Executives often discuss fraud controls. They boast of internal audits, whistleblowing hotlines, segregation of duties, and the best consultants on retainer. Yet when fraud finally explodes in their face, the boardroom chorus is the same: “But we had controls. How did this happen?”
Fraud risk is never primarily a matter of numbers; it lies quietly within your culture. The control manuals gather dust, while everyday behaviour erodes trust from within.
The invisible leak in the system
Imagine a luxury hotel that installs the best security cameras, scanners, and safes. Every guest feels protected. Yet, one bellboy has a copy of the master key. He doesn’t steal openly; he simply slips items here and there when no one is watching.
The cameras record nothing unusual because he knows the blind spots. The safes are untouched because he targets handbags left on the bed. Eventually, when losses mount, management blames “sophisticated criminals.”
In truth, the problem was inside the culture: a team that tolerated shortcuts, turned a blind eye, and trusted without verifying.
Organizations operate the same way. Fraud risk is rarely about external attackers however it is about insiders exploiting the culture you have normalized. If your managers cut corners with approvals “to save time,” if staff bend procurement rules because “that’s how things are done here,” then you already host fraud in your culture.
Where fraud risk hides in plain sight
I have worked with companies across East Africa and Southern Africa, and the patterns are strikingly similar.
The biggest frauds were not discovered through smart systems but by accident, or through disgruntled employees finally speaking up. Why? Because the fraud risk was woven into everyday behavior.
- Tolerance for small thefts. When a cashier pockets transport refund change, and supervisors laugh it off, the organization silently communicates that dishonesty is acceptable as long as it is “small.” Those small thefts evolve into massive embezzlement over time.
- Fear of speaking up. In one insurance company I supported, staff privately admitted they had seen colleagues inflating claims, but no one reported. Why? Because past whistleblowers had been sidelined. A culture that punishes dissent invites fraud.
- Hero worship of rainmakers. Boards often protect high-performing managers because they “bring in the money.” When such rainmakers manipulate numbers or collude with vendors, no one challenges them. Fraud thrives in the shadow of untouchables.
- Normalizing excuses. In procurement, managers explain away inflated invoices as “market fluctuations.” In finance, late reconciliations are blamed on “system delays.” Once excuses are tolerated, they become shields for fraud.
- Micromanagement by weak leaders. Ironically, when executives micromanage, they create opportunities for fraud. Staff stop taking ownership, and in the vacuum of accountability, those closest to the transactions quietly divert resources.
Fraud is never only about weak controls; it is about weak values. Culture is not the slogans on your office walls; it is the behaviors you tolerate. If a junior officer sees a senior manager bend rules without consequence, they learn that fraud is not punished but rewarded. Over time, dishonesty becomes part of your DNA.
Think of it this way: internal controls are the locks on your doors, but culture decides who gets the keys. If the wrong people hold the keys, no system will save you.
Many leaders assume fraud is a technical problem. “Install better systems,” they say. Or “hire more auditors.” That thinking is flawed. Fraud prevention is not a compliance checklist; it is a cultural discipline. The more an organization invests in systems without fixing culture, the more sophisticated fraud becomes.
In fact, I argue that fraud is a mirror of leadership. If leaders cut corners in strategy execution, staff will cut corners in expense claims. If the board tolerates late reports, managers will tolerate late reconciliations. Fraud reflects leadership behavior more than it reflects staff morality.
During a consulting engagement with a regional bank, the CEO proudly shared their fraud detection software. Yet when I interviewed staff, I learned that branch managers routinely bypassed approval thresholds by splitting transactions into smaller chunks.
The system flagged nothing because technically, “no threshold was breached.” The fraud was cultural; branch managers believed targets justified bending rules. The board had never asked: “What behaviors are we rewarding in pursuit of growth?”
Six months later, the bank reported a multi-million-shilling loss due to loan fraud. Not because the system failed, but because the culture celebrated sales numbers at all costs.
"Boards that survive are those that shift focus from compliance to conscience, from controls to culture. Fraud does not start with theft; it starts with silence."
Tweet
How to measure hidden fraud risk in culture
Leaders often ask me: “How do we know if fraud risk is in our culture?” My answer is simple: observe behavior. Forget the glossy reports. Instead, test for these cultural warning signs:
- Do staff openly challenge leaders when they see wrong decisions? If not, silence protects fraud.
- Do managers report bad news quickly, or do they massage it until it is too late? Delay is a fraud incubator.
- Does your organization celebrate people who hit numbers, even if they bend rules? If yes, fraud risk is embedded in your rewards system.
- When someone reports misconduct, what happens next? If whistleblowers are ignored or punished, your culture is training employees to look away.
- How often does your board discuss fraud beyond reviewing audit reports? If discussions are superficial, fraud has already entered unnoticed.
From controls to conscience
The future of fraud prevention is not more policies but more integrity. You do not need another hotline; you need leaders who live by example. You do not need more approvals; you need managers who enforce accountability consistently. Systems can only go so far. Culture carries the rest.
Here is the contrarian position: fraud is not an operational risk; it is a leadership risk. If your board does not own it, it will own your organization.
Practical leadership tool: the fraud culture audit
Every board should run a simple test quarterly:
- Listen to silence. If staff never raise concerns in town halls, assume fear rules your culture.
- Check consistency. If leaders discipline juniors but protect high performers, assume fraud is already hidden
- Test smallest promises. If managers cannot keep commitments on deadlines and reports, assume bigger promises (like financial reporting) are also compromised.
- Simulate exposure. Run a mock fraud scenario and see how quickly issues surface. The speed of response reflects your cultural resilience.
The most dangerous fraud risk is not in your systems but in your culture. It sits quietly in tolerated shortcuts, in excused behaviours, in unchallenged leaders. By the time the numbers show a loss, the culture has already been compromised for years.
Boards that survive are those that shift focus from compliance to conscience, from controls to culture. Fraud does not start with theft; it starts with silence.
So I ask again: How much fraud risk sits quietly in your culture?
