The fraud triangle describes the three conditions that tend to be present when an ordinary employee commits fraud: pressure, opportunity, and rationalization. Criminologist Donald Cressey identified the pattern in 1953, though the triangle name came later, from accounting professor Steve Albrecht. It's useful because only one of the three is really in your control. You can't remove someone's financial pressure and you can't argue them out of a rationalization, so you close the opportunity.

What are the three conditions?

  1. Pressure. A problem the person feels they can't talk about. Cressey's original formulation was narrower and sharper than the word "pressure" suggests: he called it a non-shareable financial problem. Gambling debt, a medical bill, a business failure on the side, a lifestyle the person can't afford to be seen losing. The generalization to "pressure or incentive," which covers sales quotas and earnings targets, came later from auditing standards rather than from Cressey.
  2. Opportunity. A way to take the money or falsify the record without getting caught, and enough knowledge of the controls to believe it will hold. Opportunity is rarely about weak character. It's about who can initiate a payment, who approves it, who reconciles it, and whether those are the same person.
  3. Rationalization. A story that lets the person keep their self-image intact. "I'm borrowing it." "They underpaid me for years." "Everyone expenses personal travel here." The story usually arrives before the act, not after.

Where does the model come from?

The attribution almost every page gets wrong is worth stating plainly.

Cressey never used the phrase "fraud triangle." He never drew a triangle, and he died in 1987, before the term existed. His 1953 study is Other People's Money: A Study in the Social Psychology of Embezzlement, built on interviews with convicted embezzlers, and what he described was a sequence of conditions rather than a shape.

W. Steve Albrecht coined the term, by his own account, at a fraud seminar in 1991. Albrecht's own earlier research produced a different model, the fraud scale, whose third leg is personal integrity rather than rationalization. The two models get conflated constantly, and the distinction matters: a model built on integrity points you toward hiring and screening, while a model built on rationalization points you toward culture and communication.

The audit standard describes the conditions without naming the model. PCAOB AS 2401.07 opens "Three conditions generally are present when fraud occurs" and then sets out incentive or pressure, opportunity, and attitude or rationalization. The phrase "fraud triangle" appears nowhere in it. If you are citing an authority in a training deck or a board memo, cite AS 2401.07 for the conditions and Albrecht for the name.

What does the fraud triangle explain that "bad apples" doesn't?

The bad-apple theory says fraud comes from bad people, so the fix is screening. Screening is a one-time test of the person, and it tells you nothing about the conditions they will be working under in year six.

The triangle is the more useful model for control design, because it makes fraud situational. The same person is honest under one set of conditions and not under another. That reframing has three operational consequences:

  • Trust isn't a control. Long tenure raises access and lowers scrutiny at the same time, which is a compounding risk rather than a reassurance.
  • Screening has a ceiling. A background check can only surface what is already on a record at the time you run it. It does nothing about the pressure that arrives later.
  • The design of the job matters more than the character of the person. Which is the useful conclusion, because job design is something a company controls.

How do you design controls around opportunity?

Opportunity is the leg you can actually move, so build there.

  • Separate duties. Nobody should initiate, approve, and reconcile the same transaction. This is the single highest-yield control and the one small teams skip most often.
  • Rotate and require time away. Mandatory vacation and job rotation work because most ongoing schemes need continuous maintenance by one person. Frauds surface when that person is out.
  • Reconcile independently. Someone outside the transaction chain reviews the bank reconciliation, the vendor master file, and the expense exceptions.
  • Control the vendor master. New-vendor setup is the most common entry point for billing schemes. Require a second approver and verify banking details out of band.
  • Watch the overrides. Track how often management overrides a control, and treat a rising count as a finding rather than an operational detail.
  • Give people a route. Treat the reporting channel as a detection control and resource it like one, because colleagues usually notice a scheme before a reconciliation does. See speak-up culture and employee hotline for what makes one work.

Pressure and rationalization are not entirely off-limits, but the levers are softer. You reduce rationalization by making consistency visible: when leadership follows the same expense rules as everyone else, "everyone does it here" stops working as a story. That's tone at the top doing real work rather than decorative work.

What are the limits of the model?

The triangle explains the lone, financially motivated employee well. It explains other things less well.

It struggles with collusion, where two or more people defeat separation of duties and the non-shareable element disappears by definition. It struggles with predatory fraud, committed by someone who joined intending to steal and needed no rationalization. It explains why better than it predicts who, so it's a diagnostic and control-design tool rather than a screening instrument. And its conditions are inferred after the fact, which makes the model hard to falsify.

Use it for what it does well: telling you that the opportunity side of your control environment is the part you own.

FAQ

Who created the fraud triangle?

Donald Cressey described the three conditions in 1953. Steve Albrecht named the model, by his own account, at a 1991 seminar. Cressey never used the phrase.

Is the fraud triangle part of auditing standards?

The three conditions are. The phrase isn't. PCAOB AS 2401.07 describes incentive or pressure, opportunity, and attitude or rationalization without naming the triangle.