Fraud prevention: how CFOs build financial integrity

On June 18, 2020, Wirecard AG, then a DAX 30 darling worth €24 billion, announced that €1.9 billion in cash sitting in Philippine trustee accounts simply did not exist. CEO Markus Braun resigned within 48 hours. COO Jan Marsalek boarded a private jet to Belarus and remains a fugitive. Within a week, the company filed for insolvency, becoming the first DAX-listed firm ever to do so. EY, which had signed clean audits for over a decade, faced criminal investigations. BaFin, Germany's financial regulator, had spent years investigating *short sellers*, the very people who had been screaming "fraud" since 2015.

Wirecard was not a sophisticated fraud. It was a crude one. And it persisted for years because every layer of defense, internal controls, external audit, regulator, board, failed simultaneously. For the modern CFO, Wirecard is the cautionary tale of this decade: not because fraud is exotic, but because the systems designed to catch it are more brittle than most executives realize.

The Association of Certified Fraud Examiners' 2024 *Report to the Nations* estimates that organizations lose 5% of annual revenues to fraud, a $5 trillion global drag. The median fraud loss runs $145,000 per case, but the median *duration* before detection is 12 months. For frauds involving the CFO or C-suite, median losses jump to $459,000 and detection stretches beyond 18 months. The lesson is uncomfortable: the higher in the organization the fraud originates, the longer it survives and the more it costs.

This lesson is about building the controls, culture, and detection mechanisms that prevent your name from appearing in a Wirecard-style postmortem.

Why fraud slips past smart cfos: the anatomy of failure

Every fraud rests on Donald Cressey's Fraud Triangle: pressure (financial or performance), opportunity (weak controls), and rationalization (the cognitive permission slip). Modern fraud researchers add a fourth element, capability, turning it into the Fraud Diamond. The executive insight is that CFOs can only meaningfully influence one vertex: opportunity. You cannot regulate a manager's gambling debts or a CEO's narcissism. You can absolutely close the control gaps that let those pressures metastasize into balance sheet lies.

The three fraud categories you must mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.View full definition →

The ACFE classifies occupational fraud into three buckets, and your control architecture should explicitly address all three:

Asset misappropriation (86% of cases, but only $120K median loss), skimming, payroll ghost employees, expense reimbursement fraud. Common, manageable, rarely existential.

Corruption (48% of cases, $200K median), bribery, kickbacks, conflicts of interest. Particularly acute in cross-border operations and procurement.

Financial statement fraud (5% of cases, but $766K median loss and frequently company-killing). This is the Wirecard category. It is rare in frequency but accounts for the catastrophic outcomes that end careers and companies.

The error most CFOs make is **allocating control resources proportionally to *frequency* rather than *severity***. Your SOX testing budget is probably overweighted on T&E controls and underweighted on revenue recognition cutoff and intercompany reconciliations, the very areas where catastrophic frauds hide.

Why wirecard's controls failed

The Wirecard fraud worked because of a structural blind spot familiar to any CFO with offshore operations. Roughly half of Wirecard's reported revenue came from "Third-Party Acquiring" (TPA) partners in Dubai, the Philippines, and Singapore, small companies that ostensibly processed payments in jurisdictions where Wirecard lacked licenses. The cash from these partners was held in escrow by trustees. EY confirmed the cash existed by relying on *balance confirmations from the trustees themselves*, rather than independently confirming with the underlying banks (BPI and BDO in the Philippines). When EY finally insisted on direct bank confirmations in 2020, both banks confirmed the accounts had never existed.

The control failure was not exotic. It was a violation of ISA 505, the requirement that external confirmations be controlled by the auditor and sent directly to the responding party. Every CFO with offshore receivables or escrow arrangements should be asking right now: who actually sends and receives our bank confirmations, and does our auditor independently control that channel?

Building the three lines of defense

The Institute of Internal Auditors' Three Lines Model (updated 2020) remains the operational blueprint, but most CFOs implement it as an org chart rather than a functioning system. Here is how to build it so it actually catches fraud.

First line: operational controls that bite

The first line is operational management, the people running revenue, procurement, payroll, treasury. Their controls must be designed with the assumption that a determined, intelligent insider is trying to defeat them. Key non-negotiables for 2026:

• Segregation of duties enforced at the ERP layer, not policy layer. If your SAP or Oracle access controls let the same person create a vendor, approve an invoice, and release a payment, you have a Wells Fargo, style breach waiting to happen. Run a SoD conflict report quarterly and require sign-off on every documented exception.
• Mandatory vacation and job rotation in treasury, AP, and reconciliation roles. The Société Générale rogue trader Jérôme Kerviel's €4.9 billion loss in 2008 was uncovered precisely when he was forced to take leave.
• Vendor master data hygiene. The single most common asset misappropriation vector is the fictitious vendor. Match vendor bank accounts against employee bank accounts monthly. Match vendor addresses against employee addresses. This takes a SQLSQLSales Qualified Lead: a prospect the sales team has validated as ready for direct outreach and a proposal, having passed clear qualification criteria.View full definition → query and catches frauds that have run for years.

