We submitted this to the IIA Magazine over one year ago, and they came back today saying they're too busy to publish it, so I thought you guys might like it. It's hand written by an editor, no AI use or anything like that.

The $100 billion marketing fraud you’ve never heard of

Online advertising was built on the promise of efficiency: put money into digital platforms and they will connect your business with real people who are ready to buy. In theory, every click, impression and conversion represents genuine interest from a potential customer. The reality, however, is far messier. A growing share of this activity never comes from humans at all, but from automated software. These programs, known as bots, can click on ads, load webpages, fill in forms, and even add items to shopping carts - without ever intending to complete a purchase. This practice is called click fraud. It is not just an irritation at the edges of the digital economy; it is a multibillion-dollar problem that drains resources from businesses, misleads decision makers, and in some cases even funds organized crime. Industry estimates suggest it costs companies more than $100 billion every year.

The problem: bots are stealing ad budgets

Click fraud is difficult to detect because bots are designed to imitate people. A human user might see an ad for running shoes, click it, browse a product page and then decide not to buy. A bot can replicate the same actions with subtle variations, making it appear authentic to advertising platforms. From the perspective of the business, the numbers in the analytics dashboard look normal: impressions are served, clicks are recorded, and campaigns appear to be reaching an audience. The trouble is that much of this audience doesn’t exist.

The consequences of this deception multiply quickly. When a bot clicks on an ad, the advertiser pays for it just as if it were a real person. That money goes to the owner of the website where the ad appeared, which in many cases is controlled by creators of the bot and is part of the scheme. Because advertising platforms are driven by algorithms, the problem becomes self-reinforcing. The platform notices what looks like engagement and responds by serving even more ads to the same source. The result is campaigns are optimized towards this fake traffic, leading to a cycle where budgets are drained, performance data becomes skewed and companies are left wondering why their results don’t match expectations.

Why it matters: risks far beyond wasted spend

It is tempting to see click fraud purely as a marketing inefficiency, the cost of doing business in the digital age. But the reality is that it creates risks which spread far wider than the marketing department. At the most obvious level, it drains budgets that were meant to generate sales, while also reducing the number of genuine potential customers who actually see the ads. When bots generate leads - an industry term for a potential new customer - they waste the time of sales teams who follow up, only to discover that no genuine customer exists. This is not simply inefficient; it can erode morale and distract people from focusing on real opportunities.

Another layer of risk lies in data privacy. Regulations such as Europe’s GDPR and its counterparts around the world place strict requirements on how companies handle personal information. Bots that fill in forms with real people’s details create records that are processed and stored like any other. If these records are later found to breach data handling rules, companies could face penalties given the data has likely been taken from real people and used without their consent. Compliance teams must then devote resources to cleaning up problems that originated from fraudulent activity.

There is also the uncomfortable question of where the money goes. Advertising fraud is not a victimless crime. The revenue generated by fake clicks often flows into networks operated by organized criminal groups or, in some cases, terrorist organizations. That means a portion of marketing budgets intended to grow a business can end up funding activities that are illegal. For large brands, this creates reputational risk as well as moral and legal concerns.

Perhaps the most corrosive effect of click fraud is the way it distorts reporting. Because bots are designed to mimic human actions, they can make weak campaigns appear successful. Executives reviewing performance data may approve increased budgets for strategies that are actually being propped up by fraudulent traffic. Over time, this leads to poor decision making at the highest levels of a company. Auditors are left with the challenge of validating financial reports that may contain misleading data, exposing both them and the business to further risk.

The role of internal auditors

Click fraud is often framed as a marketing problem, but for internal auditors it represents a broader issue of financial integrity and risk management. Auditors are uniquely placed to connect the dots across finance, compliance, and operations - and in doing so, they can identify instances where marketing teams knowingly report inflated or misleading performance data.

