Where Procurement Fraud Actually Starts

Every payment fraud needs a payee, and the vendor master is where payees are created. It is typically maintained by whoever has time, changed without independent approval, and never reviewed as a whole.

Four tests find most of what is there, and all four run on data the organisation already holds. Match vendor bank accounts against payroll bank accounts - an exact match is an employee-owned vendor. Look for duplicate vendors under slightly different names, which is how a single supplier evades a spend threshold. Look for vendors created and paid within a short window, and never used again. And look for vendors with no physical address, or an address shared with another vendor.

The preventive control is simpler than the detective one: creating or amending a vendor should require approval by someone who cannot also raise a payment to it.

Every procurement framework sets thresholds above which competition, committee approval or a different process applies. Each threshold creates an incentive to stay beneath it.

Split awards are the result: one requirement divided into several purchases each falling just under the limit. They are visible in the data as clusters of awards immediately below a threshold, repeat awards to the same supplier within a short period, and requirements delivered together that were procured separately.

Plot award values as a distribution. Legitimate procurement produces a broad spread. A pronounced spike just under a threshold is not a coincidence, and it is one chart.

The earliest point at which a tender can be directed is the specification, long before any bid is opened. Requirements written around one supplier’s product, unnecessarily narrow technical criteria, or timelines only an incumbent could meet all decide the outcome before competition begins.

At evaluation, the indicators are procedural: scoring criteria that changed after bids were received, subjective criteria carrying disproportionate weight, evaluation committee membership that does not rotate, and awards that consistently diverge from the technical ranking.

Both are reviewable after the fact from documents that must exist anyway. If they do not exist, that is itself the finding.

The last control point is whether what was procured actually arrived. Goods received notes signed by the same person who raised the requisition, deliveries acknowledged on the day of invoice, and contract variations that quietly restore a price competed down at tender are the recurring patterns.

Test all of it on full population rather than by sample. Sampling was designed to give assurance over a population assumed to be homogeneous; fraud is deliberately the exception, and a sample is precisely the tool least likely to contain it. Every test above runs on data the finance system already produces, and once written they can be re-run monthly at almost no cost.

Detection matters, but it is second. The reason to run these tests continuously is that people who know the tests run behave differently.