

Sooner or later somebody in a meeting proposes the obvious-sounding thing: if the three conditions are known, why not go looking for them? An indicator for pressure, a watch for the signs, a way to get ahead of it. The proposal sounds like prevention, and it is worth being blunt about why it is not.

Start with what screeningUsing an explanatory frame to try to identify individuals in advance, which this material refuses on both practical and ethical grounds. would actually require. Detecting pressure means knowing the private financial circumstances of the people who work for the institution. Knowing them means collecting them, holding them, and acting on them. The collection is an intrusion, and it is an intrusion imposed on everybody in order to find, at best, a handful. An institution that sets out to detect pressure has decided to inspect the private lives of its staff, and no framing of that decision makes it something else.

Then look at whether it would even work. The practical answer is as bad as the ethical one. The number of people carrying serious financial pressure at any moment is very large. The number of them who do anything wrong about it is very small. A test fired at a very large population to find a very small one produces overwhelmingly wrong answers, and every wrong answer here is a person treated as suspect on the basis of a difficulty in their life. The signal is not weak in some fixable way. The signal is weak because pressure is common and the act is rare, and no amount of care about the indicator changes that ratio.

Rationalisation is worse still, and it cannot be observed at all before the fact. A rationalisation is an account somebody gives themselves, in private, about something they have not yet done. There is nothing to measure. Anybody claiming to detect it is claiming to read intent, and intent cannot be read.

So a screening use of the frame does two things and buys nothing. Screening intrudes, and it points the effort at the two legs an institution cannot change. The one leg it can change is left exactly where it was. The correct reading of Cressey is the opposite of a watch list. Opportunity is the only leg that will move, so opportunity is where everything available should be spent. Pressure is private. Rationalisation is invisible until afterwards. How the work is arranged is written down, visible and changeable this week, and it is the same for every person who will ever hold the job.

Why do internal frauds run so much longer than anything else in a loss record?

Set the frame aside for a moment and just read the record. The invented bank states a running timeHow long an event continued before it was found, which for a fraud is the measure that matters most and appears in no loss column. for six of its thirteen incidents, and the six do not sit anywhere near each other. Incident I3, a core banking outage, ran 4 hours and 20 minutes. Incident I9, a vendor-hosted payment gateway failure, ran 9 hours. Incident I6, a deposit rate applied above the approved card, ran eleven days. Incident I10, a stale collateral valuation feed, ran 11 working days. And then the two category 1 internal frauds: incident I13 ran fourteen months and incident I5, in which a branch officer created 14 fictitious accounts and moved Rs 3.6 crore through them at a net loss of Rs 2.7 crore, ran twenty two months ending in month 5. The two frauds carry thirty six months of running time between them.

The population deserves care before any conclusion is drawn from it. The other seven incidents in this record carry no stated running time at all, so the record cannot say which event in the year as a whole ran longest. Of the six incidents whose running time the record states, the two internal frauds are the longest by an enormous margin, and the gap is not close enough for the missing seven to change the shape. A silence in a record is a silence and stays one.

The reason for the gap is a mechanism and not a moral, and it is worth stating carefully. Every other event in this record announced itself. A system that stops has stopped, and somebody notices within minutes. A payment that goes twice produces a second debit that a reconciliation will not balance. A feed that goes stale produces a value that is the same today as yesterday, and a data quality check can see that. Each of those events is a failure of the process to do what it was built to do, so each generates a signal inside the very process it happens in.

A fraud is not a failure of the process, so it generates no such signal. The process did exactly what it was designed to do: it received a document set, it checked it, it released an instrument. The check itself was compromised, so the process ran to completion and reported success every time. Nothing inside a process is going to surface an act that the process itself was made to complete, and running time for a fraud is therefore bounded by how long it takes something outside the process to notice.

The detection routeHow something was found, which the record states for incident I13, a beneficiary bank claiming, and does not state at all for incident I5. for incident I13 bears that out exactly: it was found when a beneficiary bank claimed, and somebody outside the bank altogether was asking about something. The record states no detection route at all for incident I5, and two events with one stated route between them cannot carry a claim about how both were found.

