Vendor Master File Anomalies at Fenwick Hardware

Weaknesses and their consequences:

1. No segregation between custody and record-keeping. Priya prepares cheques, holds the vendor file and reconciles the bank account. Cash leaving the bank and cash being recorded are controlled by one person, so a fictitious payment can be created and then concealed in the reconciliation.
2. The owner signs without support. The signature - the single most important physical control - is decorative. A payment to a fictitious vendor will be signed if nobody checks the invoice, purchase order and goods received note.
3. Single-person vendor master control. A new vendor with a PO box address, added without approval, is the classic mechanism for diverting funds.
4. No mandatory leave or rotation. Two years with no leave is a recognised red flag, because concealment often depends on the same person being present.
5. Unresolved long-outstanding cheques. Two cheques over 120 days old are either unrecorded stoppages, payments posted to the wrong account, or cheques never sent - each needs an explanation.

Fraud triangle applied:

• Opportunity: total control of payment and records, and rubber-stamp signing.
• Pressure: unknown, but a sudden cluster of payments to an unfamiliar vendor may reflect a personal financial need.
• Rationalisation: a long-serving, under-thanked employee can easily tell herself the company owes her, especially if she has never had a raise or a holiday.

The pattern of sequential invoice numbers is suspicious in itself: genuine suppliers rarely issue consecutive numbers across months without intervening invoices going unpaid.

Twelve staff cannot achieve ideal segregation, but the owner can break the fraud chain cheaply:

1. Split the payment cycle. Someone other than the preparer opens the post; the owner approves every new vendor and every change of bank details in writing, and keeps a printed vendor list that is compared to the master file quarterly.

2. Make signing meaningful. No cheque without an approved purchase order, the supplier invoice and the goods received note stapled together. The owner initials the approved pack. Better still, move to electronic payments where the owner releases each batch after reviewing a payment listing, so the person entering the payment cannot also release it.

3. Reconcile independent of the preparer. The owner (or the external accountant) should perform or review the bank reconciliation monthly and physically inspect the bank statement, not just the printout. The reconciliation reviewer must be someone with no ability to pay.

4. Use the bank as an independent check. Dual signatories above a threshold, positive pay or payment notifications to the owner's phone, and monthly review of an aged creditors list looking for unfamiliar names and odd addresses.

5. Vendor verification. Independently confirm the address and bank details of any new supplier by phone using a number from an independent source, not from the vendor's own letterhead.

6. People controls. Mandatory annual leave for anyone touching cash, rotation of duties where possible, and a written policy that duplicate vendor names must be cleared before a supplier is set up. A PO box should automatically trigger a second review.

Preserve first, confront later. Do not delete anything, do not tell Priya before evidence is gathered, and do not let the two old cheques be quietly cancelled. Secure the vendor master file history (who added Apex, when, from which login), the three invoices and their images, the bank statements and cheque images, and the email trail.

Investigate specifically:

• Whether Apex exists: independent address check, company registry search, call the number from a source other than the invoice.
• Whether the three invoices correspond to any goods received; match against purchase orders and stock receipts.
• Who endorsed or deposited the cheques - the back of the cheque is often the whole case.
• Whether the 120-day-old cheques were ever sent, were stop-paid and reissued, or are simply misposted.
• Whether other vendors share the same PO box or bank account details.
• Total value at risk: the three payments total $18,400, and the exercise should quantify the whole vendor file, not just Apex.

Remediate and decide:

1. Suspend any further payments to Apex and to any vendor with matching bank details or address.
2. Move payment preparation and reconciliation away from Priya immediately; she can be reassigned without public accusation while the review runs.
3. Take professional or legal advice before any interview or disciplinary step, and follow local employment and reporting obligations - including whether a report to the authorities or insurers is required.
4. Quantify the loss and assess recoverability and any insurance claim.
5. Close the loop with the control redesign above and record what was learned; the exam-relevant judgement is that the control failure, not just the individual, caused the loss, and a single dismissal without redesign will simply invite a repeat.