Red Flags & Fraud Schemes Reference — CFAP by Riskpro

CFAP · Certified Forensic Accounting Professional

Red Flags & Fraud Schemes Reference

A working reference of the fraud schemes covered in this certification's syllabus — Financial Statement Fraud, Frauds Against the Business, Financial Sector Frauds, and Banking Frauds — with the red-flag indicators investigators look for in each.

What is CFAP?

A short introduction to the Certified Forensic Accounting Professional (CFAP).

See the CFAP course →

Financial Statement Fraud

Revenue Recognition Schemes

Recording revenue before it is earned or that does not exist, to inflate reported top-line growth and profitability.

  • Revenue growth consistently outpaces growth in cash collections or accounts receivable turnover slowing without explanation
  • A disproportionate share of the quarter's revenue books in the final days of the period ("hockey stick" pattern)
  • Unusually generous or informal return/right-of-refusal terms extended to distributors near period end
  • Bill-and-hold arrangements where goods are invoiced but never actually shipped, or shipped to a company-controlled warehouse
  • New or related-party customers accounting for a growing share of reported revenue with weak collection history

Manipulation of Non-Revenue Components

Misstating expenses, reserves, or asset values to move reported earnings in the desired direction without touching the revenue line directly.

  • Capitalizing costs that should be expensed (turning a current-period expense into a multi-year asset)
  • Reserve and allowance balances (bad debt, warranty, restructuring) that move inversely with the pressure to hit an earnings target
  • Unusual or unexplained changes in depreciation useful lives or estimation methods between periods
  • Related-party transactions used to shift expenses off the reporting entity's books onto an affiliate
  • Frequent, aggressive "one-time" or "non-recurring" adjustments that recur every period

Frauds Against the Business

Intellectual Property (IP) Fraud

Misappropriation or unauthorized use of a company's trade secrets, proprietary processes, source code, or other IP, typically by an insider positioned to access it.

  • Large or unusual data transfers to personal email, cloud storage, or removable media shortly before an employee's resignation
  • Access to IP repositories by employees with no legitimate business need for that access
  • A departing employee joining a direct competitor or founding a competing venture with suspiciously similar products soon after leaving
  • Requests to remove confidentiality/watermark metadata from technical documents

Payroll Fraud

Improper or inflated payments issued through the payroll system, most commonly ghost employees, falsified hours, or unauthorized rate/commission changes.

  • An employee record with no tax withholding elections, no benefits enrollment, or a bank account shared with another employee on file
  • Payroll changes (new hires, rate changes) approved and processed by the same person with no independent review
  • Overtime or commission concentrated in a small number of employees, disproportionate to their role
  • An employee record whose address matches a supervisor's address or a P.O. box with no physical presence

Commercial Bribery & Corruption

A vendor or outside party influencing an employee's business decisions through undisclosed payments or benefits, against the employer's interest.

  • A vendor consistently winning bids at prices above comparable market rates with no clear competitive advantage
  • A single employee controlling both vendor selection and invoice approval with no segregation of duties
  • Lifestyle spending by a purchasing employee inconsistent with their known compensation
  • A vendor relationship that began shortly after a personal connection (family, prior employer) became known
  • Reluctance or resistance from a vendor to a routine, unannounced site visit or audit

Inventory Fraud

Theft, misstatement, or diversion of inventory, concealed through manipulated counts, valuations, or shipping records.

  • Shrinkage concentrated at specific locations, shifts, or SKUs rather than spread evenly
  • Physical inventory counts that consistently differ from perpetual/book records in the same direction
  • Write-offs of "obsolete" or "damaged" inventory that is never actually observed being disposed of
  • Shipping documents and sales invoices that do not reconcile in quantity or timing

Cash Fraud

Direct theft or misappropriation of cash receipts, disbursements, or petty cash, often concealed through lapping or skimming.

  • The same employee both receives customer payments and posts them to the accounting system, with no independent reconciliation
  • A pattern of small, round-number disbursements just under an approval threshold
  • Customer complaints of being sent past-due notices for accounts they believe they already paid
  • Bank reconciliations that are chronically late, incomplete, or prepared by the same person who handles cash

Financial Sector Frauds

Insurance Fraud

Fraud committed against or through an insurance relationship — inflated or staged claims, premium diversion, or application misrepresentation.

  • A claim filed shortly after a policy was purchased or its coverage limits were increased
  • Losses or damages inconsistent with the physical evidence, timeline, or the claimant's own account
  • A claimant history showing multiple prior claims with a similar pattern across different insurers
  • Supporting documentation (receipts, appraisals) that appears altered, or from a vendor with no verifiable trading history

Stock Market Fraud

Manipulation of securities markets or misrepresentation to investors, including pump-and-dump schemes, insider trading, and disclosure fraud.

  • A sharp, unexplained spike in trading volume or price ahead of a material public announcement
  • Promotional activity (newsletters, social media) touting a low-float stock with vague or unverifiable claims
  • Trading patterns by insiders or affiliates that consistently precede negative news
  • Financial disclosures that are unusually vague on the specifics of revenue sources or customer concentration

Banking Frauds

Banking Frauds

Fraud committed against or through a bank — loan fraud, check fraud (including kiting), account takeover, and internal employee fraud.

  • Loan application financials that do not reconcile with the applicant's tax filings or independently verifiable records
  • A pattern of deposits and near-simultaneous withdrawals between accounts at different institutions consistent with check kiting
  • An employee overriding standard approval limits or control exceptions with unusual frequency
  • Collateral valuations that rely on a single, non-independent appraiser used repeatedly for the same borrower

This reference is part of Riskpro's Certified Forensic Accounting Professional (CFAP) programme.

See the CFAP course →