Which of the following is the most common way that occupational fraud is detected?