Literature Review

Empirical data confirm that fraud remains a significant and widespread problem for organisations. A recent UK survey found that 71% of businesses reported a direct or indirect financial loss due to fraud, with 27% experiencing fraud in the previous year and 74% of those reporting multiple incidents [4]. The biannual report by the Association of Certified Fraud Examiners [10], drawing on 1,921 occupational fraud cases worldwide, found that 21% of victim organisations had fewer than 100 employees, 22% had 100–999 employees, 31% had 1,000–9,999 employees, and organisations of more than 10,000 employees accounted for the remaining 26%. In the UK, 37% of businesses with a turnover exceeding £1 million reported fraud compared with only 27% below that threshold [4]. These figures suggest that the relationship between organisational scale and fraud incidence is unlikely to be simply proportional.

Barnes and Webb [11] analysed survey data from UK organisations to test whether organisational size affects susceptibility to theft and fraud. Their findings indicated that larger organisations reported higher susceptibility to fraud and that the monetary size of individual fraud losses increases disproportionately with organisational size. They attribute this to structural features of scale: greater access to resources, increased transaction volumes, and organisational complexity. Interestingly, their analysis also finds that variation in management control configuration does not significantly affect overall susceptibility [11]. This suggests that structural properties may exert a stronger influence on fraud exposure than the specific design of control systems alone.

Taken together, however, the evidence across studies is inconsistent. ACFE and UK Home Office surveys do not consistently show higher fraud rates in larger organisations once exposure is controlled for [4,10], while Barnes and Webb [11] find the opposite. This inconsistency is difficult to resolve using only observational data. All three datasets rely on detected fraud and therefore capture only the observable portion of total organisational fraud activity [17]. Larger organisations may detect fraud more readily, meaning that higher reported rates may reflect detection effectiveness rather than underlying prevalence [12]. Empirical methods alone are therefore insufficient to determine whether fraud scales proportionally, sublinearly, or superlinearly with organisational size.

Individualistic accounts: the fraud triangle and its critiques

While Sutherland’s [18,19] seminal work has an enduring influence on the study of white-collar crime, there is a need for precision in discussion of the topic. White-collar crime can be divided into ‘corporate crime’, this being acts committed by those within an organisation for the benefit of the organisation, and ‘occupational crime’, acts against the organisation’s interests for personal benefit, such as fraud or embezzlement [20]. This study is concerned with the latter.

Scholarly explanations of occupational fraud remain dominated by the fraud triangle paradigm, which portrays fraud as a consequence of personal motives, opportunities and rationalisations. At least nineteen such theories trace their lineage to Donald Cressey’s mid-twentieth century study of embezzlers [21–23], although later theories can exhibit misinterpretation or misrepresentation of Cressey’s work [23,24], and Cressey himself did not use the term ‘fraud triangle’ [25]. Other scholars and professionals have extended the triangle by including additional psychological, sociological or situational factors [e.g., 26–28]. The fraud triangle has become ubiquitous in both scholarly and professional literature on fraud. It has attained paradigmatic status in the Kuhnian sense: research focus remains anchored to positioning fraud as a psychological or moral problem of the individual [23], and this tradition has been highly influential in professional practice, including accounting, fraud examination and auditing [24,29].

This body of work is directly relevant to the present study, as the model adopts the core decision structure derived from this tradition. However, the fraud triangle and its variants largely overlook the significance of factors outside the individual, specifically the wider system in which the individual is situated and how that system both shapes and is shaped by individual actions. The problem of fraud requires analysis through both psychological and social lenses, since “[s]ocial structures powerfully nourish or retard individual malfeasance” [20].

A partial response to this critique can be found in a situational action theory-based model of fraud that proposes [30]:

Here, the propensity to commit fraud is a matter of individual psychology, while the criminogeneity of the environment is shaped by its moral norms, culture, workforce dynamics and tolerance of unethical behaviours. This model is a significant step in recognising structural influences on fraud. However, it still seeks to explain the behaviour of the individual rather than the aggregate dynamics of the system.

Bunge goes further, calling for a ‘systemic perspective on crime’ that advocates a multi-level account incorporating both individualist and holist perspectives: “…an individual’s actions cannot be understood without considering the systems of which he is a part, just as these cannot be understood except as being composed of individuals who maintain, reinforce, or weaken the bonds that keep them and others in their systems” [31]. This points toward analytical approaches capable of capturing interaction, feedback and system-level dynamics.

Fraud as a systemic and complex problem

There are limited but notable examples of research into fraud that adopt a systemic perspective. Button et al. [5] developed a ‘fraud field’ model as a conceptual framework for explaining the opposing forces of threats and safeguards that together determine fraud levels. The researcher subsequently updated Fraud Field Theory using a complexity-theory-inspired approach [13], making opportunities the central element shaped by the interaction of threat and safeguard fields. This frames the fraud field as a complex adaptive system in constant flux, with fraud levels capable of exhibiting non-linear behaviour.

Similar critiques have emerged in adjacent domains where agent-based modelling has been used to examine how risk develops within complex social systems [32]. Rather than treating risk factors as independent and additive, such studies show how outcomes emerge through interaction over time, often producing non-linear and path-dependent dynamics. Risk, from this perspective, is a property of the system rather than a static attribute of its members.

The meaningful analysis of complex social systems requires attention to interactions between elements rather than properties of those elements in isolation [33,34]. Complex systems feature large numbers of dynamically interacting elements exchanging energy or information, governed by feedback loops and non-linearities [33,35]. Agents interact according to rules that determine responses to stimuli, and these rules are updated as agents learn from experience [36].

The effects of scale on system behaviour are well established in urban contexts. Research on cities challenges the assumption that per capita indicators scale linearly with population [e.g., 14, 16, 37]. Crime rates are no exception. Banerjee et al. [38] showed that while the number of criminals scales linearly with population, law enforcement capacity grows sublinearly. Beyond a threshold, law enforcement is outpaced and crime rates become superlinear. These findings suggest that system scale can fundamentally alter the balance between harmful activities and the mechanisms intended to constrain them. As organisations grow, increasing numbers of employees, transactions and interaction pathways may create conditions in which fraudulent behaviour can propagate in a similarly non-linear fashion.

Empirical research supports the idea that misconduct propagates through social interaction within organisations. Robinson and O’Leary-Kelly [39] found that individuals’ antisocial behaviour was positively associated with coworkers’ behaviour across 35 work groups. Dimant [40] demonstrated through experimentation that antisocial behaviour spreads through peer networks and that social proximity amplifies contagion effects. More recently, Mitsuhashi et al. [41] found that hospital nurses became more likely to violate rules when exposed to peer rule-breaking during shared shifts. These studies lend empirical support to modelling approaches that incorporate social influence as a driver of behavioural diffusion. Crucially, however, none of these studies examines whether organisational scale moderates these contagion dynamics.

Agent-based modelling in criminology and economic crime

A systems-based understanding of fraud has begun to be operationalised through agent-based models (ABM). Although ABMs are increasingly used in criminological study, enabling the modelling of complex dynamic systems in which outcomes arise from agent interactions [42], their application to organisational fraud remains limited.

Kim and Xiao [43] used an ABM to examine statistical and spatial crime patterns arising in a welfare programme. Agents were either ‘recipients’ (N = 1,000) or ‘vendors’ (N = 20). Each had opportunities and propensity to engage in fraudulent exchanges. When the simulation outputs were compared to empirical data from a real programme, they showed good alignment. The model’s limitations were, however, well acknowledged.

Davis and Pesch [44] developed the most directly relevant ABM. They constructed a model of occupational fraud within an organisation to test the effectiveness of various fraud prevention techniques. The model comprised 100 agents (i.e., simulated employees) whose interactions were governed by rules derived from Cressey’s characterisation of occupational fraud, justified on grounds of its dominance in the professional literature and its simplicity.

The model’s rules determined that “…any agent in our model possessing motive, opportunity, and an attitude that frames the fraudulent act as acceptable will commit fraud” [44]. Each agent’s attitude to fraud was influenced by those in their local network, with q representing the probability of emulating others’ behaviour. At moderate or high values of q (> 0.3), significant swings in the number of agents engaged in fraud were observed. Where q < 0.3, fraud settled into a steady level. The transition was gradual rather than bifurcated.

Davis and Pesch’s contribution is invaluable. However, their modelling was constrained by the computing time required (around 5,000 hours), which led them to keep the model at 100 agents, noting that they “…felt that the additional insight provided was likely to be limited” [44]. As a result, they did not consider whether fraud dynamics might differ at other organisational sizes. The same limitation applies to Kim and Xiao [43], who substantially downscaled the real Ohio welfare system without treating population size as a variable of theoretical interest. Across both studies, the size of the agent population is fixed within the modelling design and never examined as a generative mechanism in its own right.

