Posted on: November 22, 2019

Best Practices in Accounts Payable Audit Detection


At a certain point, every business with an A/P department must face the dark reality that fraud occurs. In an ideal world every employee would be trustworthy and there would be no theft (99.9% of your employees probably are trustworthy), but this isn't an ideal world. Further, you'd like to believe that scammers and external fraudsters don't exist, but they do. Rather than wallow in this sad realization, be proactive about it. Learn how to detect fraud and keep your A/P department safe from it.

Being proactive about accounts payable fraud detection will not only show that you're committed to your company's bottom line, but also that you're dedicated to your A/P department's success. Let's examine how to detect the two most common types of fraud in A/P.

Detecting External Fraud

External fraud is more prevalent than you might think. According to a 2019 report from the Association for Financial Professionals, "64% of attempted or actual payments fraud resulted from actions of an individual outside the organization." These fraudsters are taking advantage of companies with too many vendors to keep track of.

1. Change in Banking Information Communication

One way fraudsters try to obtain payments is through sending emails while impersonating vendors notifying companies of a change in banking information. This change will likely be to an account in the fraudster's name of their partner's name. These emails can look official and are easy to fall victim to. Especially for those companies with so many vendors that changes in banking information may be common place.

To detect and prevent a change in banking information attempt at fraud, simply examine each change. Either authenticate the email or make a call to the company. If your company is too large to authenticate or call each time a change is made, enlist a solution that can do so for you.

2. False Invoices

Another form of external fraud are false invoices. Here, the fraudster will send an email with an invoice from a vendor that the company doesn't actually do business with. The fraudster's desire is that the person processing the invoice will recognize that there is no vendor matching the invoice sender and as a result, set one up.

Detecting false invoices can be difficult once the vendor is entered into the Vendor Master File, or VMF. Best practice would dictate that before adding new vendors to the VMF that those vendors be authenticated. Again, in a large company this can be difficult without a solution. However, being diligent about verifying vendors will help you protect your bottom line.


Detecting Internal Fraud

Employees, by nature, have access to VMF and Procurement Cards. With malicious intent, both can be manipulated. There are three key indicators to look out for when detecting common employee fraud.

1. Altering of Vendor's Banking Information and Ghost Invoices

Changing a real supplier's address is a common technique used by employees committing fraudulent behavior. This happens when an employee, with access to the VMF, changes the address on a real supplier to their own address. Once they receive and cash the check, they change the address back. It appears, without close observation, that nothing out of order has occurred in the VMF.

Some fraudsters will go a step further and process a ghost invoice against a vendors account that will get paid back into their account. This way the vendor won't notice the lack of payment on a real invoice.

To prevent this you can track changes to your VMF: both the name and address. If these changes are examined properly, fraud can be detected and recovered. A good way to do this is to examine employees' addresses against those of the VMF.

2. Creation of a (Real) False Vendor

Another common type of fraud involves an employee entering their own or their significant other's personal business into the VMF. These businesses are usually real businesses and not easy to detect. Most commonly, when the employee enters their business into the VMF they will enter an invoice for a low dollar amount ($15 or $20) as to avoid any red flags. Once their business is entered into the VMF then the employee can enter an invoice against it.

However, these invoices need to be charged to general ledger accounts or specific budget items. Some systems even have controls on how to charge out expenses. In this case, the fraudulent employee will charge to a sales or revenue account. These accounts could have billions of dollars in them and, without examination, wouldn't raise any suspicion if charged.

Detecting this can be difficult without enlisting a solution, but there are a few red flags that you can manually address. First, look for any VMFs with a PO box address. Most real businesses have actual addresses. Second, look for invoice numbers in sequence (1,2,3,4...). Most invoice numbers shouldn't appear in sequence. With the proper examination and solution, detection, recovery and prevention are possible.

3. Procurement Card Charging

Procurement Card (P-Card) fraud is the most common of all employee fraud in A/P. Luckily, it doesn't often yield losses in large sums. P-Cards were invented to simplify smaller payments. Here, employees can take advantage of this simplification. With P-Card fraud, the fraudulent employee doesn't have to worry about the VMF, the invoice or the check. This makes detection a little more difficult.

One way to spot P-Card fraud is to identify when charges are being made. For example, if no charges should be made on the weekend, and they are, fraud is likely. Another way to identify P-Card fraud is through Merchant Category Codes, or MCCs. MCCs identify the type of business your P-Card is being charged to. If, for example, there are countless charges to a pet store, and your business has nothing to do with animals, fraud is likely.

Finally, a common way to identify all fraud, is having an anonymous fraud prevention dropbox. This way, informed employees can report fraud while maintaining their anonymity. This is a tried practice and can yield helpful results.

The Takeaway

Assessing multiple data-points against one another is the only true way to achieve accounts payable fraud detection. Realistically assessing 5,000 or so vendors isn't possible. Enlisting a solution is a much easier way to ensure that embezzlement or other types of accounting fraud aren't happening in your A/P department.

To learn more about common A/P fraud, check out the 5 Most Common A/P Frauds to watch out for.

Best Practices Error Prevention in Accounts Payable

Topic(s): Accounts Payable

Sign up to receive the latest updates from the experts at Technology Insights.