"The Employee Was Dishonest" Is Not a Root Cause

The typical fraud matter in an Indian company ends in a familiar way. The person responsible leaves, a new approval is added to the step they used, and the audit committee minutes record that "corrective action has been taken". A year or two later, a different person exploits a neighbouring weakness, and the cycle repeats.

The problem is that the investigation answered who, and nobody asked why.

Why "the employee was dishonest" is not a root cause

Dishonesty is a constant. In any large organisation, some people will be tempted. The questions that matter for the company are different:

• Why was the scheme possible?
• Why did it run for as long as it did?
• Why did nobody who noticed it say anything, or why was nobody listening when they did?

The ACFE's Occupational Fraud 2026 report found that a typical fraud lasted 12 months before detection, and that a lack of internal controls or override of existing controls was the primary weakness in more than half of cases. Those are organisational failures, not individual ones.

Four layers of root cause

1. Controls

Which control should have prevented the scheme, and did it exist? If it existed, how was it bypassed: segregation of duties not enforced, an override not logged, a reviewer who rubber-stamped? Which detective control, such as reconciliation, analytics or audit, should have caught it, and why did it not?

2. Incentives and pressure

Did targets, bonuses or performance pressure create a motive or a rationalisation? Was the person, or their team, rewarded for the results the fraud produced? The fraud triangle is a useful lens here.

3. Oversight

Who supervised the person, and what did they review? Were there earlier audit findings, complaints or anomalies that were noted but not acted on? Did management information hide the problem, for example by netting off or aggregating the affected accounts?

4. Culture and information flow

Did colleagues know or suspect? If so, why did they not report it, or what happened when they did? Was the person seen as untouchable because of performance, seniority or connections?

The fourth layer is the hardest to examine and usually the most revealing.

What good looks like

A separate root cause review

Run the root cause analysis alongside or after the investigation, led by someone who did not design or operate the failed controls. Interview process owners and colleagues about how the process really worked, not how the manual describes it.

Specific changes, with owners, dates and tests

For each root cause, agree a change:

A closing report to the board

The audit committee, and through it the board, should receive a closing report that covers:

1. what happened, for how long and the loss;
2. recoveries made and still being pursued;
3. action taken against individuals and third parties;
4. root causes across all four layers;
5. changes made, changes outstanding and the dates by which they will be tested;
6. external reporting made, including to the auditor, stock exchanges, insurers or regulators;
7. how the fraud risk assessment and audit plan have been updated.

For listed entities, SEBI LODR asks the audit committee to review the findings of internal investigations into suspected fraud or material control failure and report them to the board. A closing report of this kind is the natural way to discharge that duty.

Verification

Six to twelve months later, internal audit should test the changes, ideally using the data tests that would have detected the original scheme. Only then should the board consider the matter fully closed.

Common mistakes

• Fixing only the exact step. The next fraudster uses the step next to it.
• Blaming the individual alone. It is comfortable and teaches the organisation nothing.
• Asking the process owner to diagnose their own process.
• No follow-up test. Remediation without verification is a promise.
• Not sharing lessons. Anonymised lessons, shared with other units, help prevent the same scheme elsewhere.

Where we can help

We carry out independent root cause reviews after investigations, help audit committees prepare closing reports, and design the data tests that verify remediation. Where the review uncovers more, our investigation team takes it further. Speak to us in confidence.