ACFE Insights Blog

Fraud Risk in Fragile Systems: When Culture Undermines Strong Controls

Why do strong controls sometimes fail to prevent fraud? Drawing on firsthand experience in fragile, donor-funded environments, this article explores how culture, pressure and rationalization can undermine well-designed systems and offers practical ways organizations can strengthen fraud prevention beyond policies and checklists.

By Inès Panou, MBA, CFE May 2026 Duration: 5-minute read
Please sign in to save this to your favorites.
Early in my career, I traveled frequently from my company’s headquarters in the United States to review programs operating in remote and high-risk environments in Eastern Africa. As a young auditor, I believed what many auditors are trained to believe: if policies were documented, approvals were signed, inventory records were complete, and leadership projected confidence, then the major risks were under control. Fieldwork quickly changed that perspective. 

An Auditor’s Work Under Threat 

On one assignment, I arrived late in the evening in a remote area where I was scheduled to visit a warehouse the next morning. The local office’s internal auditor traveling with me decided not to stay at the hotel because of security concerns and fear of retaliation. Thus, he arranged to stay with family nearby. I did not have that option; I stayed alone under heightened safety concerns. The next day, I visited the warehouse and later walked through the local marketplace. There, I found food items meant for free distribution to vulnerable families being sold in the market. As the review progressed, it became clear that this was not the act of one individual. It involved collusion between warehouse personnel and field staff involved in the distribution chain. 

I also learned that, in such environments, professional judgment is impacted by personal security. You do not always ask every question on the spot. You do not write every finding in the field. Sometimes, the wiser approach is to observe carefully, gather facts discreetly and finalize conclusions once in a safer location. 

That experience shaped my understanding of fraud risk for the rest of my career. Strong controls on paper do not always survive contact with fragile systems. Organizations often believe that if they have segregation of duties, approval matrices, reconciliations, written procedures and signed reports, they have effectively managed fraud risk. 

These controls are necessary. But in fragile environments, they may only address part of the problem. 

How Culture and Compliance Intersect 

When systems are under pressure, indicators can be overstretched staff, strained or limited resources, and disconnected oversight. In these situations, fraud risk often moves beyond formal controls and into human behavior. In many cases, the documents may be clean, but the corporate culture is not. 

In another country’s program, leadership appeared disciplined, and processes appeared compliant. Most audit testing would have concluded that controls were functioning. Yet one area deserved closer attention: employee morale. 

I made it a point to build rapport with local staff, ask questions beyond the checklist and observe turnover patterns. What emerged was a workplace marked by dissatisfaction, distrust and silence. Employees felt unseen, and some believed misconduct was tolerated as long as results were delivered. 

This was extremely insightful because fraud does not always begin with weak controls. Sometimes, it begins with rationalization:  

  • “Everyone does it.”
  • “We are underpaid.”
  • “The organization does not care about us.”
  • “This is how things work here.” 

When these beliefs spread, collusion becomes easier and controls become more performative than effective. Many organizations focus on individual misconduct, but in fragile systems, fraud is often collective. One person can bypass a control. Several people can neutralize the entire framework. When warehouse staff, field teams, supervisors or finance personnel align around silence, false records can be produced, exceptions become normalized, and losses are concealed for long periods. This is why fraud risk assessments in complex environments must examine not only controls, but also relationships, incentives and local power dynamics. 

Strengthening Fraud Prevention in Practice 

Based on years of work across finance, compliance, investigations and donor-funded operations, I believe organizations should strengthen fraud prevention in practical ways and use cultural adaptive tools. Do not rely solely on documentation. Visit the last mile. Observe distribution points. Walk facilities. Ask operational staff how work really gets done.  

Fraud often reveals itself in the gap between policy and practice. Track turnover, absenteeism, grievance patterns, delayed vacations, management complaints and unusual staff behavior. Low morale is not just an HR issue; It can be an early fraud signal. If managers are rewarded only for revenue goals, speed, output or clean donor reports, some will protect appearances at any cost. 

Leaders must reward transparency, escalation of concerns and timely correction of identified weaknesses. 

Stakeholders often expect the same level of control maturity in remote, fragile settings as in stable headquartered environments. Accountability matters deeply, but expectations must also reflect operational reality and local context. When the pressure for results is high, but systems are weak, organizations may be pushed toward appearances instead of integrity. The answer is not lower standards, but to have smarter oversight through realistic timelines, investment in local capacity, stronger field supervision, culture assessments and independent verification at the last mile. 

Fraud prevention is more than well-designed controls. It is about understanding people, pressure, incentives and culture. Some of the most high-risk environments had policies that looked strong and well structured. What they lacked was trust, transparency and accountability in practice. In the end, a signed checklist cannot protect an organization if the system and people around it has already abandoned integrity.

Topic:
Tags: