THE Association of Certified Fraud Examiners has been counting this for thirty years, and its finding barely moves: a typical organisation loses about five percent of its revenue to occupational fraud every year. The 2024 Report to the Nations, drawn from 1,921 real cases across 138 countries, put identified losses at US$3.1 billion. Five percent is the estimate for what the world actually loses, most of which is never identified at all.
Apply that to ourselves. The FinScope MSME Survey Lesotho 2023 counted 138,723 micro, small and medium enterprises in this country, employing 255,420 people and turning over M964 (US$59.7) million a month — roughly M11.6 (US$0.72) billion a year. Five percent of that is in the region of M580 (US$35.9) million a year, walking quietly out of Basotho-owned businesses. Not stolen at gunpoint. Signed for, approved, filed and reconciled.
The figure is an application of a global benchmark rather than a Lesotho measurement, because no Lesotho measurement exists. That absence is itself part of the story.
Small firms do not lose small amounts
Reports are taken in Sesotho and English, without caller identification, and referred to the subscribing organisation under a reference number that lets the reporter follow the outcome without ever identifying themselves.
The most misunderstood number in fraud research is this one. Organisations with fewer than 100 employees recorded a median loss of US$141,000 per case. Organisations with more than 10,000 employees recorded US$200,000. The giant loses only marginally more in absolute terms — on revenue hundreds of times larger.
Translated into Maloti at present rates, the median case sits somewhere around M2.50 (US$0.15) million. For a Maseru wholesaler turning over M3.00 (US$0.19) million a year, that is not a difficult trading period. That is the end of the business, the end of eight jobs, and a family that will tell you the shop failed because of competition from across the border.
Lesotho is a country of exactly such firms. Eighty-three percent of our MSMEs employ five people or fewer. Seventy-six percent are not registered at all. They have no internal audit department, no segregation of duties, and very often one trusted relative sitting on the cash, the stock and the bank card at the same time.
The shapes it takes
What the announcement covers
Fraud arrives in three broad forms, and the cheapest one is the most common. Asset misappropriation — ordinary theft of the company’s things — appeared in 89 percent of cases. This is the category most Basotho business owners will recognise once they go looking: cash skimmed before it reaches the till roll, ghost workers drawing a wage nobody has ever met, fuel cards filling vehicles that never moved, stock signed into a storeroom it never entered, petty cash floats that have been short for six years.
Corruption — kickbacks, bid-rigging, undisclosed dealing with a related party — appeared in 48 percent of cases. In a country this size the mechanism is rarely exotic. It is the supplier who always wins, the cousin who was awarded the contract, the job that was sold to the applicant who paid for it. Lesotho scored 37 out of 100 on Transparency International’s 2025 Corruption Perceptions Index, ranked 99th. Firms do not operate outside that number. They operate inside it.
Financial statement fraud — cooking the books — appeared in only 5 percent of cases. It is rare and it is ruinous, and it is usually the last stage of something that began as one of the other two.
The World Bank’s Enterprise Survey put numbers on the visible end of this in Lesotho: 24 percent of firms reported losses from theft, robbery, vandalism or arson on their premises, and among those affected, the losses averaged 17.3 percent of annual sales — up sharply from 5.8 percent in the previous round. And that counts only what happens where somebody can see it. Internal fraud does not appear in that survey at all.
“A firm that cannot say why the money is short does not call it fraud. It calls it a bad month, then a bad quarter, and then it calls in the landlord.”
Twelve months in the dark
The median fraud scheme in the ACFE data ran for twelve months before anybody caught it. A year is long enough for a small business to burn through its reserves, default on a supplier, lose its credit terms and close — all while the books reconcile, because the person doing the reconciling is the person doing the taking.
How the decision lands
This is why cashflow is the most common complaint of Basotho business owners and fraud is almost never the diagnosis. FinScope found 21 percent naming cashflow as their principal challenge. Cashflow is not usually a cause. It is a symptom, and internal theft is one of the conditions it presents.
Lesotho publishes no statistics on why businesses close. We know how many open. We do not count what killed the ones that did not survive, so fraud is never listed as a cause of death, and a loss that is never named is never budgeted against.
Managing it as a risk, not an incident
The instinct when fraud is discovered is to treat it as an event: dismiss the person, recover what can be recovered, move on. Firms that do only this are usually defrauded again within a few years, because the person left but the opening did not.
Enterprise-wide risk management is the discipline that closes the opening. It does not require a large company or an expensive consultant. It requires that fraud be written down as a standing risk alongside drought, exchange rates and load-shedding, and then managed like one. In practice that means a register naming each exposure the business actually has — payroll, procurement, stock, fuel, cash handling, mobile money, system access — and, against each, a named owner, the control meant to contain it, the test that proves the control works, and a date when somebody senior looks at it again.
It means separating duties so that the person who orders is not the person who receives and not the person who pays, even in a firm of six. It means the board or the owner setting a tone that is visible rather than asserted. And it means accepting, in advance, that no combination of preventive controls catches everything — which is the point at which detection stops being optional.
The cheapest control in the building
What happens next
Here the evidence is unusually blunt. Frauds were detected by tip in 43 percent of cases — more than internal audit (14 percent), management review (13 percent) and external audit (3 percent) put together. The external audit that a Lesotho company pays thousands of Maloti for each year detects three cases in a hundred. A human being who decided to say something detects forty-three.
And organisations with an anonymous reporting hotline suffered fraud losses roughly half the size of those without one. Half. No other single control in the study produces that result at anything approaching the price.
That is the arithmetic behind BlowIt. Until now, a Lesotho company that wanted a properly run reporting line had to buy one from South Africa — priced for South African corporates, answered in a language many Basotho workers do not report comfortably in, and sold separately from the investigation, the charge sheet and the root cause work that has to follow a disclosure. For the overwhelming majority of firms in this country, that made the single most effective anti-fraud control on record something only the largest employers could afford.
BlowIt is a domestic service, on a toll-free national number — 80012369 — answered in Sesotho and English, anonymous by design, and priced for businesses that employ six people rather than six hundred. A subscription costs a fraction of an annual audit fee, and on the global evidence the channel it opens detects fourteen times as many frauds as that audit does.
None of this makes a reporting line a substitute for controls. It is the last line, not the first. But it is the line that is answered by the people who already know — the storeman who watched the delivery that never arrived, the clerk asked to process a transfer she could not explain, the driver told to sign for a trip he did not make. They are not waiting for an auditor. They are waiting to be asked, safely.
The cost of silence never appears in a set of accounts. It appears as the business that is simply not there the following year, and the eight people who used to work in it.
BlowIt is Lesotho’s anonymous, toll-free whistleblowing service for the private sector. Reports are taken in Sesotho and English, without caller identification, and referred to the subscribing organisation under a reference number that lets the reporter follow the outcome without ever identifying themselves.
Reporting line (toll-free): 80012369 Subscriptions: +266 5888 2369
Economy