This gap is the departure point for the present study. Organisational size has not been examined as a primary design variable in ABM-based fraud research, despite evidence from complexity science that scale can fundamentally alter system dynamics. The present study addresses this directly.

Theoretical Expectations

The literature reviewed above generates three theoretical expectations that guide the simulation design and the interpretation of results. These are not formal hypotheses, but theoretically grounded conjectures derived from complexity science and prior ABM research. Their purpose is to provide an explicit basis against which the simulation outputs can be assessed.

Expectation 1: Mean fraud levels will increase superlinearly with organisational size. Urban scaling research shows that harmful social outcomes often increase faster than population size [14,38]. Davis and Pesch’s [44] model demonstrates that social influence can generate non-linear fraud dynamics within a fixed-size organisation. Combining these insights, as organisations grow the expanding network of agent interactions should amplify fraud beyond simple proportionality.

Expectation 2: Fraud volatility will increase faster than mean fraud levels. In complex systems, growth in scale tends to amplify instability as well as average outcomes. As the number of interaction pathways through which pro-fraud attitudes can propagate increases disproportionately with size, fluctuations in fraud activity should become more pronounced. Volatility is therefore expected to scale more steeply than mean fraud.

Expectation 3: Network connectivity and susceptibility to social influence will moderate the scale–fraud relationship. Davis and Pesch [44] show that the parameter q governs whether fraud dynamics are stable or volatile at a fixed organisational size. In larger organisations with denser interaction networks and higher susceptibility, pro-fraud attitudes should circulate more widely, potentially strengthening the superlinear scaling relationship. Conversely, sparser networks and lower susceptibility should dampen contagion and moderate the relationship between size and fraud outcomes.

Model verification and validation

The model was developed to examine the behaviour of specified generative mechanisms rather than to reproduce or predict empirical datasets. As such, formal validation against real-world data was not undertaken.

Model behaviour was assessed through systematic exploration of parameter regimes varying organisational size, network connectivity scaling (αₖ), and susceptibility to social influence (q_avg). This approach allowed the consistency of observed patterns to be examined across a wide range of structural and behavioural conditions, rather than relying on a single parameter configuration.

Given the well-established limitations of empirical fraud data, which capture only a subset of underlying activity, the evaluation of the model is framed in terms of plausibility rather than empirical fit. The simulated outputs are therefore interpreted in relation to broad empirical regularities discussed in the literature, such as the persistence of non-zero fraud levels across organisational contexts and the heterogeneous distribution of fraud outcomes.

These comparisons are not intended as validation in a predictive sense, but as an indication that the model generates behaviour within a plausible domain consistent with existing empirical observations.

Findings

This section examines how fraud outcomes vary with organisational size in the simulation model. Using regime means aggregated across the twenty repetitions per parameter configuration (N = 450 for mean fraud and peak fraud; N = 405 for volatility), log–log regressions were estimated to test whether fraud outcomes exhibit power-law scaling relationships with organisational scale. Three outcome measures were analysed: mean fraud levels, peak fraud events, and the volatility of fraud activity over time.

Fig 2, Fig 3, Fig 4 illustrate the log-log relationship between organisational size and these outcomes, while Table 5 reports the estimated scaling exponents from the log–log regressions. Table 6 then presents regression models that include the behavioural parameters and their interactions with organisational size. In addition to the direct effects of these parameters, interaction terms between organisational size and each behavioural parameter were also estimated to test whether the strength of the scaling relationship varies across behavioural regimes.

Download:

• PNG
  larger image
• TIFF
  original image

Table 5. Estimated scaling exponents (β) for fraud outcomes.

https://doi.org/10.1371/journal.pone.0342964.t005

Download:

• PNG
  larger image
• TIFF
  original image

Table 6. Interaction regression results for fraud outcomes.

https://doi.org/10.1371/journal.pone.0342964.t006

Download:

• PNG
  larger image
• TIFF
  original image

Fig 2. Log-log scatter plot of mean fraud against organisational size (N = 450 regime means).

Each point represents the mean of average fraud per tick across 20 simulation runs for a given parameter regime. The regression line indicates approximately linear scaling (β = 1.004, R² = 0.988), confirming that mean fraud levels increase approximately proportionally with organisational size across the full parameter space.

https://doi.org/10.1371/journal.pone.0342964.g002

Download:

• PNG
  larger image
• TIFF
  original image

Fig 3. Log-log scatter plot of peak fraud against organisational size (N = 450 regime means).

