Most internal fraud does not start at the top. It hides in trusted employees, routine exceptions, weak controls, vendor relationships, payroll, and everyday business activity that no one questions soon enough.