Funding Fraud Controls Under a Fixed Budget at Northline Property Management
Northline Property Management manages 3,100 rental units and processes roughly 1,800 vendor invoices a month across a $96 million portfolio. Its last formal fraud risk assessment was completed three years ago. Last week an anonymous hotline tip alleged that a regional property manager steers landscaping work to a company owned by his brother-in-law. A quick query shows 14 active vendors sharing a single post office box, three of them added in the past year. Northline has $60,000 to spend on fraud controls this year and a 200-hour allocation from internal audit. The options on the table are: vendor screening software at $45,000 annually, a mandatory two-week vacation policy for accounts payable staff (no direct cost, likely union objection), expansion of the hotline programme at $18,000, and a manual vendor master clean-up.
1. Prioritise the four options. Which do you fund in year one and which do you defer, and on what reasoning?
Read the worked answer
Framework. Score each option on (a) how directly it addresses the scheme actually indicated, (b) preventive versus detective, (c) cost per unit of risk reduced, (d) speed to implement.
What the evidence points to. The tip plus 14 vendors at one PO box is a vendor-master integrity and conflict-of-interest exposure, not a payment-processing concealment exposure. Fund against that specific risk first.
Ranking.
- Manual vendor master clean-up plus the 200 internal audit hours - zero cash, immediate, and it produces the evidence base for everything else. Start week one.
- Vendor screening software ($45,000). Directly targets related-party and shell-vendor risk and keeps the clean-up from decaying.
- Hotline expansion ($18,000). Worthwhile, but the existing hotline already generated the tip; marginal value is lower than screening.
- Two-week vacation policy. Addresses concealment by an AP processor - no evidence of that scheme here. Defer.
Budget arithmetic. $45,000 + $18,000 = $63,000 against $60,000. Negotiate a phased licence or push hotline expansion to year two. Do not sacrifice the control aimed at the identified risk in order to fund a generic one.
Residual risk. There is no conflict-of-interest declaration process. Recommend a COI register at no direct cost, tested by internal audit in Q3. Record the accepted residual risk and the rationale in the risk register - the goal is a documented, defensible decision, not the elimination of all risk.
2. The tip is anonymous and specific but unverified, and naming the brother-in-law relationship is a red flag rather than proof. What do you do in the next ten business days, and what do you deliberately not do?
Read the worked answer
Do.
- Open a confidential case file with a named access list.
- Instruct accounts payable to send no notifications and place no holds that would be visible to the region.
- Pull, without alerting the region: vendor master change history, invoice and approval logs, payment details, contract files, tender documents, and incorporation or beneficial-ownership records for the landscaping vendor and the 13 PO-box vendors.
- Compare bank account details across the 14 vendors for shared accounts.
- Establish whether the regional manager approved the vendor set-up, the invoices, or both. Self-approval is the actual control failure and is provable from logs.
- Confirm the provenance of the hotline report and whether the reporter can be identified.
- Brief counsel and decide whether this is an internal audit review or a formal investigation with a written plan.
Deliberately do not.
- Confront the manager or his supervisor.
- Suspend, reassign or terminate before you know what systems access would be lost.
- Contact the vendor or the brother-in-law.
- Circulate the tip beyond need-to-know - leak risk peaks in the first week.
- Treat the tip as a finding. It is a predicate for review, nothing more.
3. Design one preventive and one detective control that specifically target related-party vendor risk, with a measurable test of effectiveness for each.
Read the worked answer
Preventive. A system-enforced vendor creation workflow: a vendor cannot be activated until the requester and the approver are different users, and until a conflict-of-interest check against employee addresses, bank accounts and declared relatives is logged. Blocking, not warning.
Test: sample 25 new vendors per quarter; measure the rate of missing declarations and the rate of self-approved vendor creations. Target zero, with every exception explained in writing.
Detective. A monthly analytics routine that matches vendor master fields (address, bank account, phone, tax ID) to employee records, plus a duplicate-detail report flagging any address or account shared across vendors.
Test: run the rule against a seeded test data set each quarter to confirm it still fires - rule decay is the usual failure mode, not a change in behaviour. Track true positives per 100 alerts; a rule whose precision falls below an agreed floor gets rebuilt.
Why both are needed. Prevention stops the scheme recurring; detection catches the control being bypassed and covers the vendors already sitting in the master.