Procurement, Vendor, and Third-Party Fraud
Procurement is the highest-value fraud surface in most organizations because it converts approval authority into money. CFBE tests three related exposures: corrupt collusion in bidding, fictitious and pass-through vendors, and third-party risk.
Corruption in the bidding process
- Bid rigging: complementary bids (losers bid high by prior agreement), bid suppression, bid rotation, and market allocation. Tells include identical line-item pricing, shared transcription errors, matching metadata, contractors who win in rotation, and losing bidders who later subcontract to the winner.
- Kickbacks: a vendor pays an employee for favourable treatment, and prices are inflated to fund the payment.
- Conflict of interest: an undisclosed employee interest in a supplier, with purchases above market price.
Fictitious vendor indicators
PO box or residential address, no website, no telephone, a name similar to an existing vendor, invoice numbering sequential across unrelated vendors, a bank account shared with another vendor or an employee, a vendor created and paid within days, and amounts consistently just below an approval threshold. Run vendor master analytics for duplicate bank accounts, employee address matches, vendors with no purchase orders, vendors missing a W-9, and vendors paid only by check.
Third-party risk
Due diligence before onboarding: beneficial ownership, sanctions screening against OFAC and equivalent lists, adverse media, financial statements, and anti-bribery certifications. Beneficial ownership registries and the US Corporate Transparency Act change what is knowable; ask for the data.
Worked example
Analytics show two vendor records with different names but the same bank account; one address matches an employee's home; invoices cluster between 9,700 and 9,900 against an approval threshold of 10,000.
Reasoning: the combination suggests a fictitious or pass-through vendor with invoice splitting to keep approvals low. Evidence to collect: onboarding documents, W-9, bank account opening records, the approving manager's email, and a site visit. The shared bank account is the strongest single indicator and should be resolved first.
Traps
- Assuming competitive bidding proves integrity; rigged bids look competitive.
- Confusing pass-through with a shell company: in pass-through a real vendor delivers, but the intermediary adds no value.
- Treating a low bid as evidence of honesty.
- Overlooking that procurement fraud often requires an insider, so the control failure sits in approvals.