Why fraud is a growing risk for SMEs
Small and medium businesses are disproportionately affected by fraud. They often lack the internal controls, segregation of duties, and oversight mechanisms that larger organisations have. The Association of Certified Fraud Examiners estimates that businesses lose approximately 5% of revenue to fraud each year. For a business with R10 million in annual revenue, that is R500,000.
Fraud is not always obvious. It can take months or years to discover, and the longer it goes undetected, the larger the loss. A forensic audit is the formal investigation process that identifies how fraud occurred, who was responsible, and how much was lost.
This article explains what a forensic audit involves, the most common fraud schemes affecting South African SMEs, and what you can do to prevent fraud before it starts.
What is a forensic audit?
A forensic audit is a detailed examination of financial records, transactions, and business processes to detect fraud, theft, or other financial irregularities. Unlike a statutory audit, which provides an opinion on whether the financial statements are fairly presented, a forensic audit is investigative. It seeks to answer specific questions: what happened, who was involved, how much was lost, and what evidence exists.
Forensic audits are conducted by forensic accountants or auditors with specialised training in fraud detection and investigation. The findings may be used in legal proceedings, disciplinary hearings, insurance claims, or regulatory complaints.
When a forensic audit is needed
- Suspicion of theft, embezzlement, or misappropriation of funds
- Unexplained discrepancies in financial records
- Irregular transactions identified during a statutory audit
- Employee complaints or whistleblower reports
- Fraudulent invoices or fictitious suppliers
- Cash flow problems that do not match revenue
- Insurance claims following suspected arson or theft
Common fraud schemes affecting South African SMEs
Billing fraud
The most common scheme involves employees creating fictitious invoices from fake suppliers or inflating invoices from real suppliers. The employee approves the invoice and directs payment to an account they control.
Red flags:
- New suppliers with no track record
- Invoices just below approval thresholds
- Suppliers with P.O. Box addresses only
- Payments to suppliers with the same bank account as employees
- Round-number invoices with no supporting documentation
Payroll fraud
Employees may create ghost employees on the payroll, inflate their own salaries, or manipulate overtime and commission calculations.
Red flags:
- Employees with no records of hiring or termination
- Payroll increases not supported by performance reviews
- Overtime payments that consistently exceed industry norms
- Bank accounts shared by multiple employees
Cash theft
Businesses that handle cash are particularly vulnerable. Cash theft can occur at the point of sale, during banking, or through manipulation of cash records.
Red flags:
- Cash shortages that are consistently explained away
- Irregular banking patterns
- Missing cash receipts or duplicate receipting
- Employees who refuse to take leave (which would reveal the theft)
Expense fraud
Employees submit false or inflated expense claims, claim for personal expenses as business expenses, or create fictitious expenses.
Red flags:
- Expenses that are consistently just below the approval limit
- Duplicate claims for the same expense
- Expenses from unusual categories or vendors
- Receipts that are altered or inconsistent
Asset misappropriation
Employees steal physical assets such as inventory, equipment, or supplies, or use business assets for personal purposes without authorisation.
Red flags:
- Inventory shrinkage that cannot be explained
- Missing or damaged equipment
- Employees using business vehicles for personal use
- Supplies ordered in excess of operational needs
The forensic audit process
Step 1: Scoping and planning
The forensic auditor defines the scope of the investigation, identifies the areas of concern, and develops an investigation plan. This includes reviewing the allegations, assessing the available evidence, and determining the resources needed.
Step 2: Evidence gathering
The forensic auditor collects and preserves evidence. This includes:
- Financial records and bank statements
- Invoices, receipts, and supporting documentation
- Employee records and payroll data
- Computer records and email correspondence
- CCTV footage and access logs
- Witness interviews
Evidence must be handled carefully to maintain its integrity and admissibility in legal proceedings.
Step 3: Analysis
The forensic auditor analyses the evidence to identify patterns, anomalies, and discrepancies. This may involve:
- Data analytics to identify unusual transactions
- Bank reconciliations to trace fund flows
- Comparison of records against independent sources
- Trend analysis to identify changes over time
Step 4: Reporting
The forensic auditor prepares a report setting out the findings, the evidence supporting those findings, and recommendations for action. The report must be factual, objective, and supported by evidence.
Step 5: Recommendations
Based on the findings, the forensic auditor recommends actions such as:
- Disciplinary action against employees involved
- Criminal charges against perpetrators
- Civil recovery of lost funds
- Improvements to internal controls
- Changes to business processes
Prevention: what SMEs can do
Segregate duties
The most effective fraud prevention measure is segregation of duties. No single employee should control an entire transaction from initiation to completion. Separate the functions of:
- Approving payments
- Processing payments
- Reconciling bank statements
- Maintaining supplier records
- Authorising new suppliers
Implement internal controls
- Require dual authorisation for payments above a threshold
- Reconcile bank statements monthly (not by the person who processes payments)
- Conduct surprise cash counts
- Review supplier master files regularly for fictitious suppliers
- Require supporting documentation for all payments
Foster a culture of honesty
- Set the tone from the top: leadership must demonstrate ethical behaviour
- Establish a whistleblower policy that protects employees who report fraud
- Communicate the consequences of fraud clearly
- Conduct regular training on fraud awareness
Conduct regular audits
- Internal audits or reviews of high-risk areas (cash, payroll, procurement)
- Surprise audits of cash and inventory
- Review of related-party transactions
- Analysis of expense claims
Monitor transactions
- Review bank statements for unusual transactions
- Monitor payroll for ghost employees or unauthorised changes
- Track supplier payments for duplicates or round amounts
- Analyse expense claims for patterns
The bottom line
Fraud is a reality that every South African business must prepare for. SMEs are particularly vulnerable because they often lack the controls and oversight of larger organisations. A forensic audit can uncover fraud that has already occurred, but prevention is always better than investigation.
The most effective protection is a combination of segregation of duties, internal controls, a culture of honesty, and regular monitoring. If you suspect fraud, act quickly. The sooner a forensic audit begins, the better the chances of recovering lost funds and preventing further losses.
SC Audit is an IRBA-registered audit firm based in Bellville, Cape Town. SC Audit’s partners Niel Schoeman, Simone Coetzee, and Hennie Meyer support businesses with forensic audits, fraud investigations, internal controls, and risk management. Contact SC Audit to discuss how to protect your business from fraud.
Frequently Asked Questions
What is the difference between a forensic audit and a statutory audit?
A statutory audit provides an opinion on whether the financial statements are fairly presented. A forensic audit is an investigation into specific allegations of fraud, theft, or financial irregularity. A statutory audit is performed annually; a forensic audit is performed when fraud is suspected.
How much does a forensic audit cost?
The cost depends on the scope and complexity of the investigation. Simple cases may cost R50,000 to R100,000. Complex cases involving multiple years and large volumes of transactions may cost significantly more. The cost is often justified by the value of funds recovered.
Can I recover funds lost to fraud?
Yes, but recovery depends on several factors: whether the perpetrator has assets, whether criminal or civil action is pursued, and whether insurance covers the loss. A forensic audit provides the evidence needed to support recovery action.
What should I do if I suspect fraud?
Act quickly but carefully. Do not confront the suspect directly, as this may cause them to destroy evidence. Engage a forensic auditor to begin an investigation. Preserve all relevant documents and records. Do not make changes to the financial system until the investigation is underway.
How can I prevent fraud in my business?
The most effective measures are segregation of duties, regular reconciliation of bank statements and accounts, surprise audits, a whistleblower policy, and a culture of honesty from the top. No single measure is sufficient, but a combination of controls significantly reduces the risk.