Three invoices from a supplier that shouldn't exist
While reconciling accounts payable at a 60-person firm, a team leader notices three invoices from a vendor that is not on the approved supplier list. Each is for $15,600, approved by the same colleague, and spaced about three weeks apart. A public register search shows the vendor's business number was registered four months ago. The colleague has 14 years' tenure, is well liked, and is currently acting manager - and is therefore the person who would decide the team leader's pending promotion. The team leader also counts the colleague as a friend. The invoices have all been paid. There is no evidence of what the vendor supplied; the descriptions say only 'consulting services'.
1. What are the first three things you do, and what do you deliberately not do?
Read the worked answer
Do, in this order:
- Preserve the records. Copy the invoices, the approval trail, the vendor master record (who created the vendor, on what date), and the payment records. Do not annotate the live system. If the file is later disputed, contemporaneous copies are the difference between an allegation and a finding.
- Pull the public record and the internal approvals. Business registration date, registered office, whether the vendor appears on any other file, whether the three invoices were approved without the second approver that policy requires. These are facts, not suspicions, and they take an hour.
- Escalate outside the reporting line that contains the colleague. The colleague is acting manager, so any route through them is closed. Go to the principal, the finance director, or the external whistleblower channel if one exists.
Deliberately do not:
- Confront the colleague. It destroys the possibility of a clean investigation and puts the evidence at risk.
- Discuss it with anyone else in the team. A friendly word becomes the colleague's defence that the process was contaminated.
- Conclude anything. Three invoices, a new vendor, an off-list supplier and 'consulting services' is a pattern that warrants investigation. It is not proof of wrongdoing - there are innocent explanations, including a legitimate urgent engagement approved outside policy.
2. How do you handle the fact that the colleague is both a friend and the person deciding your promotion?
Read the worked answer
Separate the two things - the reporting obligation and the personal relationship - and disclose the second in writing.
- The obligation does not depend on the friendship. If the reverse were true, the closer the relationship, the weaker the duty, which is exactly backwards.
- Disclose the relationship to whoever receives the escalation. State the friendship, state that the colleague is acting in a role that affects your promotion, and ask that the matter be handled by someone independent of both. This is not weakness; it is what makes the escalation credible when the colleague later argues it was personal.
- Ask for the promotion decision to be taken out of the colleague's hands now, on the basis that a pending investigation - even a confidential one - creates an untenable position for both of you. If the request itself would reveal the investigation, ask for it for the neutral reason that the acting arrangement creates a conflict.
- Do not soften the report to protect the friendship. A report hedged to be kind is worse than no report: it invites the conclusion that nothing much was meant by it.
The judgement being tested is that loyalty to a colleague and duty to the firm are not in competition here - the most loyal thing you can do for a 14-year colleague is ensure the facts are examined properly rather than circulated as rumour.
3. What standard of proof justifies escalating this, given you may be wrong?
Read the worked answer
Escalation does not require proof. It requires a reasonable basis, and the consequences of silence are asymmetric.
Against the threshold test:
- Off-list vendor, registered four months ago - suppliers usually predate their first invoice only briefly, and this one barely exists.
- Three identical amounts, $15,600, evenly spaced. Genuine consulting work rarely bills in three equal instalments at exactly the same figure.
- Single approver, and that approver is now acting manager.
- Descriptions that identify nothing delivered.
Each factor alone has an innocent explanation. Together they meet the threshold for someone with authority to look, which is all you are asking for.
Weigh the cost of being wrong:
- Escalate and be wrong: an awkward conversation, an explanation, and a control weakness (off-list suppliers) that needed fixing anyway.
- Stay silent and be right: the conduct continues, and the person who noticed becomes complicit in it.
What would change the answer: a purchase order, a signed engagement, evidence of delivered work, or an emergency-approval record. If any of those exist, the escalation is a compliance query rather than a misconduct report - and it is still an escalation, because auditors will ask why the supplier was never added to the list.
Frame the escalation accordingly: report the facts and the anomalies, not a conclusion about the person. 'These four things don't reconcile with our supplier policy, and I can't explain them' is both accurate and sufficient.