The fraud triangle names the three conditions generally present when fraud exists: an incentive or pressure to commit fraud, a perceived opportunity to commit fraud, and an ability to rationalize the fraudulent action (AICPA, AU-C 240, .A30). It organizes fraud risk factors during risk assessment, and it does not establish that fraud occurred.
The model is adapted from the work of Donald Cressey (HHS Office of Inspector General, The Fraud Triangle). Neither of the two US audit standards that govern the consideration of fraud uses the phrase “fraud triangle” in its own text, yet both classify their fraud risk factor examples on exactly those three conditions.
The Three Conditions, as the Standards Name Them
Incentive or Pressure
Incentive or pressure to commit fraudulent financial reporting may exist when management is under pressure, from sources outside or inside the entity, to achieve an expected and perhaps unrealistic earnings target or financial outcome, particularly because the consequences to management for failing to meet financial goals can be significant. Individuals may have an incentive to misappropriate assets for a plainer reason, such as living beyond their means (AICPA, AU-C 240, .A1).
Opportunity
A perceived opportunity to commit fraud may exist when an individual believes internal control can be overridden, for example because that individual is in a position of trust or has knowledge of specific deficiencies in internal control (AICPA, AU-C 240, .A1). The condition turns on the individual’s belief about the control, not on how well the control is documented. Whether a control was suitably designed and whether it actually operated are two separate questions, and tests of controls works through the difference.
Rationalization or Attitude
Some individuals possess an attitude, character or set of ethical values that allow them knowingly and intentionally to commit a dishonest act, and even otherwise honest individuals can commit fraud in an environment that imposes sufficient pressure on them (AICPA, AU-C 240, .A1).
The conditions are not independent of one another. The greater the incentive or pressure, the more likely an individual will be able to rationalize the acceptability of committing fraud (PCAOB, AS 2401, .07).
Where the Three Conditions Are Codified
Two rulebooks, split by who is being audited. Audits of non-issuers, meaning entities outside the public company regime, run on AU-C 240, whose appendix A sorts its illustrative fraud risk factors into the three conditions and adds the qualifier that the inability to observe one or more of them does not necessarily mean that no risk of material misstatement due to fraud exists (AICPA, AU-C 240, .A30). Issuer audits run on AS 2401, whose appendix sorts its examples the same way, labelled incentives and pressures, opportunities, and attitudes and rationalizations (PCAOB, AS 2401, .85).
Presence is not proof in either book. Fraud risk factors cannot easily be ranked in order of importance, some will be present in entities where the specific conditions do not present risks of material misstatement, and deciding whether a factor counts requires professional judgment (AICPA, AU-C 240, .A29). The auditor may suspect fraud or, in rare cases, identify its occurrence, but the auditor does not make legal determinations of whether fraud has actually occurred (AICPA, AU-C 240, .03).
Where the Model Lands in an Audit File
It lands first in the engagement team’s planning discussion, where the requirement is written in the triangle’s own vocabulary. That discussion should address known factors that may create an incentive or pressure for management or others to commit fraud, provide the opportunity for fraud to be perpetrated, and indicate a culture or environment that enables rationalizing it, alongside the risk of management override of controls (AICPA, AU-C 240, .15). The significant decisions reached there go into the file, with how and when the discussion occurred and which audit team members took part (AICPA, AU-C 240, .43). The same idea is a named principle in the control framework most internal control work is written against, covered in risk advisory services, and it drops away one level down, because a review does not contemplate assessing fraud risk, a boundary audit vs review vs compilation sets out.
Fraud Triangle Versus Fraud Diamond
The fraud diamond is the fraud triangle plus a fourth element. David T. Wolfe and Dana R. Hermanson proposed adding an individual’s capability, meaning the personal traits and abilities that play a major role in whether fraud may actually occur even when incentive, opportunity and rationalization are all present (The CPA Journal, December 2004). The authors put it forward as an enhancement of the fraud triangle rather than a replacement for it, and the US audit standards still classify their fraud risk factors on three conditions, not four.
Common Questions
The audit standards name two, not three. Two types of intentional misstatement are relevant to the auditor, misstatements resulting from fraudulent financial reporting and misstatements resulting from misappropriation of assets (AICPA, AU-C 240, .03). Issuer audits draw the same two-way line (PCAOB, AS 2401, .06).
A real one sounds like an accounting argument, not a confession. Management representatives may rationalize the appropriateness of a material misstatement as an aggressive rather than indefensible interpretation of complex accounting rules, or as a temporary misstatement expected to be corrected later when operational results improve (PCAOB, AS 2401, .06).
Accountably places trained offshore accountants and tax preparers inside US CPA and EA firms, and a firm can put a block of its own bookkeeping or tax work through a trial task to keep its own reviewers on judgment work like this.
