In brief: Internal fraud in SMEs follows a few well-known schemes: fictitious supplier, inflated expense claim, petty cash, ghost employee, diverted receipts, accommodation credit note. Each leaves signals that can be read in the accounts, provided you look for them. The countermeasures are simple: segregation of duties, dual signature, approved reconciliations, rotation. The statutory audit provides reasonable, not absolute, assurance (SME Audit Standards Manual, § 3): it does not replace internal control, which is management’s responsibility (§ 3.1). The statutory auditor (commissaire aux comptes, CAC) discloses to the board the facts that appear to them to be criminal offences (Art. 169-5° of Law 17-95).
Internal fraud rarely starts with a spectacular amount. This article describes the typical schemes in an SME, the signals that should raise the alarm, the controls that make them difficult, and what can, or cannot, be expected from the statutory audit.
What audit standards call fraud
The SME Audit Standards Manual of the Order of Chartered Accountants defines fraud as “an intentional act by one or more individuals among management, those charged with governance, employees or third parties, involving the use of deception to obtain an unjust or illegal advantage” (§ 3.2.2).
Two categories follow:
- employee fraud, which involves only employees;
- management fraud, which involves one or more executives or members of those charged with governance.
In both cases, the manual states, “there may be collusion with third parties within or outside the entity”. The typical case is the complicit supplier.
The fraud triangle
The manual uses the “fraud triangle”: three conditions which, when combined, make fraud likely (§ 3.2.2).
| Condition | What the manual says |
|---|---|
| Pressure | Immediate needs, for example significant personal debts or a determination to meet earnings targets at any cost |
| Opportunity | ”A weak corporate culture and a lack of adequate internal control procedures can often lead people to believe that fraud may go unnoticed” |
| Rationalisation | The perpetrator convinces themselves that it is not fraud: “it’s not a big problem”, “I’m only taking what I deserve” |
Opportunity is the only side of the triangle the company controls. The rest of this article focuses on it.
Six typical misappropriation schemes
The schemes below are typical mechanisms, presented to help with diagnosis. They are often combined.
| Scheme | Mechanism | Warning sign | Preventive control |
|---|---|---|---|
| Fictitious supplier | Creation of a supplier record, invoices with no actual delivery, payment to an account controlled by the fraudster | Supplier with no verifiable address, recently changed bank details, round-sum invoices just below the dual signature threshold | Supplier records and bank details created and changed by someone who does not make payments; matching of order, receipt and invoice |
| Expense claims | Personal expenses presented as business expenses, the same receipt submitted twice, inflated mileage | Expenses rising with no increase in activity, photocopied receipts, spending on non-working days | Written expense policy, approval by the line manager, sample checks of original receipts |
| Petty cash | Cash taken, fabricated cash vouchers, cash receipts not recorded | Recurring cash differences “adjusted” at month end, cash balance abnormally high or always a round figure | Surprise count by someone outside the cash function, cash ceiling, cash book signed every day |
| Ghost employee | A departed employee kept on the payroll, or creation of an employee who does not exist | Employee without a complete file, same bank details for two employees, payroll that does not fall after departures | Joiners and leavers approved in writing by someone other than the person preparing the payroll; reconciliation of payroll, headcount and social security returns |
| Diverted receipts | Customer payment banked into a personal account, then concealed by allocating a subsequent payment (lapping) | Customer receivables ageing without follow-up, customers disputing reminders, differences between customer statements and the accounts | Receipts handled by someone who does not keep the customer accounts; aged balance reviewed monthly; balance confirmations |
| Accommodation credit notes | Credit note issued without goods being returned, to cover a diverted receipt or favour a complicit customer | Credit notes concentrated on one salesperson or customer, credit notes issued just after year end, credit notes with no return note | Credit notes authorised by a manager other than the salesperson; continuous numbering; monthly review of the list of credit notes |
The key controls by cycle, and the evidence to keep for the auditor, are detailed in our article on internal control in SMEs. For expense claims, the accounting and tax treatment is covered in a guide to expense claims; for payroll, see the payroll audit checklist.
Warning signs by cycle
A signal is not proof. The manual makes the point about auditors: fraud often comes to light through “a combination of small clues, implausibilities and exceptions” (§ 3.2.1). The same method applies to management.
Purchases and suppliers
- New suppliers created at month end or by an unusual person.
- Several suppliers sharing an address, telephone number or bank details, or a supplier sharing these details with an employee.
- Intangible services (consulting, maintenance, studies) with no identifiable deliverable.