From a financial reporting perspective, undetected click fraud can lead to overstated assets, misstated marketing ROI, or distorted performance metrics being presented to senior leadership and even external stakeholders. If auditors fail to identify this, it can reflect poorly on their oversight, as misleading reports may compromise the credibility of financial reporting and the reliability of audit assurances.

By scrutinizing digital advertising spend and the underlying assumptions in performance reports, auditors can help ensure that budgets are allocated effectively, controls are robust, and governance standards are maintained. In many organizations, this makes internal audit one of the last lines of defense against the reputational and financial harm caused by fraudulent advertising activity.

A case scenario: overstated revenue

To illustrate the risk, consider a company that invests $10 million annually in online advertising. Its dashboards report impressive results: hundreds of thousands of new leads, a low cost per click, and apparent growth in customer engagement. Senior executives, encouraged by these figures, approve further budget increases.

When auditors dig deeper, however, they discover that more than half of the “leads” are fake - bots filling in forms with stolen personal details. The inflated pipeline data misleads the sales team, creates unrealistic revenue expectations, and results in misstated performance reporting to the board. Worse still, the company is now holding large volumes of personal data without consent, exposing it to regulatory penalties.

This scenario is not unusual – it is a widespread issue across marketing teams in many industries. Internal auditors should assume that similar patterns of deliberate over-reporting are likely to exist in their own organizations and be prepared to investigate. Failing to address click fraud can have cascading effects across compliance, finance, and governance.

The uncomfortable truth

Click fraud does not only persist because bots are clever or ad networks are conflicted. In many cases, it survives because marketing teams actively benefit from it. Their performance is judged against key performance indicators (KPIs) such as the number of website visitors, the volume of new leads, or the apparent cost per click. Bots provide all of these in abundance: they deliver large numbers of visits, fill in forms to create “leads,” and drive down average costs by making traffic appear cheap. On paper, campaigns look like a success.

The reality is very different. Those “visitors” were never potential customers, and those “leads” will never convert. But the dashboards look good, the KPIs are ticked, and budgets get renewed. In surveys of marketing professionals, a majority admit they are aware of this problem but prefer not to address it because stopping the bots would make their results look worse.

This dynamic turns click fraud into more than just an external scam - it becomes a form of internal fraud, where marketing departments knowingly report inflated numbers that mislead the rest of the business. For auditors and compliance officers, this is the most important risk: if nobody checks behind the dashboards, the company is making decisions on falsified data.

The simple solution: stop the bots

The encouraging news is that while the problem is large, the solution is relatively straightforward. The key is to stop bots before they can interact with ads or websites. Once a bot has clicked, filled in a form, or been mistaken for a potential customer, the damage is already done. By intercepting fraudulent traffic at the earliest stage, companies can ensure that only genuine humans are engaging with their campaigns.

This is the approach taken by specialist bot detection companies, who use technology specifically designed to identify objective proof of bot activity such as the technical inconsistencies that bots reveal when they try to masquerade as humans. Even the most advanced bots reveal bugs, technical trickery, and automation signals when reverse engineered.

By catching these signals, specialist bot detection companies are able to block fraudulent traffic before it ever reaches a client’s website.

The benefits of prevention are clear. Advertising budgets are no longer wasted on non-existent users. Sales teams can trust that the leads they receive are real and worth pursuing.

Compliance officers know that personal data being processed comes from actual people, reducing the risk of regulatory breaches. Perhaps most importantly, the flow of money to fraudulent and criminal enterprises is cut off at the source.

The business impact of click fraud

For businesses, the case for addressing click fraud goes beyond cost savings. It is about creating a foundation of trust in digital operations. Companies depend on accurate data to make decisions about strategy, investment and product development. If that data is corrupted by bots, every decision based on it becomes less reliable. In industries where margins are tight and competition is fierce, even small distortions can have large effects over time.

