Most fraud controls are built to catch an external bad actor: a fake invoice, a spoofed email, a fraudulent bank account change. Internal collusion is harder, because the person exploiting the control may also be the person responsible for operating it.
Why collusion evades standard controls
Segregation of duties works when no single person can both create and approve a transaction. It breaks down when two people — one on each side of that boundary — are working together. Each individual action passes review, because the review is designed to catch a single actor acting alone.
Patterns worth watching for
A few patterns show up repeatedly in confirmed internal collusion cases:
- A single approver consistently clearing the same supplier, especially just under an approval threshold that would otherwise trigger additional review.
- Supplier details that trace back to an employee — a shared address, phone number, or beneficial owner connection between a supplier and someone involved in approving payments to them.
- Unusual approval timing, such as approvals clustered outside business hours or immediately before a control deadline.
- Suppliers with minimal footprint — no verifiable registration, no other customers, no digital presence — that nonetheless clear onboarding and approval without question.
Why data-driven checks matter here
Collusion is difficult for a manual reviewer to catch because it requires connecting information across systems that don’t usually talk to each other — HR records, supplier registration data, approval logs, and payment history. This is exactly the kind of cross-referencing that’s impractical to do by hand at scale, but straightforward to automate.
Building the control
Effective collusion detection combines independent supplier verification (so a supplier’s claimed identity can be checked against external registry and banking data, not just internal records) with audit trail analysis (so approval patterns can be reviewed for anomalies, not just individual transaction legitimacy). Neither alone is sufficient — together, they close a gap that segregation of duties alone can’t.