Another possibility and a very long explanation...
My understanding is that the problem with signatures is that they do not give control over the actual fraud situation. Signatures can mainly be used to trace people when the fraud is already a fact, but they are not preventive as such, and therefore their "controlling function" is of less importance.

Therefore, a clustering of signatures at around the time of a fraud incidence, does not in any way mean that signatures can be used as a control measure. You might be interested in finding the culprit, but, more importantly, the damage is already done...

A fictive example:
Let us say that there have been 10 instances of fraud at a company. Mr X's signature appears in conjunction with 5 of these, while Mr Y's signature only appears once. Since Mr X's signature is a lot more frequent that Mr Y's, Mr X appears as more suspicious.
However, Mr X might be working 24/7 and his signature is then more frequent by default. Or maybe he is the one who signs most papers?
At any rate, the fact that Mr X and Mr Y had to leave their signature didn't prevent them from being at the scene of the crime (guilty or not). Therefore signatures can be used for tracing, but not as a (preventive) control measure.

See below for an example to support this possibility.
"Examples of potential frauds which can be displayed in this way, include:
•a buyer placing an exceptional value and volume of orders with a favoured supplier
•a contractor whose invoices are frequently just below a tendering threshold (so called“breakpoint clustering”) and
•an employee whose key card access records correlate to a number of fraud incidents."

http://www.google.se/search?q=cache:uPIaGIpCVYwJ:www.pwc.com...