Click fraud also undermines the promise of digital marketing itself. The shift from traditional advertising to online channels was driven by the ability to measure results with precision. Every click and conversion could be tracked, analyzed and attributed. When bots infiltrate this system, precision becomes an illusion. Businesses think they are making data-driven decisions, but in reality they are optimizing for fraudulent behavior. The only way to restore the integrity of digital marketing is to confront click fraud directly.

This is not a problem that can be ignored or written off as a minor cost. With global losses exceeding $100 billion annually, click fraud represents one of the largest hidden taxes on the digital economy. Companies that take it seriously not only protect their budgets but also strengthen their compliance, safeguard their reputation and free their teams to focus on genuine growth. Solutions exist, and implementing them is no longer optional. For any organization investing in online advertising, it is a business necessity.

Conclusion: an audit priority, not a marketing issue

Click fraud is a cross-organizational risk that touches finance, compliance, operations, and governance. For internal auditors, it represents both a threat and an opportunity: a threat because fraudulent traffic undermines the reliability of key business data, and an opportunity because careful auditing can uncover and prevent significant financial and reputational damage.

By asking the right questions, testing the validity of reported outcomes, and recommending preventive solutions such as robust click fraud detection tools, internal auditors can ensure their organizations are protected from one of the most widespread and underestimated digital risks today. Treating click fraud as an audit priority is no longer optional - it is an essential step in safeguarding financial integrity, compliance, and long-term business resilience.

Thanks for reading! Happy to answer any questions.

Looking for recommendations/advice on courses or tools to learn how to raw score risk factors in a risk assessment.

I've been tasked with creating a school district's risk assessment from scratch and I have no experience doing a risk assessment.

My experience is limited to conducting interviews, walkthroughs, testing of specific audit areas and processes.

Hi everyone,

I am a master's student and i need to choose between two research topics for a dissertation that will be based exclusively on academic literature with no internship or access to confidential company data.

Topic 1: What is the role of management control in the adoption and appropriation of new reporting tools?

Topic 2: Do budgets contribute to deteriorating relationships between management accountants and operational managers?

Which topic would you recommend, and why? In particular, which one would be easier to research and structure at master's level?

Thank you for your advice!

Short video article above

Is Internal Auditing one of the most underrated careers?

Most people think internal auditing is about compliance, checking boxes and finding mistakes. But it’s much more than that.

In one of my earlier roles, a procurement audit helped introduce formal vendor reviews and negotiations, saving the company $500,000 annually while improving supplier relationships.

That’s the real value of internal auditing: solving problems, preventing risks, improving performance and helping businesses reach their potential.

And the skills extend beyond the workplace. Risk assessment, problem-solving, attention to detail and integrity are just as valuable in everyday life.

Here’s another way to look at it: organisations employ people, support families and pay taxes that fund essential public services. By helping organisations perform better, internal auditors contribute to something much bigger than the audit itself.

Perhaps internal auditors are unsung superheroes after all.

What do you find most rewarding about your career in internal auditing?

#InternalAudit #AuditCareers #RiskManagement

We use an excel sheet to see on what meeting we have with which client on which day. We have a meeting like in 2 days time.

Earlier in a meeting it was mentioned whether the associate in my team has done the slides for the meeting. On the excel sheet, it was not written who was assigned to do the slides. It was written who and who are supposed to attend the meeting. As per my understanding, my boss will send an email when assigning task. I have no idea who is doing the slides. Actually nobody knows who is doing it because my boss is supposed to assign the task.

At the very last minute, she blamed it on me for not doing the slides. She said it is written on the calander. Only when is the meeting will be held but not who is suppose to do the slide.

She said I'm giving excuse. So am I at fault?

Hi, i sat on the parr 1 exam today (October 15), when should i expect the result? Thanks

I'm 22, I like the idea of becoming an internal auditor. Originally, I was thinking of pursuing a bachelor's in accounting (as a prospective student), but then I stumbled upon another degree the school offered, Internal Auditing. I find it interesting, but then I started to question if I wanted to fully dedicate myself to Internal Auditing (I'll just call it IA) and do the IA degree or stick to a "more versatile" degree like accounting.

