A falsified qualification, undisclosed directorship or conflicted supplier relationship can enter an organisation long before a loss appears in the accounts. By the time an irregular payment, missing stock or customer complaint triggers an investigation, the business may already face financial, operational and reputational damage. This corporate fraud prevention guide sets out how employers can reduce that exposure through proportionate controls, factual verification and a clear response when concerns arise.

Fraud prevention is not a single policy owned by finance or HR. It is a practical risk-management discipline covering the people hired, the organisations engaged, the authority granted and the information used to approve decisions. For Malaysian businesses operating across functions, branches and third parties, the strongest arrangements are those that make deception harder to introduce and easier to detect.

Start with the fraud risks your business can actually face

A generic anti-fraud policy has limited value if it does not reflect how money, assets and authority move through the organisation. A company with high-volume recruitment may be exposed to identity fraud, inflated employment histories and false qualifications. A business that relies on vendors, agents or joint-venture partners may face undisclosed ownership, sanctions or regulatory concerns, conflicts of interest, invoice manipulation and procurement collusion.

Map the points at which a person can obtain access, influence an approval or conceal a conflict. This should include recruitment, onboarding, payroll, purchasing, expense claims, credit decisions, tenancy approvals, supplier appointment, contract renewals and post-employment access.

The exercise should identify both opportunity and impact. A junior employee with authority to amend bank details may present a more immediate payment-fraud risk than a senior employee with no access to financial systems. Conversely, a director or business partner may create significant strategic and reputational exposure even where day-to-day transaction access is limited.

Risk assessment does not require every role or relationship to receive the same scrutiny. It should determine which decisions need basic verification, enhanced due diligence or ongoing monitoring. Proportionate screening protects resources while ensuring that high-consequence decisions receive appropriate attention.

Corporate fraud prevention guide: verify before approval

Fraud often succeeds because organisations accept information at face value when a vacancy must be filled quickly, a supplier appears commercially attractive or a transaction needs urgent approval. Verification introduces an independent factual check before trust is extended.

For employees, a screening process may verify identity, stated employment, education and professional qualifications, references and relevant civil litigation, industrial court, regulatory blacklist, financial-probity or security information, subject to the role, lawful basis and applicable requirements. The aim is not to search for reasons to reject candidates. It is to establish whether material information supplied to the organisation is accurate and whether any identified concern is relevant to the responsibilities involved.

For directors, suppliers, agents and joint-venture counterparties, due diligence should go beyond a company profile or a polished presentation. Decision-makers need to understand who is behind the entity, whether key individuals hold relevant directorships, whether there are adverse legal, regulatory or financial indicators, and whether potential conflicts have been disclosed. A low-cost supplier can become expensive quickly if its background introduces bribery, fraud, delivery failure or reputational risk.

Verification must be carried out lawfully, confidentially and consistently. Organisations should define the checks required for each risk category, obtain appropriate consent where necessary, protect personal data and ensure that reports are reviewed only by authorised personnel. Poorly managed screening can create privacy, employment and discrimination concerns. A disciplined process produces evidence that supports a fair, defensible decision.

Build controls around access, not job titles

Trust is valuable, but unrestricted access is not a control. Fraud prevention improves when authority is designed around what an individual needs to do, rather than what their seniority appears to justify.

Segregation of duties is central. The person who creates a supplier should not be able to approve payments to that supplier without independent review. The employee who processes payroll changes should not be the sole person authorising them. Likewise, expense claims, refunds, stock adjustments and customer bank-detail amendments should have clear approval routes and an auditable record.

Four controls deserve particular attention:

  • Role-based access should limit systems, records and payment authority to legitimate business need, with access removed promptly when roles change or employment ends.
  • Independent approval should apply to high-risk transactions, new vendors, bank-account changes, unusual discounts and exceptions to normal purchasing procedures.
  • Reconciliations should compare financial records, stock, payroll data and supplier information regularly enough to identify anomalies before losses accumulate.
  • Audit trails should show who requested, reviewed, approved and amended a transaction, including the reason for any override.