Each point represents the mean of peak fraud across 20 simulation runs for a given parameter regime. The regression line indicates approximately linear scaling (β = 1.008, R² = 0.989), confirming that the highest level of fraud events increases approximately proportionally with organisational size.

https://doi.org/10.1371/journal.pone.0342964.g003

Download:

• PNG
  larger image
• TIFF
  original image

Fig 4. Log-log scatter plot of fraud volatility against organisational size (N = 405 regime means).

Each point represents the mean standard deviation of fraud counts across 20 simulation runs for a given parameter regime. The 45 regimes at q_avg = 0 are excluded as zero social influence produces zero within-run variability. The regression line indicates superlinear scaling (β = 1.393, R² = 0.898), indicating that the instability of fraud dynamics increases disproportionately with organisational size. The greater vertical spread of points relative to Figs 2 and 3 reflects the substantial moderating influence of social influence and network connectivity parameters on fraud volatility.

https://doi.org/10.1371/journal.pone.0342964.g004

Across the simulated organisational sizes, clear log–log relationships emerge between organisation size and fraud outcomes. The slopes of these relationships correspond to the estimated scaling exponents reported in Table 5. Mean fraud levels scale approximately linearly with organisational size (β = 1.004, p < .001), indicating that average fraud activity increases approximately in proportion to organisation size. This result does not support Expectation 1, which predicted superlinear scaling of mean fraud levels. Peak fraud events also scale approximately linearly with organisational size (β = 1.008, p < .001), indicating that the magnitude of extreme fraud events increases approximately in proportion to organisational size. Fraud volatility exhibits a superlinear relationship with organisation size (β = 1.393, p < .001), indicating that larger organisational systems exhibit disproportionately greater fluctuations in fraud activity.

These results indicate that organisational scale shapes both the level and the instability of fraud dynamics, but in distinct ways. Average fraud levels and peak events both scale approximately in proportion to organisational size. A doubling of organisational size is associated with an increase in average fraud levels of approximately 2^1.004 ≈ 2 times and peak fraud levels of approximately 2^1.008 ≈ 2 times. This confirms that both increase approximately proportionally with size.

Volatility, on the other hand, increases substantially more rapidly (β = 1.393): doubling organisational size is associated with an increase of approximately 2^1.393 ≈ 2.62 times, indicating disproportionately greater instability in fraud dynamics as organisations grow.

Illustrative example

To illustrate these scaling patterns concretely, predicted fraud outcomes were derived from the regression models for two contrasting organisational sizes – N = 100 and N = 3,200, a 32-fold difference. At N = 100, the model predicts an average of approximately 12 fraudulent agents per tick and a peak of approximately 19 agents. At N = 3,200, these rise to approximately 392 agents on average and approximately 623 at peak. In both cases the increase is close to the 32-fold proportional expectation, confirming that mean fraud and peak fraud scale approximately linearly with organisational size. The per-capita fraud rate remains approximately stable across this 32-fold size difference, consistent with β ≈ 1.0 for both outcomes.

The picture is strikingly different for volatility. The predicted standard deviation of fraud counts rises from approximately 1.1 agents at N = 100 to approximately 124 agents at N = 3,200. Under proportional scaling the expected figure would be around 35 agents; the model predicts more than three times that amount. This disproportionate amplification of instability, while average and peak levels track size closely, illustrates the central finding: larger organisations do not experience more fraud per capita, but they experience it far more erratically.

Influence of behavioural parameters

To examine the role of behavioural and structural parameters within the simulation, additional regression models were estimated including susceptibility to social influence (q_avg) and network connectivity scaling (αₖ). The results are reported in Table 6.

The regression results reveal a clear separation between the determinants of average fraud levels and the determinants of fraud volatility. For mean fraud, none of the behavioural parameters, nor their interactions with organisational size, reach statistical significance. Mean fraud levels are therefore almost entirely predicted by organisational size alone (R² = 0.988). This suggests that organisational scale is the dominant determinant of average fraud levels within the simulated system. For peak fraud levels, organisational size remains the dominant predictor (β = 0.949), but network connectivity scaling (αₖ) and both interaction terms are also statistically significant. This indicates that the magnitude of extreme fraud events is modestly but meaningfully shaped by network structure and its interaction with organisational size, in addition to scale itself.