Sales and receipts
- An increase in credit notes or discounts with no commercial explanation.
- Customers whose balance never falls although they say they have paid.
Treasury and petty cash
- Bank reconciliation running late, or prepared and approved by the same person. Our guide to bank reconciliation explains how to build one.
Payroll
- A change in total payroll that cannot be explained by joiners and leavers or by pay rises.
Behaviour
- An employee who never takes leave or keeps sole access to a file or an account.
Simple preventive controls
Four families of controls close off most opportunities.
- Segregation of duties. Whoever creates a supplier does not pay it; whoever handles receipts does not keep the customer accounts; whoever prepares the payroll does not approve joiners.
- Dual signature. Above a written threshold, two signatories. A well-designed scheme splits payments to fall just below it.
- Approved reconciliations. Bank, petty cash, payroll and social security returns, customers and suppliers: every month, by someone who did not enter the transactions, with a written record of differences.
- Rotation and leave. An employee replaced during leave hands their position over to another pair of eyes.
Example (assumption)
Company X, an SME in distribution. Dual signature above 20,000 DH. The accounts payable clerk creates the supplier records personally and prepares the transfers, which are signed by the CEO on the basis of a summary statement.
During one financial year, the clerk records each month an invoice of 18,500 DH from a maintenance provider they created, whose bank details are their own. Over twelve months, 222,000 DH goes out without any transfer triggering the dual signature.
Three controls would have stopped it: supplier creation by another person, signature of transfers on the basis of supporting documents, a quarterly review of newly created suppliers sorted by cumulative amount.
The small organisation
With two people in the finance department, the active involvement of the owner-manager can compensate for the lack of segregation of duties, but it “may, however, increase other risks, such as the risk of management override of controls” (manual, § 5.3). Compensating controls are detailed in the internal control article cited above.
What the statutory audit detects and does not detect
The statutory auditor is not an investigator, and the law keeps them out of management: their permanent engagement is carried out “to the exclusion of any interference in management” (Art. 166 of Law 17-95).
Management’s responsibility
Before accepting the engagement, the auditor checks that management acknowledges its responsibility for “such internal control as it determines is necessary to enable the preparation of financial statements that are free from material misstatement, whether due to fraud or error” (manual, § 3.1). The audit report restates this allocation (§ 5.2). Preventing and detecting fraud day to day is therefore management’s responsibility.
The auditor’s objective
The auditor seeks to “obtain reasonable assurance that the financial statements as a whole are free from material misstatement, whether due to fraud or error” (manual, § 3).
| What the audit provides | What the audit does not guarantee |
|---|---|
| An assessment of the risks of material misstatement, including fraud, and an appropriate response (§ 3.2.2) | The discovery of all fraud: reasonable assurance “is not, however, a guarantee that an audit conducted in accordance with the standards will always detect a material misstatement” (§ 5.2) |
| Professional scepticism: the auditor must “be aware that management can always commit fraud” (§ 3.2.2) | Absolute assurance, impossible “because of the inherent limitations of the work performed” (§ 3) |
| Unannounced procedures in response to the risk of fraud, for example “surprise” checks in stores (§ 3) | An exhaustive examination: the auditor works by sampling and tests 100% of a population only in certain cases (§ 3.4.2) |
| Specific procedures in response to “management override” (§ 3) | The detection of fraud that is not material to the accounts as a whole |
| Written communication of significant internal control deficiencies to those charged with governance (§ 4.1) | A judgement on the quality of management: the report “does not guarantee the future viability of the entity, nor the efficiency and effectiveness” of management (§ 3) |
A modest but regular misappropriation can remain immaterial to the accounts as a whole: it is for internal control to spot it. The stages of the engagement are described in our article on preparing for the statutory auditor’s engagement.
What the statutory auditor must disclose
Law 17-95 sets out what the statutory auditor brings to the attention of the board of directors, or of the management board and the supervisory board, “as often as necessary” (Art. 169), in particular:
- “the irregularities and inaccuracies they may have discovered” (Art. 169-3°);
- “any facts appearing to them to be criminal offences of which they became aware in the course of their engagement” (Art. 169-5°).
This obligation carries penalties. A statutory auditor who knowingly gives or confirms false information about the company’s situation, or who fails to disclose to the administrative, management or executive bodies facts appearing to them to be criminal, faces six months to two years’ imprisonment and a fine of 10,000 to 100,000 DH, or one of these penalties (Art. 405). Article 104 of Law 5-96 makes Article 405 applicable to statutory auditors of SARLs.
