Fraud warning signs (red flags)

Fraud is rarely loud. It usually begins with small, repeated actions that look logical at first sight: a balance is "tidied up", a document "will be processed later", an employee "cannot trust anyone else with the job". Red flags are signs of such patterns. Above all, a flag is not proof of guilt but a reason to look closer.

A flag is not yet evidence

A raised flag does not mean the employee is guilty. A storekeeper who never takes leave may simply be very conscientious, and frequent balance corrections may come from a badly configured program. A flag only shows where to direct attention. Conclusions are drawn from documents and counts. So a manager who spots a flag does not accuse the employee but quietly and objectively starts a review.

An example: a storekeeper has not taken leave for two years and corrects balances up to 15 times a month. The first sign alone may point to diligence, the second to a problem in the program. Together, though, they are reason enough to look.

Signs in an employee's behaviour

• Rarely takes leave and hands the job to nobody, even when ill.
• Insists that only they have access to documents and 1C.
• Resists inspections, counts and new procedures, always saying there is "no time".
• Seeks to stay on alone after hours or at weekends.
• Is unusually close to a supplier or driver.
• A lifestyle that visibly does not fit their income (this sign is judged with the greatest caution, since the reasons can vary).

Such signs are often found in the most trusted, "irreplaceable" employee: it is precisely trust that lets control slacken. So trust must never replace control.

Signs in documents, records and process

• Balances are often corrected by hand, especially for the same items or by the same person.
• Shortages and write-offs always cluster in one product group.
• Documents are entered with back dates, with many deleted or cancelled entries.
• Round sums, identical handwriting, signatures that look alike.
• Movement without documents: goods taken out with a promise to "sort the paperwork later".
• Many returns, especially without documents or from a single customer.
• At stock take the storekeeper counts personally, and receiving and recording sit with one person.
• An unexpected "technical fault" on the eve of a count: 1C is down, the camera is switched off.

Such signs are hard to find by hand. Export 1C records to a table and sort them in Excel: group stock adjustments by employee, day and item, and note a cluster of entries at month-end and weekends and the repetition of the same items. Month-end adjustments are sometimes made to "close" a target or a report.

What to do when a flag appears

1. Do not rush and do not question the employee: they should not be tipped off.
2. Preserve evidence: copy the 1C log, document copies and camera recordings before they vanish.
3. Keep the circle small: two or three people should know about the review.
4. Hand the review to an independent party or an internal auditor, and consult a lawyer if needed.
5. Draw no conclusions and impose no penalties until results are in.

Open accusation, threats or a "trap" spoil the review and can create legal risk for the manager personally.

Prevention

Fraud usually needs three things together: pressure (debts, personal problems), opportunity and rationalisation ("the company is rich anyway"). A manager can mostly influence opportunity: segregation of duties, restricted permissions, compulsory leave, surprise counts. Compulsory leave (at least 5–10 working days in a row) is especially simple and effective: someone else takes over the job and sees what is unclear. A safe channel for employees to report concerns (for instance a closed message that only the owner receives) and an open culture that protects the honest employee also help.

Conclusion

Knowing the signs is not meant to make you suspect everybody, but to point control in the right direction. In a small store and in a large logistics centre alike the rule is the same: back trust with control, and you protect both the employee and the company. OmborAudit compares such signs with documents, permissions and count results and helps find an explanation for them.