Chapter 75: Employees and Internal Controls: The Weakness Within

Throughout many years of professional activity in boardrooms and courtrooms, I have seen a variety of cases. I have seen sophisticated hackers breaching firewalls built with massive investments, international fraudsters posing as senior officials, and phishing networks hunting for victims on social media. Yet, there is one type of fraud that always leaves a particularly bitter taste—one that stems not just from the financial loss, but from the crumbling of the most fundamental value upon which any human system relies: trust.

When we talk about business fraud, our minds tend to wander outward. We imagine an "attacker" located somewhere in cyberspace. But this chapter deals with the most tangible, immediate, and painful threat—the threat from within the house. The dedicated employee who arrives first at the office, the bookkeeper who remembers everyone’s birthday, or the procurement manager whom everyone trusts. This is a chapter about internal fraud and the structural failure in organizational controls, a place where human psychology meets technical vulnerabilities.

The Voice Inside the House: When Trust Becomes a Weapon

In the book "Have You Been Scammed?", it is emphasized that fraud is not just a matter of technology, but of psychology. In the business world, trust is the fuel that keeps the wheels turning. Without a certain degree of trust in employees, a business cannot function. It is impossible to check every line on an invoice or track every keystroke on a computer. And this trust, which is essential for growth, is also a potential point of vulnerability for the organization.

Employee fraud, or "embezzlement," is one of the most challenging phenomena in the business sector. According to international data from the Association of Certified Fraud Examiners (ACFE), organizations can lose a significant portion of their annual revenue as a result of fraud. In most cases, a long time passes before the fraud is discovered. Why? Because the embezzling employee knows the system well. They may know where the loopholes are, who approves payments automatically, and which drawer in the warehouse is never counted.

But before we turn to the legal and technical analysis of prevention, it is worth understanding what this might look like in reality. How can a normative person become someone who harms their employer’s livelihood?

The following scenario is an educational example based on common fraud patterns. The characters and events are for illustration purposes only.

The Story of "North Optics" and the Rise of Danny

"North Optics" was a chain of five branches with a logistics center. The business owner, Michal, relied on Danny, who had served as the company’s accountant for many years. He was considered part of the organic fabric of the business, managed relationships with banks, and projected a sense of total control over the data. Danny was an employee who never took long vacations and was always the last one in the office—a situation that in certain scenarios may serve as a warning sign in the world of internal auditing, as it prevents others from examining his position of control.

In this scenario, the change in Danny began following personal financial pressures. Danny found himself going over the supplier list of "North Optics" and identified a supplier that was no longer active in the system. The first action was changing the bank account details of the inactive supplier to a different bank account under his control, and generating a fictitious invoice for thousands of shekels for "consulting services." As the accountant who approves the invoices, the money moved without difficulty.

Over time, the method was perfected. Danny began making "overpayments" to real suppliers, and then asked them to return the credit to a different bank account that he controlled. He learned the habits of check signing and slipped payments intended for him among them. The amounts gradually increased.

In this scenario, the crisis arrived when it was decided to implement a new ERP system for inventory and financial management. An external consultant who sought to reconcile data discovered inconsistencies. Upon a thorough examination of the office, documents were found that raised suspicion of forgery, along with financial reports that did not reflect reality. In such a case, after examining the evidence, the parties may discover that millions of shekels in damages had accumulated over the years.

The Anatomy of Embezzlement: The Fraud Triangle and the Loophole Calling the Thief

The case described represents a pattern often called "The Fraud Triangle." For an employee to commit fraud, three elements must usually coexist simultaneously:

1. Pressure

This is the motive. Usually, it involves hidden financial pressure: debts, family financial difficulties, or the desire to maintain a standard of living that does not match one's income. Pressure is the factor that may lead a normative person to cross the line.

2. Opportunity

This is where organizational responsibility comes into the picture. Opportunity is created when internal controls are weak. If one person has exclusive control over the entire payment chain—from entering the supplier to executing the payment—an opportunity exists. In many offices, "segregation of duties" is often waived, and this is a significant loophole.

3. Rationalization

This is the psychological component. Fraud perpetrators may tell themselves a story that justifies their actions: "I'm only borrowing the money," "I deserve a higher salary," or "This is compensation for overtime." Rationalization allows them to continue functioning as regular employees while harming the company.

