The $17 million fraud carried out by a former Dual Australia claims manager and her husband should spur other firms to review and improve control processes, an expert has said.

Josie and Alvaro Gonzalez were last week sentenced to 9.5 and 7.5 years in prison respectively, for offences carried out over a number of years.

The couple began falsely billing Dual a few months after Josie joined the company in November 2010. Some 428 invoices were submitted from Jaag Lawyers, a firm they set up to carry out the crime.

The deception was finally uncovered when Josie Gonzalez was on maternity leave, and the funds were recovered through a civil deed in 2013. They denied 14 charges of obtaining a financial advantage by deception, but were found guilty by a jury in July.

KPMG Forensic Partner Stan Gallo told insuranceNEWS.com.au many aspects of the case were typical, but that others “raised eyebrows”.

“The insider threat is an area of increased focus and we see these types of things happening day in, day out,” he said.

“However, extreme cases where the amounts are in the multi millions are not an everyday occurrence and more than 400 invoices – that’s systemic.”

Mr Gallo says it is vital that control systems are not only put in place, but also well understood by staff and regularly reviewed. Otherwise it is all too easy for disgruntled or malicious staff to work around them, particularly in the electronic age.

Organisations need to ask themselves whether the control is able to withstand someone “maliciously setting out to circumvent it”, he says.

“For example, you can have a multiple approval process in place, but are people just signing and assuming that others who have previously signed carried out the required checks? At what point does someone actually stop and look?”

Mr Gallo says proactive data analysis would identify situations where millions of dollars are being paid to a company not previously used. Josie Gonzalez’s habit of listing vague terms such as “counsel” on invoices rather than the Jaag company name should also have “raised red flags”.

“The control itself is not enough. People need to understand what it is trying to achieve and it needs to be tested constantly. It can’t be ‘set and forget’, it needs to be a more diligent process.”

Mr Gallo says it is not uncommon for fraudsters to continue stealing for long periods of time, despite the ongoing risk of detection.

“When greed is the driver the question is often asked, ‘why don’t they stop?’

“But it doesn’t seem to happen that way. Once the person has successfully committed fraud it continues.

“I don’t know whether they have got used to a certain lifestyle and have to maintain it, or whether success drives the development of a habit.”

Josie, 45, will serve a minimum of seven years before being eligible for parole, while Alvaro, 51, will serve a minimum of five years.

During the sentencing hearing at the County Court of Victoria on Friday, Judge Paul Lacava said the fraud could have destroyed Dual’s business, but he applied some “mercy” as the couple have two daughters, aged six and 11, who are being cared for by relatives.