The Fraud Signal Nobody Escalated
Corvane Logistics has 1,900 staff across six depots. Internal audit's quarterly sample found 14 purchase orders raised to a new supplier, Halden Freight, approved by the same depot manager, with invoices just under the $10,000 second-approval threshold. Total spend was $131,000 over five months. The manager's explanation: urgent subcontracting during a driver shortage. The supplier was registered 11 weeks before the first invoice; its registered address matches a residential property. Internal audit rated the finding 'medium' because no loss was proven. The audit committee meets in three weeks. The CFO has asked internal audit to 'keep it operational' and not to expand testing, citing cost. The manager is a high performer and the depot's largest revenue generator.
1. Evaluate the control environment failures this finding reveals, distinguishing control design weakness from control operation weakness.
Read the worked answer
Design weaknesses
- Threshold gaming is enabled by design: a single approval limit of $10,000 with no aggregate or supplier-level monitoring invites splitting. A well-designed control considers cumulative spend per supplier and per approver.
- No supplier onboarding gate: a new vendor with a residential address and 11-week history passed into the master file without due diligence; the design lacks verification of bank details, ownership and trade references.
- Segregation of duties not enforced at design level: the same manager can raise and approve; the design should make self-approval impossible in the system, not reliant on discipline.
- Escalation route undefined: internal audit's rating scale has no mandatory escalation trigger for fraud indicators, only for proven loss.
Operation weaknesses
- Controls existed but were not operated: second-approval was avoided rather than overridden, suggesting no exception reporting.
- Internal audit operated a sampling approach that found the pattern but did not respond to it; the 'medium' rating is a judgement failure in operation, not design.
- Management response was to contain, not investigate: the CFO's instruction is itself an operation failure at the top.
Key insight: the control that failed most seriously was not transactional but behavioural - the organisation had no mechanism to convert a red flag into an investigation.
2. Advise the audit committee on the actions it should require before and at its next meeting, including how to handle the CFO's request.
Read the worked answer
Before the meeting
- Internal audit should expand testing immediately: all payments to Halden Freight, all suppliers onboarded in the last 12 months, and all approvals by the manager in question. The cost objection is not a valid basis for limiting fraud-related scope; the committee, not the CFO, sets internal audit's mandate.
- Preserve records: bank mandate details, email trails, vendor master change log.
- Verify the supplier independently: company registry, address, bank account name match. A residential address matching an employee is a conflict-of-interest indicator requiring disclosure.
- Consider whether a whistleblowing route was available and used.
At the meeting
- Re-rate the finding: suspected fraud indicators, not 'medium no loss'. Unproven loss is not the same as low risk.
- Ask the CFO to explain the instruction in writing; the committee should minute that scope decisions rest with it.
- Commission an independent investigation with a defined reporting line to the committee chair.
- Assess whether the high-performer status created a 'tone at the top' problem where performance shielded conduct.
- Review the approval threshold design and introduce supplier-level cumulative monitoring.
Judgement to show: the committee must protect the investigator's independence and resist both managerial capture and premature accusation of the manager. Suspension or restriction of duties should be considered proportionate to risk, not as punishment. The exam rewards balancing fairness to the individual with fiduciary duty to the entity.