Fraud schemes vary considerably, but many share a common characteristic: they do not begin with dramatic acts of misconduct. Instead, they often develop within routine processes that have become familiar, overlooked, or insufficiently monitored. Organizations often focus on the individuals who commit fraud, but the conditions that enable fraud are frequently easier to identify and address. That distinction matters because, according to the Association of Certified Fraud Examiners, 70% of occupational fraud cases involve at least one of the following underlying weaknesses: a lack of internal controls, management override of controls, or insufficient management review1. In senior living facilities, those weaknesses can place both organizational and resident assets at risk.
Weakness 1: Controls that exist only on paper
Most organizations don’t lack documented controls. In many cases, they have controls that were thoughtfully designed and implemented years ago. Over time, however, personnel changes, operational pressures, staffing shortages, evolving technologies, and informal workarounds can gradually weaken the control environment, even though nobody consciously decided to change it.
When employees can bypass established processes, override approvals, or make adjustments without meaningful challenge, those weaknesses can create opportunities for fraud. The risk, therefore, isn’t necessarily the absence of controls, but misplaced confidence that existing controls are functioning as expected.
This challenge often appears in routine transactions that receive little scrutiny because they seem ordinary. In senior living, one such area is resident billing and accounts receivable. Resident accounts may include payments from residents or family members, adjustments, write-offs, contractual allowances, refunds, and changes associated with admission, discharge, or level of care. Most of that activity is legitimate. However, the volume and complexity of the transactions can also help conceal a diverted payment when the same employee who receives or posts the payment can later adjust, reverse, or write off the balance.
Resident trust accounts present a similar risk. A facility may have a written requirement for monthly reconciliations and resident-level accounting, but that control offers limited protection if no one reviews the reconciliations or if a single employee controls deposits, withdrawals, ledger entries, supporting documentation, and the reconciliations. In investigations conducted by our team, improper disbursements were concealed through false entries in individual resident accounts, necessitating reconstruction of the transactions to determine the losses attributable to each resident.
Organizations should periodically evaluate whether controls are operating as intended, including whether employees consistently follow established processes and approvals involve meaningful scrutiny. Data analytics can provide an additional layer of testing by identifying activity that may reveal a control failure, such as payments followed by account adjustments, recurring write-offs by the same employee, refunds issued to someone other than the original payer, or transactions recorded after a resident’s account was closed. Identified exceptions should then be independently reviewed to determine whether they have a legitimate business explanation or warrant further investigation.
Weakness 2: Lack of visibility
The warning signs of fraud often emerge gradually through unusual or unexplained account activity, policy exceptions, or concerns raised by employees, residents, or family members. When organizations lack visibility into these indicators, problems can persist far longer than they may otherwise.
Resident trust accounts can be especially difficult to monitor because they may contain a high volume of individually small deposits, withdrawals, transfers, and personal-needs expenditures. No single transaction may appear significant. As a result, questionable activity can blend into ordinary resident activity, particularly when reviewers focus on whether the reconciliation balances or whether the ending bank balance appears reasonable. Periodic reviews and occasional surprise audits can help organizations identify irregularities that might go undetected.
A complete review should look beyond the aggregate bank balance. The trust-account bank balance should agree with the related control account, the control account should agree with the total of the individual resident ledgers, and selected withdrawals should be traced to receipts, authorizations, and the appropriate resident account. Reviewers should also examine the volume and direction of activity, including transfers between operating and resident trust accounts, repeated cash withdrawals, disbursements to employees or their relatives, and transactions involving residents who have been discharged or whose accounts should have been closed.
Organizations can gain further insight by comparing financial activity with operational information already available to them. Examples include comparing temporary staffing invoices with facility schedules, food and resident-supply purchases with census information, transportation invoices with trip logs, and maintenance charges with work orders. Unexplained differences do not establish that fraud occurred, but they can direct limited review resources toward transactions that merit closer attention.
Visibility should extend beyond financial records. Employees, residents, family members, vendors, and caregivers often observe issues long before they appear in reports or reconciliations. Establishing a confidential reporting mechanism provides an important channel for these concerns to be raised and investigated appropriately. Just as importantly, organizations should communicate clear anti-retaliation policies, so individuals feel comfortable speaking up when something seems amiss.
The goal isn’t to monitor every transaction or anticipate every fraud scheme. Rather, it’s to make unusual activity easier to identify, concerns easier to report, and potential issues easier to address before they escalate.
Weakness 3: Concentration of authority
Risk increases when a single employee can initiate, approve, record, and reconcile transactions with little or no independent oversight. Conversely, fraud becomes more difficult to commit and conceal when those responsibilities are divided among multiple individuals.
This challenge is particularly common in senior living facilities, where lean administrative teams often require employees to wear multiple hats. While such arrangements may be operationally necessary, they can also create opportunities for improper activity to occur undetected, particularly when overlapping responsibilities permit one person to complete and conceal an improper transaction.
Payroll and purchasing are two areas where these concentrations of authority can occur. Senior living organizations often operate around the clock with high employee counts, shift-based schedules, overtime, shift differentials, temporary staffing, and frequent timecard corrections. Risk increases when the same person can add or reactivate an employee, modify pay information, enter time, and approve payroll changes. On the purchasing side, decentralized facility-level buying can create opportunities when a single employee can establish a vendor, approve an invoice, and confirm receipt of goods or services.
Leaders should ask specific questions: Can the same employee initiate and authorize a transfer between operating and resident trust accounts? Can someone who receives or posts resident payments also approve adjustments, write-offs, or refunds? Can payroll be issued to someone who does not appear on the current staffing schedule? Can a facility approve maintenance, temporary staffing, or resident-supply invoices without a work order, schedule, receiving record, or other evidence that the goods or services were provided?
Organizations can reduce this risk by establishing a clear separation of duties around financial processes. When limited staffing makes full segregation difficult, the compensating review should be designed around the actual risk. An independent reviewer might receive bank statements directly, compare canceled checks with the accounting system, review changes to vendor and direct-deposit information, inspect unusual receivable adjustments, and select trust-account withdrawals for supporting-documentation testing. The reviewer should be sufficiently removed from the day-to-day process to question transactions and investigate exceptions, rather than simply confirming that required steps were completed.
The bottom line
Senior living organizations cannot eliminate every fraud risk. They can, however, make fraud harder to commit and conceal by addressing the weaknesses that create opportunities for it in the first place. Many senior living facilities operate amid competing priorities, making it difficult to implement every safeguard or maintain the level of oversight leaders would like.
That reality doesn’t diminish the importance of fraud prevention. Rather, it reinforces the need to understand where vulnerabilities are most likely to exist and where limited resources can have the greatest impact. Even incremental improvements to controls, accountability, and visibility can meaningfully reduce opportunities for fraud.
For organizations seeking to strengthen their fraud prevention efforts, an independent assessment can provide an objective perspective on existing controls and help identify areas where additional safeguards may be warranted.
