By Joey N. Friedman, CPA, ABV, MAcc, MIB — President, Joey Friedman CPA PA. This article is published by Joey Friedman CPA PA, a Florida professional association. All forensic accounting, business valuation, expert witness, and litigation support services described herein are provided by Joey Friedman CPA PA. Mr. Friedman’s professional credentials and experience are exercised in his capacity as an officer, agent, and licensed CPA practicing under and on behalf of Joey Friedman CPA PA.
Quick Answer
Asset misappropriation is the theft or misuse of an organization’s resources by an employee, owner, or fiduciary — the most common occupational fraud scheme. Examples include cash skimming, check tampering, ghost employees, fictitious vendors, and inventory theft. A forensic CPA detects asset misappropriation by reviewing bank reconciliations, vendor master files, payroll records, and inventory variances for red-flag patterns, then traces flows to quantify the loss and document the scheme for prosecution, insurance recovery, or shareholder dispute.
Asset misappropriation is the most common form of occupational fraud — and also the easiest to overlook. It rarely arrives in one large event. It accumulates through small, repetitive patterns that look normal in isolation but signal something different when you study them over time.
This article is a field guide for the people who need to recognize, investigate, and respond to asset misappropriation: business owners, audit committee members, in-house counsel, and the attorneys who advise them. It covers the most common schemes, the diagnostic patterns, and the practical steps for investigating when suspicion arises.
What Asset Misappropriation Is
Asset misappropriation, in the most common framing used by the Association of Certified Fraud Examiners (ACFE), is the theft or misuse of an organization’s assets — typically by employees, but sometimes by officers, directors, vendors, or others with access.
The ACFE’s Report to the Nations groups asset misappropriation into three primary categories:
Cash misappropriation. Theft of cash, checks, or other negotiable instruments before or after they enter the organization’s accounting records.
Inventory and other asset misappropriation. Theft or misuse of inventory, equipment, intellectual property, or other non-cash assets.
Fraudulent disbursements. Causing the organization to make payments for false or improper purposes — billing schemes, payroll fraud, expense reimbursement fraud, check tampering, and register disbursements.
In dollar terms, financial statement fraud causes the largest individual losses, but asset misappropriation is by far the most frequent fraud category in U.S. organizations.
Common Schemes
Cash Skimming
Cash is taken before it is recorded in the accounting system. Skimming typically happens at the point of sale or upon receipt:
- A cashier takes cash from sales and doesn’t record the sale
- A bookkeeper deposits checks from customers but keeps cash receipts off the books
- A driver collects payment from customers and reports a “no payment received” status
Skimming is among the hardest schemes to detect because the asset never enters the records. Detection typically requires comparing reported revenue to operational metrics (sales volume, foot traffic, inventory levels) that should correlate.
Cash Larceny
Cash is taken AFTER it’s been recorded — typically from petty cash, register cash, or bank deposit preparation. Larceny is easier to detect than skimming because the recorded cash doesn’t match the actual cash. Reconciliation discrepancies are diagnostic.
Billing Schemes
The employee causes the organization to pay for goods or services that were never actually received, or that were received at inflated prices:
- Shell vendors: invoices from a vendor that exists only on paper, owned by the employee or a confederate
- Pass-through vendors: a real vendor is used, but the employee inflates the invoice and pockets the difference
- Personal purchase schemes: the employee uses corporate accounts to buy personal items, with the invoice processed as a business expense
Billing schemes are detected through vendor master file analysis, payment pattern assessment, and verification of services rendered.
Payroll Schemes
The organization is caused to pay for labor that wasn’t performed:
- Ghost employees: employees on the payroll who do not actually exist (or who have left)
- Falsified hours: an employee reports more hours worked than were actually worked
- Commission schemes: inflated commission claims or commissions on transactions that didn’t occur
Payroll schemes are detected through employee verification, time/attendance verification, and reconciliation of payroll registers to actual headcount.
Expense Reimbursement Schemes
Employees submit false expense reimbursement claims:
- Mischaracterized expenses: personal expenses claimed as business
- Overstated expenses: actual business expenses inflated
- Fictitious expenses: expenses claimed for events or purchases that never occurred
- Duplicate reimbursements: same expense submitted multiple times
These schemes are detected through receipt verification, expense pattern analysis, and cross-checking submitted receipts against vendor records.
Check Tampering
An employee modifies, intercepts, or fabricates checks payable from the organization:
- Forged maker schemes: the employee signs an unauthorized check
- Intercepted check schemes: a check intended for a legitimate payee is intercepted and converted
- Concealed check schemes: checks are prepared, signed, and cashed by the employee with the records concealed
Check tampering schemes are detected through bank statement analysis, signature verification, and assessment of returned checks.