Controls can become burdensome if they are applied indiscriminately. A small business may not have separate teams for procurement, finance and operations. In that case, owner review, periodic external checks or rotating approvals can provide practical compensating controls. The principle remains the same: no individual should be able to initiate, approve and conceal a high-risk action alone.

Treat changes as high-risk events

Many fraud losses do not begin with a new hire or supplier. They begin with a change that seems routine: an amended bank account, a request to redirect a payment, a new email address, an urgent instruction from a senior executive or a request to bypass normal documentation.

Create verification steps for changes to supplier details, payroll information, authorised signatories, customer refunds and employee access rights. Confirmation should use known contact details, not the telephone number or email address included in the request. For material changes, a second reviewer should confirm the supporting evidence and record the decision.

This is especially relevant where staff work across multiple locations or communicate heavily through email and messaging platforms. Fraudsters frequently rely on urgency, impersonation and the assumption that a request from an apparent authority figure should not be challenged. A short verification call can prevent a significant loss.

Make reporting safe, specific and usable

Employees are often the first to notice duplicated invoices, altered records, unusual supplier behaviour or a colleague living beyond apparent means. They may remain silent if reporting is unclear, confidentially is doubtful or managers dismiss concerns as personal disputes.

Provide a defined route for reporting suspected fraud, misconduct or conflicts of interest. Staff should know who receives concerns, what information is useful, how confidentiality will be handled and why they should not conduct their own investigation. Reports may be made through a manager, HR, finance, compliance function or an appropriate independent channel, depending on the organisation’s size and structure.

A useful report contains facts rather than accusations: dates, transactions, documents, messages, names and observed behaviour. This helps the organisation assess the issue without allowing rumours to become findings. Retaliation against good-faith reporters should be prohibited and addressed promptly, while malicious or knowingly false allegations should also be managed fairly.

Training should be practical. Rather than reciting policy language, use examples relevant to the team: false mileage claims, vendor bank-detail fraud, undeclared family connections, manipulated attendance, misuse of customer data or forged credentials. Employees should understand the warning signs and the required response.

Respond without compromising the investigation

When a concern is raised, speed matters, but so does control. A poorly handled response can destroy evidence, alert the subject prematurely or create unfairness in an employment matter. Assign responsibility for triage to a limited group with the authority and discretion to act.

The first task is to preserve relevant records, including emails, access logs, approval histories, invoices, device information and physical documents. Access may need to be restricted where there is an immediate risk to systems, funds or evidence. Decisions should be documented carefully, including what is known, what remains unverified and why each protective action was taken.

Investigations should remain fact-led. An allegation is not proof, and an adverse screening result may require clarification, context or further verification before a decision is made. Where legal, regulatory, insurance or law-enforcement issues arise, obtain appropriate professional advice and follow applicable reporting obligations.

Keep prevention active after onboarding

Pre-employment screening is an effective starting point, not a lifetime guarantee. Circumstances change: employees take on new responsibilities, business partners acquire new owners, suppliers face financial stress and internal controls weaken through informal workarounds.

Review screening requirements when a person moves into a sensitive role, receives greater financial authority or becomes a director or signatory. For material vendors and partners, periodic re-screening may be appropriate where the relationship involves substantial payments, access to data, regulated activity or public-facing reputational exposure. The frequency should reflect risk, contractual arrangements and lawful data-handling requirements.

Angel Checks supports organisations that need confidential, decision-ready verification before hiring, appointing directors, entering commercial relationships or assessing other high-consequence arrangements. Independent screening gives decision-makers a clearer factual basis for approval and helps ensure that concerns are addressed before they become losses.

Fraud prevention works best when it becomes part of ordinary business discipline: verify key facts, limit unnecessary authority, question unusual changes and document decisions that matter. That approach protects more than money. It protects the trust on which every employer, supplier and customer relationship depends.