On July 13, 2026, Brady Lum, former chief operating officer of Atlanta's High Museum of Art, pleaded guilty in federal court to theft concerning programs receiving federal funds. Over his tenure as COO from January 2019 to December 2025, Lum embezzled more than $600,000 from the museum.
Lum submitted altered invoices for personal purchases, luxury guitars, music lessons, woodworking equipment, and used his own delegated approval authority to sign off on the reimbursements himself. He received more than 700 reimbursements, most under $1,000, and used accounting adjustments to spread the expenses across different cost centers so no single line item would stand out. Sentencing is set for November 2, and he has been ordered to repay the full amount.
Under the ACFE Fraud Tree, this is a classic expense reimbursement scheme, concealed through self-approval and deliberate cost-center spreading.
Nobody catches 700 reimbursements at a time.
That is the number now attached to Brady Lum, the former COO of the High Museum of Art here in Atlanta, who pled guilty this month to embezzling more than $600,000. He submitted altered invoices for personal items, guitars, music lessons, woodworking equipment, then used his own delegated approval authority to sign off on the reimbursements himself. To stay under the radar, he spread the expenses across different cost centers so no single line item would stand out. Most individual reimbursements were under $1,000.
This is a classic expense reimbursement scheme, and it is exactly the kind of fraud automated risk scoring is built to catch and a manual sample review is built to miss. No single $900 reimbursement raises an eyebrow. Seven hundred of them, submitted by the same approver, spread deliberately across cost centers over several years, is a pattern that jumps out the moment you look at the full population instead of a sample.
That is the gap in a lot of pre-close diligence. Reviewers test a handful of expense reports and a handful of invoices, confirm the documentation looks clean, and move on. They are not built to catch a thousand small transactions engineered to each look immaterial on its own.
A Business Health Check runs the whole population instead of a slice of it. It screens vendor files, expense reimbursements, and cost center allocations against known ACFE typologies, looking specifically for the split, spread, and self-approve pattern that let a scheme like this run for years inside a well resourced institution.
Whether you are advising a buyer who wants confidence the target's controls are real, or a seller who wants a clean bill of health before going to market, this is the kind of review that catches what a sample never will.
I've spent 15+ years investigating financial crime in law enforcement, fintech, and the credit bureaus. I write these briefs so the patterns are harder to miss. If this one hits close to home, I'm easy to reach.