The statutory auditor remains bound by professional secrecy for facts learned by reason of their functions (Art. 177): disclosure is made to the bodies designated by law.
When the fraud comes from management
Law 17-95 penalises SA executives who, in bad faith, make “use of the company’s assets or credit that they knew to be contrary to its economic interests for personal purposes”, or who knowingly present financial statements that do not give a true and fair view in order to conceal the company’s situation: one to six months’ imprisonment and a fine of 100,000 to 1,000,000 DH, or one of these penalties (Art. 384-2° and 3°).
If a significant deficiency concerns the conduct of the owner-manager, there is no one at an appropriate level of authority to report to, and the auditor “should reconsider their ability to continue” (manual, § 4.1). In small entities, a single person may also be responsible for governance (§ 6.2).
What to do when fraud is suspected
- Preserve the evidence. Copy the files, extractions and statements concerned; if necessary, suspend the access rights of the person involved to the accounts and to payments. Accounting documents and supporting documents are kept for ten years (Art. 22 of Law 9-88): nothing should be destroyed or “adjusted”.
- Establish the facts before drawing conclusions. Reconstruct the transactions from the documents: supplier record, history of bank details, transfers, delivery notes.
- Inform the statutory auditor. At the end of the engagement, management signs a representation letter stating that it has disclosed to the auditor “all significant facts relating to actual or suspected fraud of which it was aware” (manual, § 6.1). A suspicion kept quiet makes this statement inaccurate.
- Let the auditor do their work. The statutory auditor may obtain on site all useful documents (Art. 167). Knowingly obstructing their checks, or refusing to provide documents, exposes executives and “any person in the company’s service” to one to six months’ imprisonment and a fine of 6,000 to 30,000 DH, or one of these penalties (Art. 406; Art. 104 of Law 5-96 for the SARL).
- Fix the control that failed, as well as dealing with the case.
A targeted review by an outside party can complement these steps; our article on fraud audits describes this approach, which is distinct from the statutory audit presented on the page statutory audit and the statutory auditor’s engagement.
Points to watch
- Do not confuse audit with prevention. Certified accounts do not prove the absence of fraud (manual, § 3 and § 5.2).
- Monitor supplier records and bank details: they are the entry point for the fictitious supplier scheme.
- Put a framework around the owner-manager’s own transactions: the risk of override grows with their role (§ 5.3).
- Tell the statutory auditor what you know. The representation letter commits you (§ 6.1). Choosing an auditor who pays attention to internal control is covered in the article on choosing a statutory auditor.
READ ALSO:
- Internal control in Moroccan SMEs and mid-sized companies: key controls by cycle
- Preparing for the statutory auditor’s engagement
- Statutory audit in Morocco: complete guide
Frequently asked questions
Is the statutory auditor responsible for uncovering fraud?
The auditor seeks reasonable assurance that the financial statements are free from material misstatement, whether due to fraud or error (SME Audit Standards Manual, § 3). This assurance is high but not absolute: an audit does not always detect every material misstatement (§ 5.2). Internal control designed to prevent fraud is management's responsibility (§ 3.1).
What does the statutory auditor do on discovering a criminal fact?
The auditor brings it to the attention of the board of directors, or of the management board and the supervisory board (Art. 169-5° of Law 17-95). A statutory auditor who fails to disclose to the administrative, management or executive bodies facts appearing to them to be criminal faces six months to two years' imprisonment and a fine of 10,000 to 100,000 DH, or one of these penalties (Art. 405). Article 104 of Law 5-96 extends this rule to statutory auditors of SARLs.
Should the statutory auditor be told about a suspicion of fraud?
Yes. The representation letter that management signs at the end of the engagement states that it has disclosed to the auditor all significant facts relating to actual or suspected fraud of which it was aware (manual, § 6.1). Keeping a suspicion quiet would make this statement inaccurate.
What is the first control to put in place in a small organisation?
Separate the creation of suppliers and bank details from the execution of payments, and have the bank reconciliation approved every month by someone who does not make payments. When headcount does not allow duties to be segregated, the owner-manager receives the bank statements personally and reviews what they do not prepare.
Can an employee refuse to hand over documents to the statutory auditor?
No. The statutory auditor may obtain on site all documents useful to the engagement (Art. 167 of Law 17-95). Executives or any person in the company's service who knowingly obstruct the auditor's checks or refuse to provide documents face one to six months' imprisonment and a fine of 6,000 to 30,000 DH, or one of these penalties (Art. 406). Article 104 of Law 5-96 makes this rule applicable to the SARL.
