Fraud Risk in Self-Built Systems: When Generative AI Outpaces Internal Controls in Small Businesses

Abstract

Purpose: Generative artificial intelligence (GenAI) is making it practical for small businesses to build their own operational and financial systems without a vendor or implementation team. This paper examines the fraud risks that arise when such systems become a firm’s book of record, and it develops a framework that fraud examiners and auditors can use to evaluate them.
Design/methodology/approach: The paper combines conceptual analysis grounded in fraud theory, internal-control frameworks and audit-evidence standards with an illustrative practitioner case: the development, by a Certified Fraud Examiner, of a GenAI-built enterprise resource planning (ERP) system for a family-owned industrial sewing-machine business in Lagos, Nigeria.
Findings: Self-built systems start with no inherited controls. Five mechanisms amplify fraud opportunity: concentrated access, mutable records without change history, untested business logic, unvalidated data migration, and key-person dependency on the builder. Because GenAI produces polished outputs, these weaknesses can be harder to see, since the system looks more formal than the process behind it. The paper proposes a five-question examination framework that links each mechanism to procedures, evidence and a graded reliance decision.
Research limitations/implications: The framework is derived from one build and from established theory; it has not yet been field-tested across examinations. Propositions for empirical testing are provided.
Practical implications: Examiners should not give system-generated reports more evidentiary weight because they resemble commercial software output, and should consider early preservation where one person controls the system.
Originality/value: The paper identifies a new category of evidence risk, the AI-generated, owner-built book of record, and translates existing fraud and audit principles into practical procedures for it.