Embezzlement and Financial Fraud Reports in Companies

Embezzlement is rarely discovered by an annual audit. It surfaces by accident: an employee goes on leave and an irregularity appears in their area, a supplier calls chasing an invoice that was in fact paid, or a float discrepancy cannot be explained. When that moment arrives, what the business does in the first few days determines — more than anything that follows — whether it will be able to prove what happened.

The most common mistake is for the owner to confront the employee immediately. The usual outcome: denial, the disappearance of anything that can be made to disappear, the loss of a traceable documentary trail, and a suspicion that no longer rests on evidence.

What an embezzlement investigation report is

It is a technical report prepared by a certified public accountant to determine whether an unlawful financial act has occurred, its magnitude, its mechanism, and the period over which it extended — based on the books, documents and bank movements, not on statements and impressions.

It differs fundamentally from an annual audit. An audit is designed to express an opinion on the fair presentation of the financial statements as a whole, at a given level of materiality, and is not designed to detect manipulation that is small in value or concealed through collusion. An embezzlement investigation works in the opposite direction: it starts from a specific indicator and follows it to its conclusion however small the amount.

Aspect	Annual audit	Embezzlement investigation
Objective	An opinion on the fair presentation of the financial statements	Establishing a specific financial event and measuring its effect
Selection method	Samples based on materiality and risk	Complete examination of the period and trail under suspicion
Output	An auditor report in standard form	A detailed report of the documentary trail, amounts and dates
Use	Users of the financial statements	The board or owners, the competent authorities, and the courts where required

Indicators that precede discovery

Embezzlement rarely starts large. It is usually preceded by a pattern of indicators read at the time as administrative untidiness:

An employee who never takes leave or refuses to delegate, particularly in roles combining recording and collection.
Bank reconciliations that are late or not prepared, or reconciling items that recur without being cleared.
Suppliers with incomplete files: no commercial registration, no address, no VAT number, and changing bank account details.
Recurring float discrepancies cleared through generic “adjustment” entries without support.
Unexplained increases in petty expenses or in a particular account without any change in activity.
Manual entries after period close, or recurring reversing entries near month end.
Deferred inventory counts, or count differences written off as depreciation or damage without investigation.
Concentration of authority in one person who records the entry, approves the payment and executes the transfer.

The most recurrent patterns

Pattern	Mechanism	Where it is detected
Diversion of receipts	Cash collection or transfer to a personal account without recording the revenue	Reconciling system revenue to bank deposits customer by customer
Fictitious supplier	Creating a non-existent supplier, issuing invoices and paying them	Examining supplier files, VAT numbers and bank account matching
Ghost employee	Adding a name to the payroll and transferring the salary	Reconciling payroll to employment files and the wage protection file
Expense inflation	Altered, duplicated or personal invoices	Examining invoice sequences and repetition of amounts and dates
Manipulating returns and discounts	Recording a return or discount that did not occur and extracting the difference	Analysing returns by user and by time
Inventory manipulation	Releasing goods without recording a sale, or treating them as damaged	Reconciling inventory movement to sales and to damage reports

What to do in the first days — and what to avoid

What to do

Secure the evidence before anything else. Back up the accounting system, preserve access and authorisation logs, and obtain complete bank statements for the whole period.
Restrict authorities quietly. Review approval and bank transfer rights without announcing the reason for the review.
Set an initial period for examination, prepared to widen it — the first event discovered is rarely the first event.
Engage an independent professional firm. An internal review by a colleague or line manager lacks independence and weakens the value of the findings later.
Document every step with its date and who performed it, because the soundness of the investigation procedures is itself open to challenge.

What to avoid

Early confrontation. The single largest cause of evidence loss.
Relying on a verbal admission without documentary support that stands on its own.
Deleting or amending entries to “tidy” the accounts before the investigation.
Settling the matter with an accounting entry that conceals the event rather than recording it.
Delay. Every additional month means more transactions, documents that are harder to retrieve, and balances that are harder to preserve.

What makes the report usable

An unbroken documentary trail for every amount: from the entry, to the document, to the bank movement, to the beneficiary.
A quantified schedule of dates and amounts that can be re-added to the same total.
An express separation between what the documents establish and what is inferred from circumstances.
A statement of scope and limitations: the period examined and any documents not made available.
Confinement to the financial dimension, without legal characterisation of the event — that is for another forum.
Neutrality of language. The report presents what was found; it does not advocate.

After the report: the options

The findings open several routes, and more than one may be pursued at once: recovery of the amounts, statutory action in respect of the employee, referral to the competent authorities, an insurance claim where fidelity cover exists, and correction of the financial statements for affected periods where the effect is material.

Selecting the right route — and sequencing the steps between them — is a decision taken after the numerical picture is complete, not before, and with legal advice alongside the accounting advice.