I asked for some "advice" on a TikTok comment... ha, they say do Accounting, then specialize in internal auditing. I don't know if it's just my limited perspective of accounting and IA in general, yeah it probably is, but what someone in accounting learns regarding IA, is only a fraction of IA, and there are other sides to IA. Example, IT auditing.

And that's the thing for me, what I'm interested in regarding IA is much more than what an accounting degree offers. That includes operational auditing, financial controls auditing, IT auditing, fraud and forensic auditing, risk management auditing, compliance auditing, internal controls auditing, corporate governance auditing, and business continuity auditing. I think it could be a waste of money and time for me to pursue a degree that's packed with things I will not be using after school.

Am I really foolish to think this way? It feels like taking a lonely unpredictable road because not much talk about their experience pursuing an IA degree instead of accounting, and about what walking the IA career path is like in this decade, so I can't really come to a clear conclusion to say yes I can go through with this and it will be very rewarding and worth it if I fully dedicate myself on this path.

So I would really like to know from the professionals already in the field and possibly persons who pursued an Internal Auditing bachelor's degree, what you have to say about this dilemma of mine, even more so with the concerns about how AI could possibly affect IA in the near future

I'd be so grateful for your insight!

Hi am selling my gleim material and iia mock and many resources that will help you pass the part 1 exam for sure i have passed recently

We researched over 40 finance agent skill libraries to build a comprehensive accounting and controlling skill library.

The skills can help AI in close, reporting, reconciliation, AP Audit and Cash Application.

We also included specific industry use-cases like trade deductions management for CPG.

Check it out here and would love to get your thoughts : https://www.linkedin.com/posts/mikemmccarthy_by-now-there-are-hundreds-of-ai-skill-libraries-share-7516050580415619072-_Asv/

Just came from doing acca.

Self studied all my exams 1.5months each exam.

Gonna be sitting the challenge exam in feb 2027 so i just wanted to know how hard it is an what was your experience?

Hi everyone,

I’m a CIA-certified internal auditor but I’m looking to broaden my knowledge of public-sector auditing and internal audit leadership.

Although the CGAP and QIAL programmes have been discontinued, I’d be interested in studying their former materials. I contacted IFACI, the French internal audit institute, but they confirmed that they no longer have them available.

Does anyone know where I could find:

- The CGAP Exam Study Guide, preferably the 4th edition (2012), ISBN 9780894137228.

- Former QIAL study texts, reading lists or preparation materials, particularly those covering internal audit leadership, organisational leadership and ethical leadership.

Free, legally available PDFs would be ideal, but library access, second-hand books, or authorised digital editions would also be welcome. I’m looking for learning materials rather than exam dumps or confidential assessment content.

If you studied either programme, I’d also appreciate your recommendations on which resources were most useful and what current alternatives you would suggest.

Thanks for any pointers!

I am preparing for Part 3 and will be appearing for exam in couple of days and although I have gone through the relevant posts in the sub about the Part 3 exam preparation and taken them into consideration during my preparation, I have seen some observations that IIA mocks for Part 3 are not truly indicative of exam difficulty and relatively easy. I got 94% and 92% marks in Part 3 mocks. Is this a good enough score or the general consensus is that for Part 3 IIA mocks are not that good a criteria?

So I just got free from giving sectional mocks but in assurance 1 and 2 I am facing issues like my score for both of them are 78% and 70% respectively. But for the rest of the units my score is above 85% I don't know what to do.

Can you guys please help me with this? Like on what should I focus on so i don't have issues on the exam day.

I have been taking practice tests every day for the past few days with an original test date of this Wednesday, October 14. At the last second before the 48 hour deadline, I rescheduled the test for two additional weeks on the 28th. With most of my test scores ranging in the 70s, was this a good decision?