Long running time is not just an unpleasant fact about a category. Long running time also converts a category into most of a loss record. Category 1 at this invented bank carries 2 of the 13 incidents, or 15.4 per cent of the count, and Rs 18.1 crore of the year's Rs 43.8 crore of net loss, or 41.3 per cent of the value. Two events, out of thirteen, account for more than two fifths of everything the year cost, and the thing they had in common was time.

What would earlier detection have been worth, and what would it not have been worth?

Running time has a money consequence, and it is worth working out carefully. The working also shows what the arithmetic cannot say. Incident I13 booked Rs 15.4 crore of net loss over fourteen months. Spread that on a straight line and it is Rs 1.10 crore a month exactly. Dividing 15.4 by 14 gives 1.1 with nothing left over.

Two warnings attach to that number, and both stay on screen throughout. The straight line is the reader's own assumption and not the case's: the record says what the event cost and says nothing at all about how the cost accrued across the fourteen months. A second, equally reasonable basis sits right beside it. 9 letters of credit were issued, and Rs 15.4 crore over 9 instruments is Rs 1.71 crore each. The question being asked is about time, so the monthly straight line is the one used, and it remains a device.

Now run it. At Rs 1.10 crore a month, detection in run month 4 gives Rs 4.4 crore, exactly the whole of category 7's net loss for the year at this invented bank, three incidents put together. Be careful with that figure: Rs 4.4 crore here is category 7's year, and the same Rs 4.4 crore appears elsewhere in this case as incident I9's gross loss, so the object is named every time. Detection in run month 5 gives Rs 5.5 crore, passing incident I4 at Rs 5.2 crore. Incident I4 is the largest net loss among the other twelve incidents, so at Rs 5.5 crore this event would already have stood at the top of the year's net list, in run month 5 of a run that went to fourteen.

The exact crossing is run month 4.73, being 5.2 divided by 1.1. No whole month puts this event second on net. Second place occupies the narrow band between incident I1 at Rs 4.8 crore and incident I4 at Rs 5.2 crore, or run month 4.36 to run month 4.73, and no integer sits inside it. Every rank here names its basis: everything in this paragraph is on net loss, and on gross loss the year is led by incident I2 at Rs 42.0 crore instead.

There is one more date in this record that belongs here, and it is uncomfortable. Near miss N4, in month 7, was a trade finance document set carrying the same forgery pattern, refused by a checker. The refusal was recorded as routine and linked to nothing. Incident I13 ran fourteen months ending in month 8, so it began in month minus 5, and case month 7 is run month 13 of the fourteen. At Rs 1.10 crore a month that is Rs 14.3 crore already accrued, being 92.9 per cent of the final figure. The near miss that carried the pattern arrived when the scheme was 92.9 per cent complete, and no sharper statement exists of why a linked near miss is loss the learning would have been looking at and never loss avoided. The near miss as a record, and the two links inside this year, are set out under near miss recording.

Does a limit on annual operational loss protect against fraud at all?

The invented bank has a limit numbered L11 capping net operational loss over a rolling twelve months at Rs 60.0 crore. The limit sits under appetite clause A7, and both the limit and the clause are the bank's own decisions rather than anything required by an authority. At month 12 the year stood at Rs 43.8 crore, being 73.0 per cent of the limit. A utilisation of 73.0 per cent reads like a sensible margin, and the question worth asking is whether the margin did any work.

Work it out. The other twelve incidents carry Rs 43.8 crore less Rs 15.4 crore, or Rs 28.4 crore. For the year to touch Rs 60.0 crore, this event alone would have to carry Rs 31.6 crore, and at Rs 1.10 crore a month that is run month 28.7. The fraud ran fourteen. So reaching the limit would have needed it to run more than twice as long as it did. And there is a second landmark that also fails to arrive: for this one event to be worth more than all the other twelve put together it would need Rs 28.4 crore, being run month 25.8, again nearly twice the run. At its full fourteen months it is Rs 15.4 crore against Rs 28.4 crore, or 54.2 per cent of them.

A limit on annual operational loss is not a control against fraud, and this arithmetic is the whole argument. The largest single net loss in this bank's year ran for fourteen months, and at no point in those fourteen months did the limit come within reach of being touched. Nothing in the limit framework would have brought the event forward by a single day. None of that is a criticism of the limit. The limit does the job it was built for, and that job is to tell a committee whether the total is drifting. The arithmetic is a statement about what the total cannot see.