The fraud triangle is a model developed by criminologist Donald Cressey in 1953 that explains occupational fraud through three converging conditions: pressure, opportunity, and rationalization. When all three are present in a trusted employee’s situation, the model holds, the psychological barrier to stealing breaks down. Auditors, investigators, and compliance teams still use this framework as the dominant lens for assessing fraud risk, and the Association of Certified Fraud Examiners estimates that organizations lose roughly 5% of annual revenue to occupational fraud each year.1Association of Certified Fraud Examiners. ACFE Report to the Nations: Organizations Lost an Average of More Than $1.5M Per Fraud Case
Where the Model Comes From
Donald Cressey was studying why people with no prior criminal history became embezzlers. His 1953 book, Other People’s Money: A Study in the Social Psychology of Embezzlement, laid out a hypothesis that stuck. Trusted people violate that trust when they face a financial problem they feel they cannot share with anyone, they recognize a way to secretly solve it by abusing their position, and they convince themselves the behavior is acceptable.2AGA. The Fraud Triangle Those three conditions became the triangle’s three sides.
The model doesn’t claim to predict who will steal. It describes the conditions under which stealing becomes psychologically possible for someone who otherwise wouldn’t.
Pressure: The Motive
Pressure is the personal or professional force that makes someone feel trapped enough to consider fraud. Cressey’s key insight was that the problem must feel “non-shareable.” The person believes they cannot turn to a spouse, employer, or bank for help. That isolation is what transforms financial stress from an everyday hardship into a motive for crime.
On the personal side, this often looks like mounting consumer debt, a gambling problem, a medical crisis, or a divorce that has wrecked someone’s finances. The person sees no legitimate path out and no one they can ask. The ACFE’s research consistently finds that “living beyond one’s means” and “financial difficulties” are among the most common behavioral indicators tied to fraud perpetrators.3ACFE Insights Blog. The 6 Most Common Behavioral Red Flags of Fraud
On the organizational side, pressure can be structural. Unrealistic revenue targets, compensation tied entirely to short-term earnings, and a culture that punishes missed numbers create incentives to manipulate financial statements. When an executive’s bonus or job security depends on hitting a quarterly target, the gap between reality and expectation becomes a motive every bit as powerful as personal debt. Top-down pressure of this kind has been at the root of some of the largest financial reporting scandals in U.S. history.
Opportunity: The Opening
Opportunity is the element organizations have the most control over, and it’s the one most directly addressed in auditing standards and compliance programs. A person under financial pressure doesn’t commit fraud unless they see a realistic path to doing it without getting caught.
Weak Internal Controls
The most common source of opportunity is poor segregation of duties. When one person can create a vendor in the payment system, approve an invoice, and reconcile the bank statement, that person can steal money and hide it in the same workflow. Separating those functions across different employees forces collusion, which is harder to sustain and easier to detect. Other control failures that create opportunity include overriding system access controls, not requiring secondary approval for transactions above a threshold, and skipping regular account reconciliations.
Mandatory job rotation matters too. Frauds that rely on concealment, and most do, fall apart when a different employee takes over the duties, even temporarily. A perpetrator who refuses to take vacation or resists cross-training may be protecting a scheme that would unravel the moment someone else looked at the books.
Digital Opportunity
Modern fraud opportunity increasingly lives in digital systems. Email compromise schemes, where a fraudster impersonates a vendor or executive to redirect a wire transfer, exploit the speed and anonymity of electronic payments. The most common factor in wire fraud losses is failing to independently verify new or changed payment instructions through a separate communication channel, such as a phone call to a known number. Layered controls close these gaps more effectively than any single technology solution: multiple approvals for payment changes, callback verification procedures, and restricted access to banking credentials.
How Auditors Assess Opportunity
External auditors at public companies are required under PCAOB Auditing Standard 2401 to actively consider fraud risk during every financial statement audit. That standard directs auditors to exercise professional skepticism, assess risks related to both asset theft and financial reporting fraud, and specifically evaluate the risk that management has overridden internal controls.4Public Company Accounting Oversight Board. AS 2401 – Consideration of Fraud in a Financial Statement Audit The standard exists precisely because management sits in the best position to create opportunity for itself. Executives often have the authority to bypass the controls designed for everyone else.
Rationalization: The Mental Permission Slip
Even with pressure and opportunity in place, most people will not steal from their employer. Something has to neutralize the ethical barrier, and that something is rationalization: the internal story the perpetrator tells themselves to justify the act.
The most common rationalizations follow a few predictable patterns. “I’m just borrowing this and will pay it back” turns theft into a temporary loan. “The company owes me” reframes fraud as collecting an unpaid debt, often tied to a perceived slight, a denied raise, or years of feeling undercompensated. “Nobody gets hurt” minimizes the impact, especially when the victim is a large corporation rather than an identifiable person. And “everyone else does it” points to perceived misconduct by management or colleagues as moral cover.
