The fraud triangle is a framework from criminology that explains why otherwise trusted employees commit financial crimes. It identifies three conditions that appear together in virtually every embezzlement case: perceived pressure, perceived opportunity, and rationalization. When all three line up in the same person at the same time, the risk of fraud becomes acute. The model has shaped modern auditing standards in the United States and remains the starting point for most forensic investigations of occupational fraud.
Where the Framework Came From
Criminologist Donald Cressey developed the underlying hypothesis in the 1940s while interviewing 133 convicted embezzlers across three federal prisons. He published his findings in 1953 in Other People’s Money: A Study in the Social Psychology of Embezzlement. His study population was exclusively male, drawn from an initial pool of 503 inmates who potentially qualified as embezzlers.1University of Portsmouth. Deconstructing the Origins of Cressey’s Fraud Triangle
Cressey’s core finding was deceptively simple. People in positions of trust become violators when they face a financial problem they believe they cannot share with anyone, recognize that their access allows them to solve it secretly, and talk themselves into believing the act is justified. Cressey himself never used the phrase “fraud triangle.” That label was applied later by other researchers and practitioners who distilled his hypothesis into the three-element visual that auditors rely on today.1University of Portsmouth. Deconstructing the Origins of Cressey’s Fraud Triangle
Perceived Pressure
The first element is what gets things moving. Every embezzler Cressey studied was dealing with a financial problem they felt they could not disclose. The key word is “non-shareable.” The problem itself might be objectively solvable, but the person experiencing it believes that admitting it would cost them their reputation, their marriage, or their career.
These pressures often stem from personal financial distress. Credit card interest rates now average nearly 24%, with borrowers who have poor credit paying as much as 36%, creating debt spirals that feel impossible to escape through normal income. Gambling losses, medical bills, or a sudden drop in household income can produce the same desperation. The common thread is that the person has exhausted what they see as legitimate options and feels trapped.
Corporate incentive structures create a separate category of pressure. When an executive’s bonus depends on hitting a quarterly revenue target, the temptation to manipulate the numbers intensifies with each missed forecast. The executive views a restatement or a missed target as a personal catastrophe, and that fear drives the initial step toward fraud. Under SEC rules adopted in 2023 pursuant to the Dodd-Frank Act, companies listed on major exchanges must now maintain clawback policies to recover incentive-based compensation from executives when financial restatements occur, so the stakes for getting caught have risen considerably.
Behavioral Red Flags of Pressure
Pressure rarely announces itself, but it leaves traces. According to the Association of Certified Fraud Examiners, the two most common behavioral red flags across every study since 2008 are living beyond one’s means and financial difficulties.2ACFE Insights. The 6 Most Common Behavioral Red Flags of Fraud An employee who suddenly starts wearing expensive clothes, buying a new car, or taking lavish vacations on a modest salary may be signaling that illicit funds are flowing. On the other side, an employee who seems chronically stressed about money, avoids financial conversations, or refuses to take vacation (because they fear someone will discover irregularities in their absence) is exhibiting classic warning signs.
Perceived Opportunity
Pressure alone does not produce fraud. The person also needs to believe they can pull it off without getting caught. This is where organizational weaknesses become dangerous. In Cressey’s framing, the opportunity must be specific to the person’s position of trust, not just a general awareness that fraud happens.
The most common structural flaw is a lack of separation between duties. When the same person can create a vendor in the accounting system, approve invoices, and sign checks, the door is wide open. Sound internal controls require that no single individual handles all stages of a transaction. Recording, approving, holding custody of assets, and reconciling accounts should each fall to different people. When staffing constraints make full separation impractical, the organization needs to compensate with heightened management oversight and regular rotation of key responsibilities.
Poor oversight compounds these gaps. An employee who notices that expense reports under a certain dollar threshold are rubber-stamped will eventually test that boundary. Shared passwords, unsecured digital signature files, and infrequent audits all send the same message: nobody is watching closely. The person who is already under financial pressure begins cataloging these gaps as part of their daily routine, quietly calculating the odds of detection. Technical controls like multi-factor authentication on financial systems can narrow the window of opportunity significantly by ensuring that stolen credentials alone are not enough to authorize transactions.
Rationalization
The third element is the most psychologically interesting. Most people who commit occupational fraud do not see themselves as criminals. They need a story that lets them preserve their self-image as a decent person, and they construct that story before the act, not after.