Meanwhile, the behavioural dynamics of social influence and network connectivity shape how erratically and unpredictably fraud manifests within the system, without significantly altering the average level at which it occurs. This suggests a structural separation: mean fraud levels are determined almost entirely by organisational scale, consistent with a fixed per-agent fraud probability scaling with system size. Volatility reflects the dynamics of social contagion and network propagation, scaling superlinearly and responding significantly to susceptibility to influence and network connectivity. The structure and culture of organisational systems therefore matter primarily for managing how erratic fraud becomes, rather than how much of it occurs on average.

Revisiting the research questions

The three research questions posed by this study can now be answered directly by reference to the simulation results. Firstly, mean fraud scales approximately linearly with organisational size (β = 1.004). The per-capita fraud rate is approximately constant across organisational sizes when averaged across parameter regimes. Fraud volatility, however, scales superlinearly (β = 1.393), indicating that larger organisations experience disproportionately more erratic fraud dynamics. Peak fraud events also approach proportionality (β = 1.008). A 32-fold increase in organisational size is therefore associated with an approximately proportional increase in mean fraud, but with a substantially disproportionate amplification of volatility.

The approximately linear scaling of mean fraud is notable in that it does not support Expectation 1. This suggests that social contagion mechanisms alone, as modelled here, are insufficient to produce superlinear mean fraud scaling. The superlinearity observed in urban crime contexts [e.g., 14,37] may therefore depend on factors absent from the present model, such as a degradation of control capacity with organisational size, or disproportionate expansion of opportunity structures.

Secondly, network connectivity and susceptibility to social influence shape fraud volatility but not mean fraud levels. The results in Table 6 show that for mean fraud, neither q_avg, αₖ nor their interactions with organisational size reach statistical significance. For volatility, all five predictors are highly significant, with large interaction effects indicating that social influence and network connectivity substantially amplify the erratic character of fraud dynamics in larger organisations.

Thirdly, organisational scale amplifies volatility far more strongly than it amplifies average fraud levels. This is the most novel finding of the study. While mean fraud doubles approximately with each doubling of organisational size, volatility scales at β = 1.393, meaning fluctuations in fraud activity grow substantially more rapidly than organisation size. Larger organisations therefore do not face more fraud per capita on average, but dramatically more unpredictable fraud dynamics. This finding has no known direct counterpart in prior empirical fraud research.

Fraud as a system-level phenomenon

The results demonstrate that fraud is a dynamic, emergent property of organisational systems. The same behavioural mechanisms—individual susceptibility to social influence and network-mediated diffusion of pro-fraud attitudes—generate qualitatively different fraud dynamics depending on the structural scale of the system in which they operate. Larger systems do not simply contain more fraud; they exhibit fraud that is less stable and therefore harder to predict.

The results partially qualify the assumption of per capita linearity. For mean fraud levels, the per-capita rate is approximately constant across organisational sizes, meaning that larger organisations do not experience disproportionately more fraud, on average. However, for volatility, proportionality fails substantially: the instability of fraud dynamics grows far more rapidly than organisational size, making fraud behaviour substantially more erratic and unpredictable in larger systems.

These patterns are also qualitatively consistent with the empirical inconsistency in survey findings on organisational size and fraud [4,10]. Because volatility scales disproportionately with size, cross-sectional surveys capture larger organisations at varying points in their fraud cycle, producing highly variable results that are difficult to replicate across studies. The volatility finding therefore provides a plausible systemic mechanism for the empirical ambiguity that detection-based datasets alone cannot explain.

Fraud exhibits two distinct scaling regimes: a superlinear one for volatility and approximately linear scaling for both peak and average levels. This has implications for how fraud risk is measured. Focusing on aggregate incident counts captures only one dimension of this far richer dynamic. Periods of low detected fraud may reflect temporary stability rather than genuine control effectiveness, while episodic peaks can overwhelm safeguards in ways that average measures fail to anticipate. Attending to the full distribution of fraud behaviour, understanding its central tendency, its extremes, and its variability over time will provide a more accurate picture of systemic risk.

