The fraud triangle (不正のトライアングル) is a framework holding that people are prone to commit fraud when three elements come together: opportunity, motivation, and rationalization.
Fraud triangle
Opportunity (a gap that lets it happen)
Motivation (a reason or pressure to do it)
Rationalization (an excuse to oneself)
It is used to explain why fraud committed by people inside an organization (insider fraud, 内部不正) happens. The idea grew out of research by the American criminologist Cressey, who studied people who had embezzled money.
AnalogyA fire flares up where fuel, heat, and oxygen meet. Fraud, too, becomes likely when three conditions overlap.
How to rememberPicture a triangle: if any one of its three sides is missing, the shape will not close.
Exam points
ExamWhen fraud occurs, all three elements are considered to be present at the same time, with none missing.
Opportunity (機会) is a gap in workplace systems or controls that lets someone carry out fraud once they decide to.
Examples include a single staff member who can handle everything from receiving a payment to recording it in the books without anyone checking, or accounts of former employees that are left undeleted. The organization itself can shrink this element by separating privileges and reviewing operation logs regularly.
AnalogyThink of a shop floor with no staff around. The very state of being able to walk off with goods without paying is the opportunity.
Exam points
Mix-upOpportunity (機会) is the state in which fraud can be carried out, a separate element from motivation (動機), which is the reason or pressure that makes someone want to do it.
Motivation (動機) is the personal circumstances or pressure that drive a person toward fraud.
Examples include worries over living costs or debt, feeling cornered by a sales target that is hard to reach, and strong dissatisfaction with one's performance review. Because it is rooted in a person's own circumstances and feelings, an organization can hardly eliminate it entirely, but an easy-to-reach consultation desk and realistic targets can weaken it.
AnalogyIt is like hunger. The hungrier you are, the more you want to reach for the food in front of you.
Exam points
ExamMotivation (動機) is one of the elements that make up the fraud triangle (不正のトライアングル).
Rationalization (正当化) is the way of thinking that cancels out guilt by finding reasons why committing fraud does not put oneself in the wrong.
Excuses such as “I'm only taking back the overtime pay I never got” or “I'm just borrowing it and will return it soon” fit here. The countermeasure is to build a workplace climate where such excuses do not hold up, through ethics training and publicizing a code of conduct.
AnalogyIt is like telling yourself “everyone does it” and letting yourself cross on a red light.
How to rememberThe English word rationalization comes from the Latin ratio (reason), so remember it as the mind's habit of making up reasons.
Exam points
Mix-upRationalization (正当化) is the excuse that convinces oneself fraud is acceptable, and it works differently from motivation (動機), the reason or pressure that pushes someone toward fraud.
Human vulnerability (人的脆弱性) is a weakness that lies with people rather than with equipment, such as carelessness, lack of knowledge, or being easily deceived.
Human weakness (example: opening a received link without checking it)
A threat exploits the weakness (example: luring to a fake login page)
Damage (example: ID and password stolen)
Once the weakness is exploited, damage such as stolen information follows.
3 / 3
A vulnerability is a weakness that can be exploited by a threat (a cause that can bring about damage). Human vulnerabilities include reusing the same password and forgetting to lock the screen when leaving one's desk, and they are reduced step by step through education, training, and publicizing rules.
AnalogyEven a sturdy safe is pointless if its combination is written on a sticky note stuck to the door. The weak point is not the safe but the person using it.
Exam points
ExamA vulnerability (脆弱性) is the weakness on the side that a threat (脅威) exploits, distinct from the threat itself, which is the cause of damage. Poor management or handling of authentication information by people is also a vulnerability.
ExamStaff with low security awareness make an organization easy prey for tricks that deceive people into revealing information (social engineering, ソーシャルエンジニアリング).
Mix-upHuman vulnerability (人的脆弱性) is a weakness in people's behavior and awareness, so it sits in a different place from technical vulnerabilities such as program bugs.
Shadow IT (シャドーIT) refers to devices or services that employees use for work without the organization's approval or control.
Company-approved IT
Shadow IT
Permission to use
Approved by the IT department
Not approved
What the department can see
Usage and settings are visible
Even the fact that it is used goes unseen
Where information is kept
Places the company manages
Devices or services the company does not know about
Examples include editing internal documents on a personal laptop that was never registered, or talking with customers through a chat tool the company has not approved. Because the organization cannot track what information is where, it tends to be slow to notice data leaks or virus infections.
AnalogyIt is like secretly making a spare house key without telling your family and leaving it somewhere. It is handy for you, but whoever looks after the house knows neither how many keys exist nor where they are.
How to rememberShadow means the dark corners a manager's eye cannot reach: IT used out of sight of the department in charge.
Exam points
ExamHandling business data on an external service the company has not approved counts as shadow IT (シャドーIT), even when the aim is convenience and there is no ill intent.
Mix-upShadow IT covers not only personal devices but also unauthorized use of intangible services, such as free cloud services (クラウドサービス).
The fraud triangle holds that people are prone to fraud when all three elements, opportunity, motivation, and rationalization, are in place.
Anti-fraud measures are designed to shrink one of the elements, for example reducing opportunity by separating privileges.
Weaknesses caused by low awareness or lax management cannot be closed by technical measures alone, so education, training, and publicizing rules are at the core of the response.
Shadow IT is the business use of unapproved devices or services, and because the organization cannot see that use, it tends to notice data leaks and similar problems late.