Rationalization is the hardest element for investigators and auditors to observe directly, because it lives entirely inside the perpetrator’s mind. But it shows up indirectly. A perpetrator who is rationalizing may become defensive when questioned about procedures, dismissive of compliance requirements, or vocal about perceived unfairness in compensation. These behavioral shifts are clues, not proof, and they matter most when combined with other red flags.
Rationalization is not the same as intent. In legal terms, what separates fraud from an honest accounting mistake is whether the misstatement was intentional.4Public Company Accounting Oversight Board. AS 2401 – Consideration of Fraud in a Financial Statement Audit Rationalization is the psychological mechanism that enables that intent, the story that makes deliberate wrongdoing feel acceptable. Proving a defendant rationalized isn’t the prosecutor’s job; proving the act was knowing and intentional is.
Behavioral Red Flags That Map to the Triangle
The ACFE has tracked behavioral warning signs across every edition of its Report to the Nations, and the same six indicators have topped the list since 2008:3ACFE Insights Blog. The 6 Most Common Behavioral Red Flags of Fraud
- Living beyond one’s means. Spending patterns that outpace known income signal pressure or suggest fraud proceeds are already funding a lifestyle.
- Financial difficulties. Known debt problems, liens, or garnishments point directly to the pressure side of the triangle.
- An unusually close relationship with a vendor or customer. This can signal collusion and represents a failure in the opportunity controls meant to separate personal relationships from purchasing authority.
- Unwillingness to share duties or excessive control. When someone insists on handling a process end to end and resists cross-training, they may be protecting a scheme that depends on sole access.
- Irritability, suspicion, or defensiveness. Behavioral shifts often surface when a perpetrator feels the strain of concealment or fears detection.
- A “wheeler-dealer” attitude. A pattern of cutting corners and treating ethics as flexible suggests rationalization comes easily.
No single red flag proves fraud. The indicators are most dangerous when they cluster, because each one maps to a different side of the triangle. Someone living beyond their means (pressure), who controls an entire billing cycle without oversight (opportunity), and who regularly dismisses compliance rules as bureaucratic nonsense (rationalization) is a textbook case.
How Organizations Address Each Side
The most effective detection method isn’t an audit or a software tool. It’s a tip. ACFE data from 2024 shows that 43% of occupational fraud cases were uncovered because someone reported suspicious activity, more than three times the next most common detection method.5Association of Certified Fraud Examiners. 2024 ACFE Report to the Nations That finding makes a strong case for anonymous reporting hotlines and a culture where employees feel safe raising concerns.
Prevention strategies work best when they target each side of the triangle separately.
- Reducing pressure. Employee assistance programs, reasonable performance expectations, and compensation structures that avoid all-or-nothing incentives won’t eliminate personal financial stress, but they remove organizational sources of pressure and give employees an outlet before desperation sets in.
- Eliminating opportunity. Segregating duties so no one person controls an entire transaction cycle, enforcing mandatory vacations and job rotation, requiring dual authorization for payments above a threshold, reconciling accounts on a schedule, and conducting surprise audits. These are the nuts-and-bolts controls that make fraud harder to commit and harder to hide.
- Disrupting rationalization. A clear code of conduct, consistent enforcement across all levels including senior management, transparent communication about why controls exist, and visible consequences for violations. When employees see that leadership follows the same rules, the “everybody does it” rationalization loses its power.
Beyond the Triangle: The Fraud Diamond
Cressey’s triangle has proven durable, but it has one blind spot. It assumes anyone with pressure, opportunity, and a rationalization will commit fraud. In practice, some people in that exact situation still won’t do it, and others with the same profile succeed where their peers would fail. In 2004, researchers David Wolfe and Dana Hermanson proposed adding a fourth element: capability. Their model, called the Fraud Diamond, argues that the perpetrator also needs the personal traits and positional authority to actually pull the scheme off.
Capability includes understanding how accounting systems work, holding a role with enough access and authority to exploit control weaknesses, being confident and composed enough to deceive colleagues, and having the ability to manage the stress of ongoing concealment. This addition explains why fraud tends to concentrate among employees with longer tenure and higher positions. They’ve had time to learn where the gaps are and to accumulate the access needed to exploit them. ACFE data supports the pattern: median fraud losses rise from $50,000 for perpetrators with less than one year of tenure to $250,000 for those with more than ten years.5Association of Certified Fraud Examiners. 2024 ACFE Report to the Nations
The Fraud Diamond hasn’t replaced the triangle in most compliance training and audit standards, but it is a useful correction. When assessing fraud risk, the question isn’t just whether someone has a motive, an opening, and a justification. It’s whether they also have the skill and position to actually do it.