Implications for fraud theory

This paper introduces organisational scale as an explicit structural variable in occupational fraud research, demonstrating that varying organisational size produces a systematic divergence in the fraud dynamics observed. This extends the theoretical scope of computational approaches to fraud beyond Davis and Pesch’s [44] fixed-population design. Furthermore, the results establish fraud volatility as the key dimension of disproportionate risk in larger organisations. While both mean fraud and peak levels are approximately stable across organisational sizes, the instability of fraud dynamics grows substantially more rapidly. This distinguishes the risk profile of larger organisations not through higher average fraud, but instead through significantly greater unpredictability.

These contributions complement, rather than replace, individual-level frameworks such as the fraud triangle, which remains a valid account of why individual agents engage in fraud. The model’s decision rule is derived directly from Cressey’s framework and retained unchanged from Davis and Pesch’s design. What the present study adds is an account of why identical individual-level mechanisms produce very different aggregate outcomes depending on the structural scale of the system in which they operate. The fraud triangle explains the conditions under which fraud occurs at the individual level; organisational scale and network structure explain how much, how often, and how erratically it emerges at the system level.

Positioning within Critical Realism and Complexity Theory

As set out in the literature review, this study is grounded in critical realist and complexity-theoretic perspectives that conceptualise fraud as an emergent property of complex adaptive systems. The ABM operationalises these frameworks computationally. It represents the Real domain in Bhaskar’s [51,52] stratified ontology: a space in which generative mechanisms can be specified, activated and observed without the epistemic distortions introduced by detection bias and underreporting. Within the simulation, every fraudulent event is observable, enabling systematic exploration of mechanism–outcome relationships that detected-incident datasets cannot support.

The results reinforce Bunge’s [31] systemic view that individual actions cannot be understood without reference to the systems in which they are embedded. Fraud does not arise from individual dispositions alone: it arises from the interaction between those dispositions and the structural conditions that shape how motives, opportunities and social influences combine. The present study extends this perspective by demonstrating that organisational scale is one such structural condition, and that its effect on fraud dynamics is systematic and non-linear.

These results should nonetheless be interpreted as exploratory. The model is a deliberate simplification, with mechanisms and parameters that are theoretically grounded but not empirically calibrated. The patterns generated represent plausible system-level dynamics rather than predictions of behaviour in specific real organisations. They provide a basis for theoretically informed hypotheses that future empirical research can test.

Implications for policy and practice

Established approaches to fraud prevention have largely remained aligned with the fraud triangle perspective, even though Cressey himself did not intend his research to serve as a direct framework for prevention [21,53]. The simulation results indicate that organisational scale exerts a dominant structural influence on fraud outcomes, while interaction networks and susceptibility to social influence shape the variability of fraud activity. Larger organisations do not face disproportionately greater fraud exposure on average: mean fraud scales approximately proportionally with size, but the instability of fraud dynamics scales substantially more rapidly. Effective fraud prevention therefore requires attention both to the individual conditions that motivate misconduct and to the systemic features that drive volatility within organisations.

Controls aimed solely at influencing individual behaviour may reduce detected instances of fraud but do not necessarily address the deeper structural conditions that generate fraud risk [9]. In critical realist terms, organisational knowledge of fraud is confined to the Empirical domain, i.e., those incidents that are observed. Expanding detection capabilities, for example through data analytics, may reveal more fraud that has already occurred, shifting cases from the Actual to the Empirical domain. While this may enhance deterrence and accountability, it does not necessarily address the latent generative mechanisms that create new forms of fraud risk.

In practice, improving organisational culture is often seen as a central component of fraud prevention, typically through awareness and ethics programmes, leadership messaging, and improved communication across teams. However, the same interaction networks that allow ethical norms to spread can also transmit misconduct. Research on behavioural contagion shows that antisocial behaviour can propagate through workplace networks, sometimes more readily than prosocial behaviour [39–41]. The model results suggest that where employees are highly susceptible to the attitudes of those around them, fraud dynamics can become more erratic and volatile within organisational networks. This highlights a dilemma: strengthening communication and connectivity within organisations may promote ethical culture, but it can also accelerate the diffusion of harmful norms if misconduct becomes normalised within influential groups.

For practitioners, this implies that attention should be paid not only to formal control systems but also to the structure and operation of organisational influence networks. Interventions that focus solely on detection or individual deterrence may overlook the role of interaction networks and behavioural propagation. Techniques such as organisational network analysis can help identify highly connected individuals who shape norms across teams. Ensuring that these key actors reinforce organisational values may therefore be particularly important in preventing the normalisation of fraudulent behaviour.

