File No: 2026-001 The Employee Nobody Suspected

The accounts payable officer stared at the screen.

The supplier was adamant. "We've been chasing this invoice for weeks."

That couldn't be right. The system showed the invoice had been paid.

She checked the payment report. The money had left the organisation's bank account exactly as it should have. So why hadn't the supplier received it?

She ran another report. Then another. Something wasn't adding up.

Within hours, what appeared to be a simple payment query had become something far more sinister.

The money hadn't gone to the supplier at all. It had gone to someone inside the organisation.

At first, everyone assumed it had to be an error. Perhaps the supplier had provided incorrect banking details. Maybe someone had entered an account number incorrectly. Maybe it was simply a banking glitch.

Nobody wanted to believe the alternative. Because the account belonged to one of the organisation's most trusted employees.

She had been there for years. She had worked her way to the top of the finance team. She was experienced, knowledgeable and respected. She understood the finance system better than almost anyone else. Managers trusted her judgement. Colleagues relied on her advice. When auditors recommended improvements to financial controls, she was often the person responsible for implementing them.

She wasn't bypassing the system. In many respects... she was the system.

As investigators pieced together the transactions, a remarkable pattern emerged.

This wasn't a single lapse in judgement. It wasn't a desperate decision made in the middle of a financial crisis. It was a carefully refined process. A supplier's banking details would be quietly changed. A payment would be processed. The banking details would then be changed back before anyone noticed.

Duplicate invoices were disguised among hundreds of legitimate transactions. System warnings were overridden. Other employees' logins were used to conceal activity.

When one control became more difficult to exploit, another weakness was found.

The fraud didn't survive because there were no controls. It survived because someone understood them well enough to work around them. For more than four years.

When people hear stories like this, they often ask the wrong question. "How could someone do that?" The more important question is:

How could an organisation full of honest, capable people not see it?

The answer isn't incompetence. It's trust.

Organisations need trust. Without it, nothing gets done.

Experienced employees are given greater responsibility because they've earned it. Their judgement is respected. Their work is questioned less often. Over time, trust becomes confidence. Confidence becomes assumption. Eventually, assumption replaces verification.

That is where organisations become vulnerable.

Every major insider fraud contains the same uncomfortable truth. The offender is rarely the person everyone worries about.

They are often the person everyone depends on. The employee who never takes leave. The one who always volunteers to fix problems. The person who knows every shortcut in the system. The colleague who appears indispensable.

None of these behaviours are in themselves evidence of dishonesty. Most hardworking employees display many of these traits. The danger arises when an organisation mistakes reputation for control.

There is another lesson hidden inside this story. The fraud wasn't discovered by forensic accountants. It wasn't uncovered by sophisticated software. It wasn't found because someone finally became suspicious. It started because someone was curious.

A supplier asked a question. An employee decided not to dismiss it. Instead of accepting the first explanation, they looked a little deeper. That single decision ended a fraud that had been running for years.

Sometimes integrity doesn't begin with sophisticated controls. It begins with somebody asking one more question.

Questions every executive should ask

Rather than asking whether your organisation employs trustworthy people, ask yourself:

• Where have we allowed trust to replace verification?

• Which employees have become so experienced that their decisions are rarely questioned?

• Could one person create, approve and conceal the same transaction?

• If a supplier called tomorrow with a simple question, would we know where to look?

• Are our controls designed to detect mistakes - or to detect trusted insiders?

  
  

Trust is one of the foundations of every successful organisation. But trust is not a control.

The strongest organisations don't trust their people less. They simply build systems that verify, regardless of who is sitting behind the keyboard.

This story is inspired by real events. Some characters, organisations and circumstances have been changed or combined to protect confidentiality and highlight the governance lessons.