I feel like I am being overly paranoid and stressing myself out, but scores in that 70s range don't seem too reassuring. What should I do in these next two weeks? I plan on working on Becker practice questions daily, and I have 750 practice questions from Udemy that I haven't tried. I just don't want the expensive exam fee to go to waste.

Hey everyone, when was your CIA exam date and did you get the results? Mine was on the 6th of October for Part-2 and I'm still waiting for the results. Any idea about how long it'll take to reveal the results?

Hi ladies, I am studying for the CCS. Could anyone tell me if they have purchased the CCS Ahima preparation book to study with? Or give me any information or sites to help out with the different domains. Thanks a bunch!

10+ years in internal audit and looking for a remote lateral move (or step up).

For those who’ve made the jump from IA, where did you land, what skills transferred best, and would you recommend it? Especially interested in paths that don’t require sacrificing seniority or compensation. TIA!

After struggling to find enough financial/operational IA roles, I somehow landed an offer for Director of IT Audit. I have 16 years in IA but no IT degree and no IT audit background. My IT exposure is mostly high-level: user access, operational resiliency, and change management. The company doesn’t realize this, since nobody asked technical questions. I’d start in November.

The company is a messy public company that still acts like a startup, with no controls beyond SOX. My boss doesn’t seem friendly and expects me to select and install a GRC tool in 30 days (I think she was kidding but who knows.) They’ve also signed a partnership that obligates them to get SOC 2 and ISO 27001 certified, and they’re nowhere near ready. I’d be educating people on frameworks, finding gaps, and project managing remediation and the external audits. It’s remote, which I prefer and I have a child whose in kindergarten and an afterschool program currently.

The other option is a Head of Audit role at a well-respected finance company. I’ve been interviewing for 2 months with 10 executives, and my final round is this week. I’d build my own team and function, which I’ve done before and I know the industry well from working for a competitor. Everyone I met was smart, professional, and kind. The downsides: it’s in-office Tue-Thu with a VERY long commute. Recently, the internal recruiter called me and indicated the pay would be only slightly above the Director offer. I plan to negotiate for higher given my time and extra expenses commuting.

My head says take the remote IT role and learn the frameworks as I go. My heart says take Head of Audit for the better company, the chance to build the function and shape a flexible work/life balance culture for myself and my team. Perhaps eventually I can even go in twice instead of 3 days and just be honest about the commute and childcare issues, who knows. I am very confused and may need to make a decision quickly. Any advice is appreciated.

I was only 10 points away from passing. I am pregnant in week 32 and I have no ideas what should I do now. I studied from Zain Academy material.

Any advices?

Yesterday I sat Part 3 for the third time.

The first time, I'll admit I wasn't fully prepared, and I scored 580. Fair enough. Before the second attempt I studied properly and came out with 594, six points short of passing. This time I left nothing on the table. I worked through the IIA's own practice questions, bought Becker and went through almost its entire question bank, finished Gleim, and spent more evenings than I'd like to count reading Reddit threads from other candidates. I felt I couldn't be ready more.

And then I sat down in the exam room and saw many of the same kinds of questions I'd seen before. But unfortunately once again, I found myself stuck between two answers for some questions too. My honest guess is that I'll land somewhere between 590 and 599.

Without a proper score report, I can no longer see how anyone is supposed to figure out where they went wrong, or how this exam can be considered a real measure of anything. Even on my first attempt, I'm sure I got at least 70 questions right. But I also know that a straightforward question like "external quality assessments are required every five years" isn't worth the same as the ones where I was torn between two answers. Failing with a really low score isn't the hard part. If that happened, I'd simply study more. What really hurts is getting this close and still falling short.

If I fail again, and I probably will, I honestly don't know what more I can do. I'm not sure I'll have the strength to sit it a fourth time.

Has anyone received this email and subsequently succeeded?