Meridian Health Supply: Turning Duplicate-Payment Flags into Defensible Findings

Treat the 2,300 flags as anomalies, not fraud. A duplicate-payment test on invoice number, amount, and posting date will produce false positives from split shipments, recurring fees, credits reissued, and legitimate multiple invoices. Sending the full list to AP invites inconsistent, undocumented clearing and possible tip-offs. Instead, define validation criteria in advance: exact duplicate vendor, invoice number, amount, and date; same vendor with near-duplicate invoice numbers and same amount within a short window; same bank account across vendors; and payment status. Review a stratified sample of high-value and high-risk flags first, then expand. Require each disposition to cite evidence, such as receiving documents, contract terms, or vendor confirmation, and have a reviewer independent of AP sign off. Keep the fraud label out of the risk report until cases are substantiated. Track false-positive rates by rule so the analytics improve. This approach is defensible, protects vendor relationships, and uses the 30 days to resolve the highest-risk items rather than all 2,300.

Refine matching by using invoice line detail, purchase order number, vendor tax ID, bank account, and free-text normalization; exact invoice numbers are easily reused. Add fuzzy matching for vendor names and addresses, and compare payment date to invoice date for split payments. Prioritize by risk score: amount, vendor created recently, vendor bank account changed near payment, employee linked to vendor, sequential invoice numbers from one vendor, and invoices just below approval thresholds.

Run the test against historical paid files, not just the current period, to find repeat patterns. Assign each flag to a queue with an owner and service-level deadline. For the Benford deviation, do not conclude fraud: first-two-digit tests fit naturally occurring amounts, not assigned or recurring fees, and virtual-office addresses are common for legitimate small vendors. Use Benford as a triage signal only. Combine it with vendor master change logs, employee-vendor address matches, and bid-rigging indicators such as losing bidders that later become subcontractors.

Combine duplicate payment testing with vendor master analytics: vendors sharing addresses, phone numbers, tax IDs, or bank accounts with employees or other vendors; vendors created outside normal hours; changes to bank details shortly before payment; and vendors with no purchase order history. Add spend analytics for split purchases below approval thresholds, price variance against contract, and sequential invoice numbers. Link AP data to HR master data to detect shared addresses and bank accounts, subject to privacy rules.

Avoid confirmation bias: the team wants a fraud finding because the test produced volume. Avoid base-rate neglect by recognizing that most vendors are legitimate and most flags are process noise. Avoid labeling vendors as fraudulent before validation, which can cause defamation and relationship harm. Document rule logic, sampling, and dispositions for reproducibility. Finally, present findings as control weaknesses plus validated exceptions, not as a single dollar estimate of loss.