Between Criminal and Civil: Analyzing Legal Options

When a suspicion of embezzlement arises, the employer may face an emotional and legal storm. The question arises of how to act to recover funds. It is important to understand the existing legal options.

Theft by an Employee – The Criminal Aspect

The Penal Law, 1977, treats offenses committed by an employee against their employer with severity. Section 391 of the law mandates severe punishment in cases of theft by an employee from their employer, due to the violation of the special value of trust between the parties. Filing a police complaint is a possible step, but it focuses on the punitive aspect and not necessarily on financial compensation.

The Civil Route and Interim Remedies

In the civil sphere, the goal is to attempt to stop the concealment of assets. One can consider filing a civil claim and applications for urgent interim remedies, such as attachment orders on bank accounts or property, subject to legal limitations. Sometimes it is possible to request orders allowing the seizure of evidence to prevent the destruction of digital materials.

Liability of Other Parties

A question that sometimes arises is whether liability can be imposed on other parties, such as the banking system. The answer depends on the circumstances and is not simple. One can examine whether a duty of care was met and whether the bank ignored clear warning signs. However, when it comes to an employee with legal authorization, financial institutions may be protected. Each case is examined on its own merits according to its special circumstances.

Employee Rights in Light of Embezzlement

A sensitive issue is the denial of severance pay. The Severance Pay Law allows the labor court to examine the denial of severance pay under certain circumstances. However, the employer cannot act unilaterally and arbitrarily. There is a regulated procedure, and the courts examine the balance between the severity of the act and the employee's social rights. Options for offsetting proven debts can be considered, subject to legal proof.

Building Walls Within the Office: Controls for Risk Prevention

To reduce the risk of internal fraud, it is recommended to adopt a corporate culture and clear work procedures:

1. Segregation of Duties

This is a fundamental rule in internal control. It is desirable that the person ordering goods should not be the same person who approves the payment, and that the person recording the transaction should not perform the bank reconciliations. In small businesses, periodic external audits can be utilized.

2. Supplier Approval Procedure

It is recommended not to allow changes to a supplier's bank account details or the creation of a new supplier without dual approval. In the case of a request to change details, it is mandatory to verify this with the supplier using an official and known communication method.

3. Mandatory Vacations

Requiring employees with access to funds to take continuous annual leave, during which another party fills their role, is an effective tool. Many frauds require daily "maintenance" of concealment that may be exposed in the absence of the perpetrator.

4. Digital Access Management

One must ensure the use of personal authorizations only and the use of two-factor authentication (2FA). Setting alerts for unusual activities or transactions above a certain amount may assist in real-time monitoring.

5. Periodic Audits

In addition to the regular annual audit, one can conduct surprise spot checks at points of vulnerability such as procurement, inventory, and expense reimbursements.

Red Flags

There are behavioral and organizational signs worth paying attention to:

• An employee who consistently avoids taking vacations or delegating authority.
• A noticeable and unexplained change in an employee's standard of living.
• An employee who is in significant financial difficulty.
• Unusual unofficial relationships between an employee and certain suppliers.
• Recurring discrepancies in inventory reports or the cash register.
• Significant resistance to the implementation of new control systems.

What Can Be Done When a Suspicion of Embezzlement Arises?

1. Careful Information Gathering: It is recommended to collect evidence and relevant documents in a quiet and professional manner, while adhering to the legal provisions regarding privacy.
2. Professional Consultation: Contacting an attorney specializing in this field to build a proper legal strategy.
3. Assessing the Scope of the Event: Utilizing professionals such as forensic accountants to estimate the damage and prepare the evidentiary basis.
4. Checking Insurance Coverage: Reviewing the business’s insurance policies and reporting according to their terms.

Legal Aspect and Summary

Internal frauds damage the foundation of the organization. While the law provides tools for dealing with them—from the criminal level to tort claims and unjust enrichment—the path to recovering funds depends on many circumstances. Courts require a high standard of proof in cases of fraud, and one must balance the protection of the employer's property against the employee's rights.

At the end of the day, building a system of checks and balances is part of responsible management. A business that protects itself from within reduces risks and maintains the integrity of its employees. As emerges from the professional experience accumulated over the years, prevention and control are essential tools in the complex business space. The chance for recovery of funds and proper management of the incident depends to a large extent on the speed and thoroughness of the action from the moment the suspicion is discovered.