Prevention: controls that do not require an expensive system

Segregation of duties: whoever records the entry does not approve the payment, and whoever approves does not execute the transfer.
Monthly bank reconciliation reviewed by someone other than its preparer.
Mandatory leave for sensitive finance roles, with an actual handover of duties.
A complete supplier file before the first payment, with any change of bank details approved through an independent channel.
Periodic reconciliation of payroll to employment files and the wage protection file.
Monthly review of unusual manual entries, particularly those recorded near period close.
An internal audit function, even of limited scope — its existence alone changes how controls behave.

Frequently asked questions

Does an annual audit detect embezzlement?

Not necessarily. An audit expresses an opinion on the fair presentation of the financial statements as a whole at a given level of materiality and relies on sampling, whereas manipulation may be small in value or concealed through collusion. An embezzlement investigation starts from a specific indicator and examines the trail under suspicion in full.

What should be done first when embezzlement is suspected?

Secure the evidence before anything else: back up the accounting system, preserve access and authorisation logs, and obtain complete bank statements for the whole period. Then restrict authorities quietly and engage an independent professional firm. Do not confront the employee beforehand.

Why is early confrontation discouraged?

Because it is the single largest cause of evidence loss. The employee denies the allegation, anything that can be made to disappear does, and the documentary trail becomes untraceable — leaving a suspicion that cannot be proven.

How long does an embezzlement investigation take?

It depends on the length of the period examined, the volume of transactions, the quality of available documentation, and the number of suspected trails. The scope itself may widen during the investigation, because the first event discovered is rarely the first event to have occurred.

Is an embezzlement report usable in court?

It is usable to the extent that it rests on an unbroken documentary trail for every amount — from entry, to document, to bank movement, to beneficiary — expressly separates what the documents establish from what is inferred, states the scope and limitations of the examination, and confines itself to the financial dimension without legal characterisation.

What are the simplest controls to prevent embezzlement?

Segregation of duties so that no one person records the entry, approves the payment and executes the transfer; monthly bank reconciliation reviewed by someone other than its preparer; mandatory leave for sensitive finance roles with an actual handover; a complete supplier file before the first payment; and monthly review of unusual manual entries near period close.

How we can help

At Almousa & Altamimi, Certified Public Accountants and Auditors we investigate embezzlement and financial manipulation on a documentary basis: securing evidence, defining scope, tracing the trail from entry to beneficiary, and issuing a detailed report usable before the board, the competent authorities or the courts — together with an assessment of the control failures that allowed the event and how to remediate them.

Speed is decisive here. See our fraud and misconduct reports service, or contact us before taking any action in respect of the employee. For how courts treat accounting reports, see our guide to the accounting expert report before the commercial court.

Quick reference: Glossary · FAQ

This content is general guidance on the professional approach to investigating embezzlement and financial manipulation. It is not a substitute for professional or legal advice on a specific case and does not constitute a legal opinion. Last updated: 14 September 2026.

The legal framework: what exactly is criminalised

The Anti-Financial Fraud and Breach of Trust Law separates two situations that are frequently conflated in practice, and the distinction changes both the route of the complaint and the methodology of the examination:

Fraud (Article 1): taking another’s money without right by one or more acts involving any means of fraud, including lying, deception or misleading. Penalty: imprisonment of up to seven years and a fine of up to SAR 5 million, or either of them.
Breach of trust (Article 2): taking without right money delivered to the offender by virtue of their work or by way of trust, partnership, deposit, loan for use, lease, pledge or agency, or disposing of it in bad faith, or deliberately causing damage to it, other than public money. Penalty: imprisonment of up to five years and a fine of up to SAR 3 million, or either of them.
Incitement, agreement and assistance (Article 3): punished up to the maximum penalty where the offence takes place, and up to half the maximum where it does not.
Attempt (Article 4): up to half the maximum penalty prescribed for the completed offence.
Aggravation (Article 5): the penalty is not less than half its maximum and not more than double it where the offence is committed through an organised gang or in the case of recidivism.
Confiscation (Article 6): the tools and instruments used and the proceeds are confiscated by judicial order, without prejudice to the rights of a bona fide third party.

In most corporate cases the closer description is breach of trust rather than fraud, because the money was already in the offender’s hands by virtue of their work. That determines what the report must establish: not merely that money is missing, but that specific money was delivered to a specific person in a specific capacity, and then taken or disposed of in bad faith.

Sources

Anti-Financial Fraud and Breach of Trust Law — Articles 1–6
Labour Law — Article 80 (termination without award or notice and the 24-hour reporting condition) and Article 69 (the thirty-day limit for accusing an employee)
Companies Law (Royal Decree M/132) — Articles 26–29 (duties of care and loyalty, the prohibition on exploiting company assets, management liability, and the company’s action)
Evidence Law — Chapter Ten: Expert Evidence (Article 117 on the contents of the expert report)