A further implication concerns the resourcing of counter-fraud capability. Because average fraud levels scale approximately proportionally with organisational size, proportional increases in counter-fraud resources should, in principle, maintain equivalent control effectiveness over average fraud levels as organisations grow. The more challenging problem concerns volatility. The model shows that fraud volatility scales disproportionately with organisational size, but in real organisations, this volatility is largely invisible.

Organisational knowledge of fraud dynamics is confined to what is detected and reported: a series of snapshots rather than a continuous picture. Practitioners cannot observe the underlying distribution of fraud activity, only its occasional surface manifestations. This creates a structural resourcing problem that better measurement cannot fully solve. At times, fraud activity within a system may be at its lowest ebb; at others, the same system may be experiencing peak conditions that overwhelm existing controls. Neither state is predictable from the detected data available.

It is important to recognise that the invisibility of these dynamics does not diminish their reality or their consequences. In critical realist terms, the generative mechanisms that drive fraud volatility operate within the Real domain regardless of whether their effects reach the Empirical domain through detection. Unobserved fraud is not therefore an absence of fraud: it is fraud whose causal effects are being produced but not yet encountered. Controls that fail to account for this may appear effective while the underlying conditions for escalation remain intact and active.

The implication is not that organisations should invest in ever more sophisticated measurement in the hope of achieving complete visibility. Such visibility is not achievable in principle, given the inherently hidden character of fraud. Rather, counter-fraud systems should be designed with an explicit acceptance that a significant proportion of fraud dynamics will always remain unobserved, and that resilience to unpredictable variation, rather than optimisation for average conditions, should be a design objective for control frameworks in larger organisations.

For policymakers and regulators, the findings suggest that organisational scale and complexity should be explicitly considered when designing governance requirements. As organisations become larger and more interconnected, the number of potential interactions between employees increases, altering network structures and creating conditions in which fraud dynamics may become more volatile and unpredictable. Ensuring that oversight, audit, and investigative capacity are aligned with organisational complexity, and with the greater instability that complexity brings, may therefore be important in maintaining effective fraud control.

Beyond resourcing and governance, the scaling relationships identified in this study have implications for how organisations design and target counter-fraud interventions. Parameter regimes characterised by higher levels of connectivity and susceptibility to social influence are associated with higher levels of fraud volatility and greater dispersion in outcomes. In organisational settings, this suggests a need for more targeted, system-aware approaches that focus on identifying and managing high-risk interaction structures, such as densely connected networks or areas of strong behavioural influence.

These findings also highlight the limitations of evaluating fraud risk solely through detected incident counts. Periods of apparent stability may reflect temporary lulls rather than genuine control effectiveness, while episodic peaks may overwhelm existing safeguards. Attending to the full distribution of fraud behaviour—its average level, its peak, and its variability over time—therefore provides a more meaningful basis for organisational risk assessment than snapshot measures alone.

More fundamentally, these findings suggest that organisations would benefit from reorienting their approach to fraud risk identification away from individual-centred frameworks toward a more structural analysis of the conditions that make fraud possible. Building on the Fraud Field Theory framework developed in previous work [9,13], the present model supports an approach grounded in affordance mapping: the systematic identification of the structural and cultural conditions that create the situational affordances through which fraud becomes possible. This reframing locates fraud risk within the Real domain as a property of system design rather than as a consequence of individual intention and capability.

The fraud field can in this sense be understood as a structured space of potential: the configurations of controls, incentives, routines, and network structures that determine where and how fraud could plausibly occur. Meanwhile, detection activity functions as a mechanism for testing whether those potentials are being realised, rather than as a primary source of knowledge about risk. Crucially, this framing is durable across changing conditions: although the specific techniques and technologies through which fraud is committed evolve continuously, the underlying mechanisms by which organisational systems generate affordances for fraud are more stable. Risk identification grounded in affordances therefore targets the generative layer of fraud dynamics rather than its surface expressions. This is more consistent with the complexity-informed critical realist perspective developed throughout this paper.

