A Control Breakdown in the Purchase Cycle
Marlowe Components Ltd has 40 staff and a finance team of three: a financial controller, a purchase ledger clerk and a credit controller. During an internal review you find:
- The purchase ledger clerk raises purchase orders, matches invoices to goods received notes, and enters supplier payments onto the bank.
- The financial controller is the sole bank signatory; the second signatory (the managing director) is frequently travelling and signs blank cheques in advance.
- Supplier master data can be amended by the purchase ledger clerk without review.
- Three suppliers share the same bank account number and were all set up in the last four months.
- Month-end supplier statement reconciliations are performed by the purchase ledger clerk, who also clears any differences by journal.
The controller says the team is too small to segregate duties and that the reconciliations 'catch everything anyway'.
1. Identify the fraud risk most consistent with findings 1, 3 and 4, and explain why the existing reconciliations would not detect it.
Read the worked answer
Risk: a fictitious supplier (or duplicate supplier) fraud operated by the purchase ledger clerk.
The clerk controls the entire transaction lifecycle - raising the order, matching the invoice, amending master data and releasing the payment - so a supplier can be created with the clerk's own bank details, invoiced for goods that never arrive, and paid without any independent check. The shared bank account across three recently created suppliers is the classic red flag: either one beneficiary is running multiple front entities, or the clerk has created aliases to stay below scrutiny thresholds.
Why reconciliations fail: the reconciliation is performed by the same person who would perpetrate the fraud, and differences are cleared by journal with no second review. A supplier statement reconciliation only proves that the ledger agrees to the statement the supplier sends - if the supplier is fictitious and the statement is fabricated or non-existent, there is nothing to reconcile to. The control is circular: it tests the clerk's records against records the clerk controls.
Detection tests to recommend: match supplier master data to bank details and search for duplicate account numbers/sort codes; compare supplier addresses and VAT numbers against employee records; review all suppliers added in the last 12 months and confirm they were approved by someone other than the clerk; trace payments to supporting goods received notes and investigate any invoice without a GRN; review journal entries clearing reconciling items.
2. Design a cost-effective control package for a three-person finance team, addressing segregation of duties where full separation is impossible.
Read the worked answer
Full segregation is unaffordable at this size, but 'compensating controls' can achieve the same assurance objective. Recommend:
- Supplier master data: changes require written approval from the financial controller and a system log of who changed what, when. The clerk may input but not approve. Monthly review of the change log by the controller.
- Purchase-to-pay split: the clerk may raise orders and match invoices, but the controller must authorise the payment run. The clerk prepares, the controller reviews the payment listing against supporting documents and releases. No single person both prepares and releases.
- Bank controls: cancel the practice of pre-signed blank cheques - it defeats the second signature entirely. Use dual electronic authorisation with the MD able to approve remotely, or delegate a second signatory (e.g. a director) with a documented limit. Pre-signing should be reported as a control failure, not tolerated.
- Reconciliations: move supplier statement reconciliation to the controller or credit controller, rotating quarterly. Differences above a set threshold (say £250) must be supported and approved, not journal-cleared by the preparer.
- Independent check: the controller performs a monthly review of a sample of payments to GRNs and invoices, evidenced by sign-off.
- Culture and whistleblowing: a confidential route to report concerns, given the controller is also a potential colluder.
Key principle for the answer: where segregation is impossible, substitute independent review, authorisation, rotation and audit trails - and document the rationale so the residual risk is accepted knowingly by the board.