Inventory and Asset Theft
Physical inventory or assets are removed from the organization:
- Outright theft: products, equipment, or supplies physically taken
- Falsified shipments: products shipped to addresses controlled by the employee
- Inventory misappropriation via false write-offs: inventory reported as scrapped or damaged when it was actually diverted
Detection requires physical inventory counts, shipment verification, and assessment of write-off documentation.
Red Flags to Watch For
Asset misappropriation typically generates patterns that, in retrospect, were visible. The challenge is recognizing them in real time. Common red flags include:
Behavioral indicators in employees with financial access:
- Lifestyle inconsistent with stated income (new cars, vacations, expensive purchases)
- Reluctance to take vacation or delegate (concealing the scheme)
- Unusually close relationships with vendors
- Defensiveness about audits, reconciliations, or process changes
Operational indicators in financial records:
- Reconciliation discrepancies that “almost balance”
- Vendor invoices from addresses that don’t have a physical business location
- Vendor invoices in round numbers ($5,000 even, $1,000 even — unusual for real business)
- Payments to vendors not on the approved master list
- Unusual transactions just below approval thresholds
- Frequent voided transactions or returns
- Inventory shrinkage exceeding industry norms
- Sudden changes in vendor mix or vendor terms
Process indicators:
- One person controlling cash receipt, recording, and bank deposit
- Inadequate segregation of duties
- Lack of approval requirements for journal entries, write-offs, or refunds
- Missing or backdated documentation
The single biggest enabler of asset misappropriation in small and mid-sized organizations is inadequate segregation of duties — one person doing too many parts of the cash cycle.
What to Do When You Suspect Asset Misappropriation
If you (as a business owner, audit committee member, or attorney) suspect asset misappropriation, the worst response is improvised action. Confronting the suspected employee without evidence, locking them out abruptly, or making accusations without forensic support can blow up the investigation and create legal exposure.
The right response is a deliberate process:
Step 1 — Preserve evidence. Quietly secure records that may be relevant. Document the suspicion in writing (date, observations, who knows about it). Do not alter anything; do not delete anything.
Step 2 — Engage counsel. A suspected misappropriation creates legal questions: employment law implications, potential criminal referrals, insurance claim considerations, evidence preservation obligations. Counsel should be involved before any further action.
Step 3 — Engage a forensic CPA. A credentialed forensic accountant can scope the investigation, identify the records needed, and conduct the analysis with proper documentation. Engaging through counsel (under attorney-client privilege where applicable) typically protects the investigation.
Step 4 — Conduct the investigation discreetly. Until the investigation is complete, the suspected employee should typically not be confronted. Premature confrontation can result in document destruction, evidence tampering, or legal claims by the employee.
Step 5 — Make decisions based on the findings. Once the investigation is complete, the organization decides on consequences: termination, recovery action, criminal referral, insurance claim, internal control changes. Each path has legal and practical implications counsel will help navigate.
What a Forensic Accountant Brings to the Investigation
A forensic CPA conducting an asset misappropriation investigation typically performs:
- Document analysis and reconstruction (general ledger, bank statements, vendor invoices, payroll records)
- Interview support (helping counsel prepare factual questions; not conducting interrogation)
- Quantification of losses
- Identification of internal control weaknesses that enabled the scheme
- Preparation of a written report suitable for insurance claims, civil litigation, or criminal referral
- Expert witness testimony if the matter goes to trial
The credentials that matter most for this work are CPA + forensic specialty (typically CFE or CFF for fraud-focused matters; ABV when business value is also at issue).
Recovery Options When Misappropriation Is Confirmed
Once asset misappropriation is documented, the organization typically has several recovery paths:
Civil litigation. Suit against the employee (and any confederates) for the documented losses. Recovery depends on the employee’s assets; many cases result in judgments that exceed what is collectible.
Criminal referral. Reporting to law enforcement may result in prosecution. Criminal restitution can supplement civil recovery but is rarely the primary path to recovery.
Insurance claims. Most organizations have fidelity bond or employee dishonesty coverage. A forensic accountant’s documented quantification is typically required for the claim.
Settlement. Many cases resolve via settlement with the employee — often involving a confession of judgment, agreed payment plan, and waiver of claims by the employee.
Internal action only. In small dollar amounts or where reputation concerns predominate, organizations sometimes choose to terminate quietly without pursuing recovery.
Preventing Future Misappropriation
A forensic accounting engagement often leads to recommendations for internal control improvements. Common improvements include:
- Segregation of duties in cash handling and AP processes
- Mandatory vacation policies (especially for finance roles)
- Vendor master file assessment and approval processes
- Periodic surprise reconciliations
- Whistleblower hotline implementation
- Background check policies for finance roles
A well-designed internal control system doesn’t eliminate fraud risk but significantly raises the effort required to commit and conceal it.
