Recognizing a Pattern Before Evidence Disappears You suspect money or property is leaving your Michigan business, but the records do not yet explain how. Here are the behavioral, ledger, vendor and inventory warning signs that may justify an anti fraud investigation. A single discrepancy may be an error. Repeated anomalies connected to the same employee, vendor or approval path deserve closer attention. The aim is not to decide guilt from a red flag. It is to recognize when an objective inquiry is needed before records are changed, routine deletion cycles run or financial losses continue. Behavioral Shifts: Unexplained Lifestyle Inflation and Control Guarding Behavior alone does not prove theft. It becomes more relevant when a noticeable change appears alongside accounting or control problems. According to the Association of Certified Fraud Examiners , living beyond apparent means appeared in about 39% of the occupational fraud cases it studied. Watch for an employee whose visible spending changes sharply without an obvious explanation, especially if that person handles cash, payments, payroll or vendor records. Treat the lifestyle change as context, not a conclusion. Personal debt or a family change can produce similar signs. Control guarding is often more useful operationally. An employee may refuse to share duties, resist cross-training, avoid taking leave or become unusually defensive when another person reviews the work. They may insist that only they understand a vendor relationship or accounting process. That conduct matters when it prevents normal oversight. Apply established controls consistently. Require scheduled leave where company policy permits it, rotate review duties and have an independent employee reconcile accounts. Do not accuse or confront the person based only on behavior. An early confrontation can prompt evidence destruction or create avoidable employment issues. Ledger Anomalies: Manual Write-Offs and Transactions Clustered Below Approval Limits Your general ledger may reveal a scheme before anyone reports misconduct. Review manual journal entries made outside the usual closing schedule, near reporting deadlines or by employees whose normal duties do not include adjustments. Accounts receivable write-offs also need supporting records. A recurring bad-debt adjustment may conceal diverted customer payments or a lapping scheme. Inventory write-downs can hide missing goods. Compare each adjustment with the credit memo, customer history, approval record and original transaction. Missing support is more significant when the same user repeatedly posts and approves the entry. Approval limits create another useful test. Export transactions immediately below your company’s sign-off thresholds and examine repeated payments near, but below, those amounts. Check whether one invoice was split into several payments or purchase orders to avoid review. Also compare the ledger with bank statements and subsidiary records. Unexplained differences and blanket descriptions can indicate manipulation. Preserve the native accounting data and audit logs rather than relying only on printed reports or screenshots. Procurement and Disbursement Red Flags: Ghost Vendors and Routing Shifts Accounts payable problems often hide inside records that appear routine. Start with the vendor master file. Compare vendor addresses, telephone numbers and payment details with employee and payroll data. An overlap does not establish fraud, but it can expose an undisclosed relationship or a vendor created to receive false payments. Review suppliers that use only a post office box, lack a verifiable operating address or receive payments despite thin business records. Check public business registrations and identify who approved the vendor. A new supplier repeatedly selected by one manager without normal comparison or onboarding deserves scrutiny. Payment-routing changes require separate verification. If a vendor sends new bank instructions, confirm the change through a known contact using information already held in your records, not the telephone number supplied in the change request. Preserve the request, approval trail and system log showing who changed the vendor profile. Other warning signs include duplicate invoice numbers and altered invoices. Search for duplicates after removing harmless formatting differences such as spaces or dashes. Then compare the invoice with the purchase order, receiving record and proof that the goods or services were delivered. Physical Asset Discrepancies and Systemic Gaps in Source Paperwork Missing stock becomes more concerning when the losses concentrate around a product, shift, location or employee access window. Compare physical counts with inventory records, shipping data, returns and write-off activity. Repeated shortages outside the business’s normal shrinkage pattern can point to theft or falsified receiving records. Source paperwork helps distinguish a weak process from intentional con