The Purchase Ledger Clerk Who Also Reconciles the Bank
At Marlowe Trading, a purchase ledger clerk, Priya, has worked unsupervised for two years. She sets up new supplier accounts, enters invoices, prepares the payment run, and also reconciles the bank account each month. The owner approves the payment run by signing a printed list, but Priya prepares that list. A review of the 31 March bank reconciliation shows: unpresented cheques £18,400; an opening balance difference of £1,250 unexplained; and two supplier statements showing invoices of £3,100 and £2,050 that do not appear in Marlowe's ledger. Priya says the suppliers' statements are 'probably wrong'. The business has 40 suppliers and turnover of £3.2m.
1. Identify the control weaknesses and the specific fraud risks they create.
Read the worked answer
Segregation of duties failure (the core weakness): Priya combines four incompatible functions: supplier master-data maintenance, invoice entry, payment preparation, and bank reconciliation. This is the classic fraud triangle enabler.
Specific risks:
- Fictitious supplier - she can create a supplier, post invoices, pay it, and reconcile the bank - no one else sees the trail.
- Payment diversion - she can amend a genuine supplier's bank details to her own account.
- Teeming and lading / concealment - because she also reconciles the bank, she can hide a misappropriated payment behind reconciling items.
- The owner's approval is illusory - the approval list is prepared by Priya, so she controls what is presented. Approval of a list she compiled is not independent authorisation.
- Unexplained £1,250 opening difference and unmatched supplier invoices (£3,100 + £2,050 = £5,150) are red flags consistent with unrecorded liabilities or misappropriation. Dismissing the supplier statements is exactly the response a concealment would produce.
2. Recommend remedial controls, distinguishing preventive from detective controls.
Read the worked answer
Preventive (stop it happening):
- Segregate duties: one person enters invoices, a different person (e.g. the owner or a supervisor) maintains the supplier master file and prepares/authorises payments, and a third reconciles the bank. With only a small team, the owner must perform or independently review the bank reconciliation.
- Supplier master-data change control: any new supplier or change of bank details requires documented owner approval, with independent verification (e.g. a call-back to a known number).
- Payment authorisation: the approver should see the underlying invoices and supporting documents, not just a list compiled by the payer.
Detective (find it if it happens):
- Monthly independent bank reconciliation reviewed and signed by the owner, with every reconciling item aged and cleared.
- Supplier statement reconciliations for all significant suppliers, with unmatched items investigated and evidenced.
- Exception reports: payments to new suppliers, duplicate invoice numbers, round-sum payments, and payments just below approval thresholds.
- Periodic creditor listing review against prior periods for unusual balances.
Immediate action: investigate the £1,250 difference and the £5,150 of unmatched invoices before any further payments; consider whether a fraud investigation is warranted.