Could you explain point 6 a bit more?
It would take a year or more for a dev to become familiar enough with their domain and its systems to even know to suggest a report that would sniff out this fraud, and even more time for them to have the political capital to get support for the project.