Red Flags
| Fraud red flags | |
|---|---|
| Also called | Fraud risk factors; indicators |
| Categories | Financial, behavioral, documentary, accounting-record |
| Standards lineage | SAS 53 → 82 → 99 (AU-C 240) |
| Key caution | Indicators, not proof |
Red flags are warning signs, anomalies, patterns, or circumstances that indicate an elevated risk that fraud has occurred or is occurring. A red flag is an indicator, not proof: its presence establishes suspicion and predication for further inquiry, but many red flags have innocent explanations. The discipline of recognizing and interpreting them is central to forensic accounting, to auditing, and to fraud prevention, and it connects directly to the fraud triangle: red flags are the observable surface traces of pressure, opportunity, and rationalization.[1] A pressure such as personal debt may surface as behavioral flags (a lifestyle beyond apparent means); an opportunity such as weak controls surfaces as accounting-record flags (unexplained adjustments); and the act of concealment surfaces as documentary flags (missing originals). Fraud is rarely announced by a single unambiguous sign; it is inferred from a constellation of smaller anomalies that, taken together, are hard to explain innocently.
1 Categories of red flags
Practitioners commonly sort red flags into four families:[2]
- Financial (analytical) — anomalies in the numbers and their relationships, surfaced by analytical review: unusual ratios, out-of-line trends, and figures that defy business logic.
- Behavioral (lifestyle) — conduct and circumstances of individuals, such as living beyond apparent means or refusing to take vacations.
- Documentary — irregularities in source documents and records: missing originals, alterations, duplicates, and photocopies where originals should exist.
- Accounting-record (internal-control) — irregularities within the books and control environment: unexplained adjustments, override of controls, and reconciliations that never balance.
2 Examples by category
| Category | Example red flags | Fraud-triangle link |
|---|---|---|
| Financial / analytical | Revenue rising while cash from operations falls; receivables or inventory growing far faster than sales; gross margins out of line with peers; digit distributions that violate Benford's Law; earnings suspiciously smooth quarter to quarter (cookie-jar reserves) | Opportunity / pressure |
| Behavioral | Living beyond one's means; known financial difficulties; unusually close ties to a vendor or customer; unwillingness to share duties or take vacation; defensiveness or irritability when questioned | Pressure / rationalization |
| Documentary | Missing original documents (only photocopies available); altered dates or amounts; duplicate or sequential invoice numbers from one vendor; vendor address matching an employee's; documents that cannot be located on request | Concealment of opportunity |
| Accounting-record / control | Unexplained top-side or round-number journal entries near period-end; frequent adjusting entries reversing the next period; management override of controls; poor segregation of duties; reconciliations chronically out of balance; a single person dominating a process | Opportunity |
Many of these financial and record-level indicators are exactly the anomalies that analytical methods and risk-based journal-entry testing are designed to surface, while behavioral flags such as living beyond one's means are among the most frequently observed warning signs in ACFE occupational-fraud data.[3]
3 SAS 99 lineage
In U.S. auditing, the formal catalog of red flags, called fraud risk factors, evolved through a lineage of Statements on Auditing Standards, each of which broadened the auditor's fraud responsibilities and lengthened the list of indicators to consider.[1]
- SAS 53 (1988) — "The Auditor's Responsibility to Detect and Report Errors and Irregularities." An early, relatively narrow articulation of the auditor's duty, associated with a shorter set of risk factors.
- SAS 82 (1997) — "Consideration of Fraud in a Financial Statement Audit." Reframed the responsibility explicitly around fraud and expanded the enumerated risk factors.
- SAS 99 (2002) — the post-Enron replacement, retaining the same title as SAS 82 but reorganizing fraud risk factors around the three legs of the fraud triangle (incentives/pressures, opportunities, attitudes/rationalizations) and adding requirements such as engagement-team brainstorming and mandatory journal-entry testing. SAS 99 is now codified as AU-C 240.
Across this progression the number of enumerated risk factors grew substantially, a lineage often summarized as an expansion from roughly 14 to 25 to 42 flags as the standards moved from SAS 53 through SAS 82 to SAS 99.[1] The value in reciting the lineage is not the exact counts, which vary by how one tallies them, but the trajectory: successive standards recognized more indicators and tied them ever more explicitly to fraud theory.
4 Interpreting red flags
The cardinal rule is that red flags raise questions, they do not answer them. A single indicator, or even several, may reflect legitimate business conditions, a struggling but honest company, an eccentric but honest employee, or sloppy but non-fraudulent bookkeeping. Acting on red flags therefore demands professional skepticism balanced by fairness: the examiner develops hypotheses, gathers corroborating evidence, and preserves a defensible chain of custody before drawing conclusions.[2] Research on practitioners' perceptions of red flags shows that experienced auditors weight indicators differently and that no fixed checklist substitutes for judgment.[3] Properly used, red flags are the entry point of the investigative process, converting a vague suspicion into a focused, evidence-driven forensic examination that can culminate in a defensible report.
Two failure modes bracket the practice. Under-reaction ignores clustered indicators, allowing schemes to run for the twelve-month median (or longer) documented in the ACFE occupational-fraud data, with losses compounding the whole time. Over-reaction treats every anomaly as guilt, damaging morale, exposing the organization to defamation and wrongful-termination claims, and squandering scarce investigative resources on false positives. The mature approach is proportionate escalation: log the indicator, corroborate discreetly, widen the inquiry only as evidence accumulates, and involve counsel before any accusatory step. Automation increasingly assists this triage, continuous-monitoring systems and data-analytic routines flag statistical outliers at scale, but a human examiner must still supply the judgment that separates a genuine red flag from ordinary business noise. In this sense red flags are less a checklist than a habit of disciplined skepticism applied consistently across the financial, behavioral, documentary, and accounting-record domains.
See also: Fraud Triangle, Analytical Methods, Financial Statement Fraud, Occupational Fraud.
References
- AICPA Statements on Auditing Standards No. 53 (1988), No. 82 (1997), and No. 99 (2002; AU-C 240); see Colbert, J. (2007), "What the 10 New Auditing Standards Mean for Forensic Accountants," Forensic Examiner 16(4).
- Houck, M., et al. (2006). "Forensic Accounting as an Investigative Tool." CPA Journal 76(8); general principles summarized in Dwiputri (2025), Fraud and Forensic Accounting.
- Moyes, G. D. (2008). "CPAs' Perceptions of Red Flags Used in Detecting Fraud." Icfai Journal of Audit Practice 5(1); ACFE (2024), Occupational Fraud 2024: A Report to the Nations. acfe.com