Segregation of Duties and a Management Override Red Flag

Control weaknesses:

1. No segregation of duties. Mere controls supplier setup, PO approval, bank reconciliation and system administration. The same person can create a fictitious supplier, approve the payment, and reconcile the bank account so the payment appears legitimate. This is the classic fraud-enabling combination.
2. Master-file change log disabled. Removing the audit trail is itself a red flag. It eliminates the detective control that would otherwise reveal who added or amended a supplier.
3. MD approval is a rubber stamp. Signing without reviewing supporting documentation means the second-approval control is designed but not operating. A control that exists on paper but is not performed provides no assurance.
4. No independent review of the reconciliation by a second person.
5. Long tenure without rotation in a role with broad system access increases familiarity-based override risk.

Why this is a red flag, not just untidiness:

• Structuring. Eleven invoices between $26,000 and $34,000 sit just below the $35,000 second-approval threshold. Random amounts do not cluster below a control limit; deliberate clustering suggests the limit is being avoided.
• New supplier, high value, rapid bank-detail changes. A supplier appearing from nowhere and receiving $310,000, with its bank account changed twice in month one, is consistent with a fictitious or hijacked supplier.
• Timing correlation. The log was disabled in the same six-month window as the payments - the two facts are not independent.
• Consulting is a plausible but hard-to-verify service. No tangible goods are delivered, so there is no goods-received evidence to test against.

The combination - opportunity (no segregation), concealment (no log), and pattern (structuring) - is what elevates this from poor administration to suspected fraud.

Immediate management actions:

1. Suspend further payments to Rātā pending verification, and independently confirm the supplier's existence, ownership and bank details through a channel other than the contact details on file.
2. Restore and preserve the change log, and retrieve any backups covering the disabled period. Preservation matters because evidence may otherwise be overwritten.
3. Reassign Mere's conflicting duties immediately - at minimum remove her system-administrator rights and bank-reconciliation role. This is protective, not an accusation.
4. Escalate to the board or audit committee, not just the MD, since the MD's own approval control has failed and the MD may be implicated or conflicted.
5. Consider legal and forensic advice before interviewing staff, to preserve privilege and evidence integrity.

Auditor's response:

• Assess whether this constitutes fraud under the auditing standards, which triggers a duty to report to those charged with governance and, in many jurisdictions, to consider obligations to regulators.
• Do not rely on the disabled log period as evidence of completeness; the population of supplier changes is unreliable.
• Increase the extent of substantive testing: direct confirmation of supplier balances, review of payments around the threshold for other suppliers (to see whether structuring is systemic), and data analytics on invoice amounts against approval limits.
• Reassess control risk upward for the purchasing and payables cycle, moving to a predominantly substantive approach, and reconsider the reliance strategy for the whole audit.
• Consider whether the issue is pervasive enough to affect the audit opinion, and document the judgements carefully.

The professional-skills point: the auditor must not simply note the weakness in a management letter. A structuring pattern plus a disabled audit trail requires escalation and a change in audit strategy, not a routine finding.