Second line: risk, compliance, and the forgotten power of analytics

The second line, risk management, compliance, controllership, owns the framework but must own the *data* to be effective. The shift since 2022 has been from sample-based testing to continuous controls monitoring (CCM). Mid-market CFOs now have access to tools (MindBridge, AppZen, Trullion) that apply machine learning to 100% of journal entries, flagging Benford's Law violations, round-dollar entries, weekend postings, and entries by users outside normal roles.

Siemens, after its €1.3 billion FCPA settlement in 2008, built what is now considered the gold standard compliance program: 600+ full-time compliance officers, mandatory annual certifications for 100,000+ employees, and a centralized case management system. The cultural transformation took a decade. The point for today's CFO: compliance is not a department, it is a data infrastructure.

Third line: internal audit with real independence

Internal audit must report functionally to the audit committee, not the CFO. If your Chief Audit Executive's bonus is influenced by the CFO, you have a structural conflict that will surface in the worst possible moment. The audit committee should approve the IA budget, the audit plan, and the CAE's compensation. Anything less is theater.

Post-Wirecard, the EU's Corporate Sustainability Reporting Directive (CSRD), now in full force for FY2025 reporting, has dramatically expanded the scope of what auditors must assess, including non-financial control environments around ESGESGA framework for measuring a company on environmental, social and governance factors, used by investors, regulators and buyers to judge non-financial performance.View full definition → data. CFOs who treat CSRDCSRDEU directive requiring large companies to report standardized, audited sustainability data alongside financial results.View full definition → compliance as a sustainability problem rather than an internal controls problem are setting up the next generation of restatements.

From framework to monday morning: the CFO's practical playbook

Theory is cheap. Here is what a CFO does in the first 90 days to materially reduce fraud risk.

Run a fraud risk assessment that names names

Most fraud risk assessments are generic heat maps. A useful one identifies, for each material business process, **the *specific scheme* that could occur and the *specific control* that prevents it**. For revenue recognition in a SaaS business, that means listing: channel stuffing, side letters voiding revenue recognition criteria, bill-and-hold arrangements, related-party round-tripping. For each, document the preventive control, the detective control, and the named owner.

The case study here is Under Armour, which paid a $9 million SEC penalty in 2021 for pulling forward $408 million in sales over six quarters (2015-2016) without disclosing the practice. The fraud was not a control failure in the traditional sense, orders were real, but rather a disclosure failure that masked decelerating organic growth. A robust fraud risk assessment would have flagged "pull-forward of future-quarter orders" as a scheme requiring specific disclosure controls. Most assessments don't get this granular. Yours should.

Build a whistleblower channel people actually use

The ACFE finds 43% of frauds are detected by tips, more than internal audit, management review, and external audit *combined*. Yet most corporate hotlines generate negligible volume because employees correctly perceive them as career-ending. Three design principles separate functional hotlines from theatrical ones:

1. Independence of intake, outsource to a third party (NAVEX, Convercent) with direct reporting to the audit committee chair.
2. Anonymity that holds up, under the EU Whistleblower Directive (transposed into national law across member states by 2023), retaliation against whistleblowers is a personal liability event for executives. Make sure your legal team has briefed you.
3. Feedback loops, tipsters who never hear what happened to their report don't tip again. Without breaching confidentiality, communicate disposition statistics quarterly.

Dan McCrum's Wirecard reporting was sourced largely from internal whistleblowers, people who had tried internal channels and been ignored or threatened. By the time information reaches the *Financial Times*, your internal controls have already failed twice.

Tone from the top, but measured from the middle

Every CFO recites the "tone at the top" mantra. The operational question is how you measure it. The most rigorous companies now run culture audits, anonymized employee surveys that probe specific dimensions: "Do you believe leaders would accept bad news?" "Have you seen colleagues pressured to hit numbers in ways that concerned you?" The results are reported to the audit committee alongside financial metrics. Boeing's MAX crisis, while not an accounting fraud, illustrates the cost of ignoring middle-management signals about engineering shortcuts driven by financial pressure.

Stress-test your auditor relationship

Post-Wirecard, the global audit profession is under regulatory siege. The UK's FRC has split audit and consulting at the Big Four; the PCAOB has dramatically increased inspection scrutiny under Erica Williams. As CFO, your job is not to be your auditor's friend, it is to ensure your auditor has the resources, access, and spine to challenge management. Practical tests:

• When did your auditor last issue a material adjustment? If the answer is "years," ask why.
• Does your audit committee meet with the engagement partner *without management present* at least twice a year? It should.
• Has your auditor rotated lead partners on the SEC-required schedule? Document it.

The CFO's action checklist

1. **Commission an independent fraud risk assessment in