Frequently Asked Questions
How common is asset misappropriation?
According to the ACFE’s Report to the Nations, asset misappropriation is the most common form of occupational fraud — accounting for over 85% of fraud cases studied. The median loss is roughly $100,000-$150,000 per incident, though individual cases range from a few hundred dollars to multi-million-dollar losses.
How long do asset misappropriation schemes typically last?
The ACFE data suggests a median duration of 12-18 months before detection. Cash schemes (skimming, larceny) tend to be detected faster; payroll and billing schemes can persist for years.
What’s the difference between asset misappropriation and embezzlement?
Embezzlement is a legal term that typically refers to the criminal misappropriation of funds entrusted to a person. Asset misappropriation is broader, covering both criminal and civil cases, and any type of asset (not just funds). In practical terms, the words are often used interchangeably.
Who is most likely to commit asset misappropriation?
The ACFE data shows that employees with financial access — those who handle cash, payroll, accounts payable, or inventory — are the most common perpetrators. Tenure correlates positively with loss magnitude (longer-tenured employees who commit fraud typically take more before being caught), as does position level.
How much does an asset misappropriation investigation cost?
A focused investigation may run 40-100 hours of professional time. A complex multi-scheme investigation involving multiple employees, multiple years, and significant volumes of records can run several hundred hours. Costs typically range from $10,000 to $100,000+, with most engagements in the $20,000-$50,000 range.
Can the loss be recovered from the employee?
Sometimes. Recovery depends on the employee’s assets. Civil judgments are often only partially collectible. Insurance recovery (via fidelity bond or employee dishonesty coverage) is typically the most reliable recovery path, but requires proper documentation of the loss.
Should we file a criminal complaint?
The decision is the organization’s, typically made with counsel. Criminal prosecution can result in restitution and serves as a deterrent, but typically does not maximize financial recovery. Many organizations pursue civil recovery and insurance claims first, with criminal referral as a separate decision.
Does Joey Friedman CPA PA handle these investigations?
Yes. The firm has substantial experience with asset misappropriation investigations across small, mid-sized, and large businesses, nonprofits, and HOAs/COAs/POAs. Engagements typically begin with a confidential consultation to scope the investigation appropriately.
Working with a Forensic CPA on Suspected Misappropriation
If you suspect asset misappropriation in your organization, the most important early decisions are about preservation and process — not confrontation. Engaging counsel and a forensic CPA early protects the investigation and the organization.
Joey Friedman CPA PA, through its President Joey N. Friedman, CPA, ABV, MAcc, MIB, provides forensic accounting services to businesses and counsel throughout Florida. The firm handles asset misappropriation investigations across cash schemes, billing schemes, payroll fraud, and inventory misappropriation. Contact the firm to discuss your specific situation.
About Joey Friedman CPA PA
Joey Friedman CPA PA is a Florida professional association providing forensic accounting, business valuation, expert witness, and litigation support services. The firm is led by Joey N. Friedman, CPA, ABV, MAcc, MIB, who serves as the firm’s President.
All services described in this article are provided by Joey Friedman CPA PA. Engagement letters and professional services are issued by the firm. Joey N. Friedman signs in his capacity as the firm’s President — as an officer and agent acting on behalf of Joey Friedman CPA PA, not in any personal or individual capacity. Mr. Friedman’s professional credentials — including CPA license, ABV (Accredited in Business Valuation, AICPA), and ACFE membership — are exercised under the firm.
To engage Joey Friedman CPA PA, contact the firm:
- Phone: 954-282-9615
- Contact form: Contact the Firm
Disclaimer: This article is for informational purposes only and does not constitute legal, accounting, or tax advice. Engagement of Joey Friedman CPA PA is subject to a written engagement letter executed between Joey Friedman CPA PA and the engaging party. No attorney-client or accountant-client relationship is created by reading this article.
Related coverage from Joey Friedman CPA PA
- Ghost Employee Detection: A Forensic CPA’s Field Guide
- Fraud Investigator: When You Need a Forensic CPA vs Other Investigators
- The Bank Deposit Method: Reconstructing Revenue When the Books Are Missing
- Forensic Accounting in Bankruptcy: Tracing Fraudulent Transfers
About This Service
This article is part of Joey Friedman CPA PA’s broader practice in forensic accounting service overview. Visit the main service page for a complete overview of how we support attorneys, businesses, and individuals across Florida and nationally in financial disputes, litigation, and forensic engagements.