On the Case: A calculated breach – When a trusted employee manipulates the system

On the Case: A calculated breach – When a trusted employee manipulates the system

Business, Human Resources, Payroll / eTorQue

Author: Nicky Hardwick

This month, we examine a complex case of sustained and deliberate dishonesty involving a senior employee whose knowledge of internal systems became a tool for significant financial misconduct. Despite years of good service, a trail of falsified overtime claims, manipulated data, and ignored instructions exposed deep-rooted fraud, and triggered summary dismissal.

The situation

A senior manager at a healthcare facility, responsible for vetting overtime claims and overseeing staff operations, was found to have manipulated payroll and patient records over a prolonged period. The issues came to light following a tip-off and internal review. The resulting investigation uncovered more than 27 incidents of dishonesty, including:

  • Falsified overtime submissions
  • Duplicate and retro-dated patient entries
  • Payment claims for procedures he did not perform
  • Manual adjustments to Excel spreadsheets using hidden white-font entries
  • Ignoring clear managerial instructions

Despite a clean disciplinary history and a decade of service, the scale and premeditation of the fraud left the employer with little room for leniency.

The impact

  • Estimated direct losses of over R525,000 from December 2023 to April 2024, with additional losses still being quantified
  • Breach of trust at leadership level
  • Risk of reputational harm had the fraud been externally exposed
  • Damage to internal morale and systems accountability

The defence

The employee claimed:

  • The call logging system was insecure and could be accessed by others
  • He wasn’t aware of discrepancies in his own claims
  • Any mistakes were unintentional and systemic
  • He believed he had implicit authorisation for certain practices

However, the evidence didn’t support these claims. For example, the hidden white-text entries in spreadsheets showed deliberate concealment. Cross-checks of other employees’ records showed no such anomalies. Witnesses, including those brought by the employee, failed to back his version of events.

Lessons learned

  • Trust is not a policy, it’s a practice: The employer’s greatest mistake was trusting one person with sole oversight over key financial processes. Separation of duties and cross-checking mechanisms are essential, even for long-serving, “trusted” team members.
  • System access = system vulnerability: Employees with knowledge of your processes and loopholes are best positioned to exploit them. Regular audits and role-based access reviews are critical.
  • Documentation trumps defence: Despite his claims, the evidence – call sheets, patient records, and spreadsheets – painted a clear picture. Employers should always prioritise thorough digital documentation in investigations.
  • Excuses don’t erase impact: While personal pressures, length of service, or claims of misunderstanding may soften perception, they don’t negate financial loss or the breach of fiduciary responsibility, especially for those in senior roles.

The outcome

The employee was found guilty on all charges of gross dishonesty, fraudulent conduct, and insubordination. The recommended sanction: summary dismissal. The Chairperson noted that while personal and tenure-based mitigating factors existed, the scale and intention of the misconduct broke the trust beyond repair.

Key takeaways for employers

  • Create layered approval structures: No one employee should handle both submission and verification of claims.
  • Perform regular system audits: Audit logs, timestamps, and access control are your frontline defence.
  • Define clear callout and overtime protocols: Avoid grey areas by ensuring policies are written, communicated, and enforced.
  • Investigate before assuming intent: However, once dishonesty is proven, act decisively.

How we can help

We support employers in:

  • Drafting fraud-resistant policies and claim procedures
  • Conducting independent and fair disciplinary hearings
  • Auditing internal systems for vulnerabilities
  • Rebuilding controls after trust breaches

Need help safeguarding your workplace from internal risks? Contact us at [email protected]