It's hard to identify. I audited a Sheriff's account once because there was constant chatter that the funds were being misused. Out of an entire year I could only find one line item that was questionable (it was still a police item, but it should have come from a different fund).

What isn't clear is this: if say the Sheriff buys 100 riot shields from Company X, does his cousin own Company X and there is a kickback or a favor? I couldn't answer those questions because they would require a whole new level of investigation.