The most common rationalization is the “temporary loan.” The person tells themselves they will repay the money as soon as their financial situation improves. They are not stealing; they are borrowing. Another frequent justification is entitlement. An employee who feels underpaid relative to their contributions may frame the theft as a long-overdue correction. A third variation is minimization: the company is so large and profitable that a few thousand dollars will never be noticed, so no one is truly harmed.
What makes rationalization so dangerous is that it works. People who would never shoplift a pair of shoes can convince themselves that diverting company funds is fundamentally different. They compartmentalize the act, function normally in their professional and social lives, and often grow more confident over time. That confidence tends to increase the size and frequency of the theft until something external finally triggers detection.
Later Expansions: The Fraud Diamond and Fraud Pentagon
Cressey’s three elements have proven durable, but later researchers argued they do not tell the whole story. In 2004, David Wolfe and Dana Hermanson proposed adding a fourth element, “capability,” creating what is now called the fraud diamond. Their argument was straightforward: even when pressure, opportunity, and rationalization are all present, the fraud will not happen unless the person has the traits and ability to execute it. Capability covers factors like the person’s position within the organization, their understanding of internal control weaknesses, their ability to manage stress under scrutiny, and their skill at deception.3The CPA Journal. The Fraud Diamond
In 2010, Jonathan Marks of Crowe Horwath expanded the model further by adding a fifth element: arrogance. The resulting fraud pentagon recognizes that some perpetrators do not need to rationalize their behavior at all. They operate from a sense of superiority and entitlement, believing that internal controls simply do not apply to them. Arrogance is distinct from rationalization because the person does not believe they need a justification in the first place.4MDPI. The Use of the Fraud Pentagon Model in Assessing the Risk This element shows up most often in cases involving senior executives who have the authority to override controls and the ego to assume they are untouchable.
How Auditors and Investigators Use the Triangle
The fraud triangle is not just a teaching tool. It is embedded in the auditing standards that govern financial statement audits in the United States. PCAOB Auditing Standard AS 2401, which reorganized and superseded the older AU Section 316 effective December 31, 2016, requires auditors to specifically assess the risk of material misstatement due to fraud.5Public Company Accounting Oversight Board. Consideration of Fraud in a Financial Statement Audit The standard directs auditors to look for conditions corresponding to each element of the triangle: incentives or pressures that might motivate fraud, opportunities arising from weak controls, and attitudes or rationalizations that might allow management or employees to commit it.
Under AS 2401, the primary responsibility for designing controls that prevent, deter, and detect fraud rests with management and the audit committee, not the auditor.5Public Company Accounting Oversight Board. Consideration of Fraud in a Financial Statement Audit When an auditor finds evidence suggesting fraud may have occurred, they must communicate the findings to appropriate levels of management and the audit committee. The triangle drives the risk assessment, and the risk assessment determines where the auditor focuses testing.
Forensic accountants apply the same framework after fraud has been discovered, but their objective shifts from risk assessment to evidence building. They look for documentation that establishes criminal intent. The ACFE’s 2024 Report to the Nations found that 43% of occupational fraud cases were initially detected by tips, more than three times the rate of any other detection method.6ACFE. ACFE Report to the Nations Over half of all cases were attributed to either a lack of internal controls or an override of existing ones, reinforcing how central the opportunity element is to real-world fraud.
Using the Triangle to Prevent Fraud
Of the three elements, opportunity is the one an organization can directly control. Pressure comes from an employee’s personal circumstances, and rationalization happens inside their head. Opportunity is a function of how the organization designs its processes, which is why prevention efforts focus heavily on closing control gaps.
The fundamental principle is straightforward: no single person should be able to initiate, authorize, record, and reconcile the same transaction. Practical steps that reinforce that principle include:
- Documenting responsibilities so that it is clear who initiates, approves, processes, and reconciles each financial activity, making overlaps visible and fixable.
- Rotating duties like bank reconciliation and transaction approval on a regular schedule, which both deters fraud and cross-trains staff so one irreplaceable person never controls a critical process.
- Increasing direct management review of transactions in smaller organizations that cannot fully divide duties among separate people.
- Requiring multi-factor authentication for high-value fund transfers and system-level changes, so a stolen password alone cannot authorize a transaction.
Culture matters as much as controls. Because tips are the single most effective detection method in the ACFE data, organizations that invest in anonymous hotlines and treat reporting as a normal part of the job directly attack the opportunity element by making perpetrators less confident they can operate undetected. The fraud triangle predicts secrecy; a workplace where employees feel safe speaking up is the counterweight.