Exception ≠ Error ≠ Fraud

A transaction flagged by a rule has earned a closer look. It has not earned an accusation.

In this article, an exception means a departure from a defined test, expectation or control requirement. The meaning depends on the rule and the reliability of its inputs. A badly designed duplicate test can produce a convincing-looking queue of false leads.

The infographic's calculator and crossed-out figures are illustrative props, not reported losses or case data.

Three terms, different questions
An exception asks: why did this item fail the test?

An error asks: what went wrong unintentionally?

Suspected fraud asks: what evidence suggests intentional deception or misappropriation?

These are different lenses, not three automatic stages. An exception may reveal an error, a legitimate circumstance or a control weakness. Intentional misconduct can also escape the test entirely. The absence of a flag does not establish the absence of misconduct.

PCAOB AS 2401 distinguishes error from fraud through intent in the context of financial-statement misstatements. It also separates audit evaluation from a legal determination of fraud. That US audit context informs the distinction here; it does not establish a local legal definition.

First, validate the signal
Before contacting a process owner, check the population, period, rule and fields used. Were invoice numbers normalized consistently? Were reversals or credit notes included? Does the extract contain the same transaction twice?

Record the test logic and retain the original output. If the flag came from an unreliable extract, correct the test and preserve an explanation of the change.

Then, build the explanation
Consider this hypothetical case: two entries share an invoice number. They could represent one transaction duplicated in the extract, a reissued document, a posting error or a payment requiring further investigation.

Compare the underlying documents, posting history and payment trail. Check relevant approvals and obtain corroborating evidence. A plausible verbal explanation is a starting point for follow-up, not a substitute for the records needed to support it.

The classification should follow the evidence. If uncertainty remains, say what is unresolved and what would resolve it.

Choose a proportionate response
A confirmed data issue may call for a corrected report and a better extraction check. An unintentional posting error may require correction, an impact assessment and attention to its cause. Evidence suggesting deliberate conduct calls for escalation through the authorized route, with appropriate confidentiality and preservation of records.

Who investigates, whom to notify and what action is appropriate depend on the organization's mandate, policies and applicable requirements. Avoid distributing unverified allegations or unnecessary personal data.

Make the conclusion traceable
A useful exception record identifies the item, test, evidence, explanation, assessment, action owner and closure basis. Distinguish a closed issue from one merely awaiting a response.

The strongest conclusion is the one the evidence supports—even when that conclusion is that more work is needed.

Reference
- Public Company Accounting Oversight Board — AS 2401, particularly paragraphs .05, .11 and .13 — https://pcaobus.org/oversight/standards/auditing-standards/details/AS2401

The practical triage approach and hypothetical example above are Inside Assurance editorial guidance, not a reproduced investigation standard.