The Vendor Just Under the Approval Threshold
A community health nonprofit receives a tip on its ethics hotline: a long-tenured accounts payable clerk may be steering payments to a vendor owned by her brother-in-law. The vendor, "Northstar Office Solutions," was added 14 months ago and has received 23 payments totaling $86,000, mostly between $3,800 and $4,900, just under the $5,000 threshold that triggers a second approval. The clerk has authority to set up vendors and enter invoices but not to approve payments. The payments were approved by the department director, who says he "trusts her and just signs what she puts in front of him." The vendor's address in the system is a post office box; a public records search shows the brother-in-law's business registered at the same box. There is no evidence yet that services were not delivered, but the nonprofit's offices are small and supply purchases have risen 38% year over year. The clerk is popular and has 19 years of service. The executive director wants to confront her immediately and suspend her pending termination.
1. Identify the fraud indicators and explain why the executive director should not confront the clerk immediately.
Read the worked answer
The indicators include a hotline tip, a related-party vendor, 23 payments mostly just under the $5,000 approval threshold, a post office box shared with a relative's business, a 38% increase in supply spending, and an approver who admits rubber-stamping. These are red flags, not proof. Immediate confrontation is risky because it can prompt destruction of emails, vendor records, or files; allow the clerk to coach the brother-in-law; and expose the nonprofit to a wrongful-termination or defamation claim if the suspicion is wrong. The clerk's 19-year record and popularity increase the need for a disciplined process, not a public accusation. The executive director should route the matter to counsel and the audit committee and keep the initial inquiry confidential.
2. Outline the investigation and reporting steps the nonprofit should take.
Read the worked answer
Preserve documents and electronic records; issue a litigation hold; review the vendor master file, invoices, purchase orders, receiving records, and payments; verify whether goods or services were delivered; check the brother-in-law's ownership and the post office box; and compare the clerk's conflict-of-interest disclosure, or absence of one. Use data analytics to test all vendors for employee addresses, phone numbers, and bank accounts. Interview the department director first, then the clerk, in a non-accusatory fact-finding style with counsel present. Decide whether to suspend with pay pending investigation based on evidence and policy. Report to the audit committee and, if fraud is substantiated, to the insurer and law enforcement as required; follow funder reporting rules. Do not promise confidentiality you cannot keep.
3. What controls would prevent recurrence without paralyzing a small nonprofit?
Read the worked answer
Separate vendor setup from invoice entry and payment approval; require a second person to approve new vendors and changes to bank details. Require conflict-of-interest disclosures annually and before vendor onboarding. Test for payments just below approval thresholds and review all related-party transactions. Make the department director review invoices against purchase orders and receiving records rather than signing whatever is presented. Rotate approval duties or require a second signature above a lower threshold. Run periodic vendor master file analytics against employee and board member information. These controls are proportionate for a small organization and target the specific weaknesses the tip exposed: unchecked vendor creation, threshold gaming, and passive approval.