In 2025, the NBA was rocked by an illegal gambling scandal. It is not at all the focus of this article, but it helps make the point I want to make off the top. To summarize, there were a handful of guys allegedly doing questionable, illegal things. To be clear – I am not suggesting any of these guys are guilty. I don’t know all the circumstances, so I want to avoid passing judgement. But ASSUMING there is some truth to the allegations, there were some guys that provided information about players that could affect the outcome of the basketball games being played. Some of these guys were players that could actually affect the outcome themselves; others were people around the teams that had access to confidential information that they could share with people outside of the organization. Here’s my point: let’s say the number of people involved was five (for the record, there were more than five people listed but for the sake of this article, let’s keep it simple). For the sake of consistency, let’s say there are 1,000 people in similar positions as these guys throughout the entire NBA (again, on the low side). That is 1%. Said differently, 99% of the league is not participating in this activity.

Here’s my point, my gut feeling is that 99% of folks are not trying to commit fraud. There is research that supports my position. The Association of Certified Fraud Examiners estimates that less than 1% of employees in a typical organization are ever involved in a material fraud case. While many fraud cases are small, a few large ones account for the majority of losses. Past studies have demonstrated that when presented with a hypothetical fraud scenario, 85-90% of people will not act, even if they believe they could get away with it, often because of personal ethics or cultural norms. Over 40% of irregularities reviewed by auditors turn out to be honest errors, not fraud. That number jumps up to approximately 90% if considering issues resulting from internal control issues compared to intentional fraud efforts. All that data to say this – most people are not coming to work looking for opportunities to be fraudulent. So why would we work so hard to identify and mitigate the risk?

In a session I presented on fraud (where we talked about Travis Kelce and Taylor Swift, by the way… fun times!), I suggested regulators should be leveraging data to identify metaphoric smoke, then investigate the smoke to be sure they don’t have any metaphoric fires. I realized after that presentation how much time and resources I was suggesting they put into these exercises. It’s a lot. However, I stand by it. Internal controls are not in place to “catch” fraud – they are intended to be guardrails that protect the honest 99%. Adding extra layers of control to discover smoke and fire provides a culture, clarity, and fairness to further prevent more fraud than simple suspicion ever will. When these layers depend primarily on data, it immediately becomes even more effective. This protects the trustworthy employees and promotes an environment in which they want to work. We are protecting the majority, not targeting the minority!

It really comes down to finding the right balance. If we over-control, we frustrate the good employees that just want to make an honest living. Obviously, under-control leads to opportunities for bad actors. Finding the balance between effective controls, trusting employees, and accountability is the “magic formula”. If there were a scientific way to figure this out, someone would have figured it out and wrote a book about it already. To my knowledge, that book does not exist. I would argue this is a fluid process. Things change all the time. If our “formula” is not updated accordingly, our risks are increased. As staff changes, your level of trust will naturally change as well. Leadership should provide accountability, but leadership has the human element. The human element is unpredictable because life is unpredictable. Adjusting controls to account for the trust and accountability variances while maintaining the balance of culture and morale is the most effective way to prevent fraud.

Fraud response is critical to the ongoing success of any organization. But it’s a response aimed at the minority of staff. It should not be a proactive attack to all employees. Organizations will determine what they need to respond to by analyzing data and gathering facts, not chasing suspicion or personal agendas. When we protect the people that are doing the right thing, we inevitably will catch people trying to do the wrong thing!