In operational terms, this approach implies a different sequencing of fraud risk management activity from that typically found in practice. Where case-led approaches use historical detections as the primary means of identifying where risk resides, affordance mapping operates upstream: it identifies where within the system fraud could plausibly occur independently of whether it has yet been detected and directs investigative resources toward those areas accordingly. Detection then becomes a way of testing whether identified affordances are being exploited, building cumulative knowledge of the system rather than simply confirming what is already known. This is a meaningful shift, because case-led approaches are structurally self-reinforcing as they direct attention toward patterns that have already produced observable outcomes, leaving novel or emerging risks in shadow. Combining affordance-based risk identification with empirical case data allows organisations to work toward a more complete picture of their fraud exposure, attending to latent vulnerability alongside realised harm.

A related benefit of this approach concerns the confidence it can provide under conditions of irreducible uncertainty. Where affordances are identified through structural analysis and found to correspond to areas already covered by effective controls, this offers meaningful assurance that the control environment reflects the actual architecture of risk rather than simply the record of past incidents.

Where structural analysis reveals plausible pathways for fraud that are not currently addressed by controls, this constitutes a substantive signal of exposure that warrants attention irrespective of whether any cases have been recorded. The absence of detected fraud should not be taken as evidence of absence, as it may reflect the limits of detection capability rather than the absence of underlying activity. To interpret a clean detection record as confirmation of safety is to commit precisely the epistemic error that a critical realist framework cautions against: treating the boundaries of the observable as the boundaries of the real. Affordance mapping addresses this by anchoring risk assessment in what the system makes structurally possible, rather than in what it has so far revealed.

Ultimately, the results suggest that fraud control should be understood as the governance of complex organisational systems whose structural properties can amplify or suppress fraudulent behaviour as those systems grow, rather than as the attempted management of individual misconduct. These implications are necessarily tentative and should be interpreted as illustrative of how scaling dynamics may influence organisational fraud risk, rather than as prescriptive guidance applicable to all organisational contexts. The model provides insight into possible mechanisms through which fraud dynamics may arise, but further empirical work is needed to assess how these patterns manifest in real organisational contexts.

Limitations and directions for future research

Agent behaviour and parameterisation

Agent behaviour is governed by the simplified binary states for opportunity, motive and pro-fraud attitude, with equal initial probabilities assumed across all agents. This simplification captures the core logic of the fraud triangle but necessarily omits the psychological, social and organisational heterogeneity present in real workforces. Parameter values for susceptibility to social influence and network connectivity were selected to span a theoretically meaningful range rather than being calibrated to empirical data, meaning results should be interpreted as illustrating possible dynamics rather than estimating their real-world magnitude. Future research should explore continuous and heterogeneous representations of agent attributes and seek to calibrate key parameters using organisational data, such as internal audit findings, detected fraud incidents, or employee survey evidence on cultural susceptibility.

Empirical calibration and external validation

The simulation environment presented in this paper is closed: regulatory changes, economic shocks, technological developments and governance reforms are excluded. Additionally, every fraud event within the simulation is observable, whereas real-world datasets capture only detected incidents. Together these features mean that formal empirical validation is not undertaken, and the findings should be understood as plausible generative dynamics rather than estimates of real fraud rates in specific organisations. Collaboration with organisations possessing detailed records of communication patterns, transaction flows, or detected fraud incidents would enable the model to be applied to specific contexts and its outputs compared with observed detection patterns. This would provide a basis for iterative model development and empirical grounding.

Scope of modelled fraud

The model represents occupational fraud committed by internal agents against their employing organisation. It does not include fraud perpetrated by, or in collusion with, customers, suppliers or other external parties. The findings are therefore most applicable to organisations characterised by relatively dense informal interaction networks and less applicable to contexts where external fraud vectors or formal control environments dominate. Future research should extend the model to incorporate external actors and multi-party fraud scenarios to provide a more comprehensive account of the full range of organisational fraud risk.

Priorities for future research

Three directions are identified as the most important for researchers building on this work. Firstly, incorporating empirically observed network structures drawn from organisational communication records, reporting hierarchies, or transaction logs would allow the robustness of the scaling relationships to be tested under structurally realistic conditions. This would directly address the most significant limitation of the current model. Secondly, calibrating model parameters against specific organisational data, using partial indicators such as audit findings or detected fraud rates, would allow simulated vulnerability profiles to be compared with observed risk patterns, bridging the gap between exploratory simulation and practical application. Thirdly, using the calibrated model as a testbed for policy interventions through systematically varying governance structures, network connectivity, or cultural susceptibility to influence would enable the relative effectiveness of different counter-fraud strategies to be examined in a controlled simulated environment. This would provide theoretically grounded guidance for practitioners before real-world implementation.