Eleven payments just under the threshold
You are on an interim visit at a charity with income of £8.4m. In the purchase ledger you notice 11 payments to a supplier, "Northgate Facilities", between £9,300 and £9,850 across 14 months. Every one sits just below the £10,000 dual-authorisation threshold. The supplier's registered address matches a flat listed in the staff directory as the home of the charity's facilities manager. He approved each invoice himself; the second signature box is blank on seven of them. When you raise it, the CFO - a former partner of your firm who still acts as your promotion referee - says the facilities manager is "family" and asks you to keep the matter out of the file until after next week's trustee meeting, at which a merger is to be voted on. Your firm also provides the charity's internal audit and has advised on the merger.
1. Set out your next actions in sequence, distinguishing what you do tonight from what requires the partner and the trustees.
Read the worked answer
Tonight, and without consulting the CFO again:
- Preserve the evidence. Copy the 11 invoices, the supplier master file record, the staff directory entry and the blank signature fields into a working file you control, with a timestamp. Do not leave originals in a folder the CFO can edit.
- Extend the test rather than concluding on 11 items: search the whole ledger for payments to the same bank account, the same address, or the same individuals, and check whether Northgate appears on any procurement approval list or competitive tender.
- Check whether the supplier was set up by the facilities manager, and who changed the supplier master data.
Then, before the end of the visit:
- Report to the engagement partner in writing, not verbally, because verbal reporting is how these matters disappear. The partner decides who contacts the trustees.
- Recommend that the matter goes to the chair of the audit committee or the board, bypassing the CFO if the CFO is implicated or is suppressing it. The CFO's request is itself a reportable event.
- Consider the firm's own position: we provide internal audit, so we may be the control that failed. That must be disclosed to the trustees and considered in the merger work.
What I would not do: agree to keep it out of the file, agree a timetable for disclosure tied to the merger vote, or investigate alone without notifying the partner.
2. Analyse the CFO's request and the firm's dual role. What exactly is the conflict, and can it be managed?
Read the worked answer
The CFO's request has two components and only one of them is negotiable.
"Please investigate before we alarm the board" is a reasonable sequencing request that can be accommodated within a short, defined period, provided the trustees are told it is happening. "Keep it out of the file until after the merger vote" is not accommodation; it is a request to suppress a suspected fraud from the people with governance responsibility, at the moment they most need to know. The timing is the point: trustees voting on a merger need to know whether the charity has a control failure and a possible misappropriation. Suppressing it until after the vote would make the firm complicit in an uninformed decision.
The dual role is a genuine self-review threat. Internal audit exists to test the controls that the 11 payments appear to have bypassed. If the same firm also advises on the merger, the temptation is to keep the charity's problems small so the transaction proceeds. Add the personal dimension - the CFO is a former partner and the referee for my promotion - and the threat is not theoretical. It is a familiarity and self-interest threat that no amount of good intention removes.
Management: segregate the engagement. Someone outside the internal audit team and outside the merger work leads this, reports directly to the audit committee chair, and the CFO is excluded from decisions about scope and reporting. If the charity's size makes real segregation impossible, the firm should consider whether it can continue as internal auditor at all, and discuss that openly with the trustees rather than quietly.
3. Draft the substance of what you would say to the trustees, and note what you would record in the file about the CFO's instruction.
Read the worked answer
To the audit committee chair, in substance: "During our interim visit we identified 11 payments to a supplier connected to a member of staff, each falling just below the £10,000 dual-authorisation limit, with the second authorisation missing on seven. We have widened our testing. We are reporting this to you now, ahead of completing the work, because the board is being asked to approve a merger and we do not think that decision should be taken without knowing this. We have asked the CFO to step back from this matter while we complete our enquiries. We will report our findings to you and to the board, and we will say clearly what we have and have not been able to establish."
In the file, record:
- The date, time and content of the CFO's request, in his words, and my response.
- The fact that I reported to the partner and to the audit committee chair, with dates.
- The connection between the CFO and this firm, and between the CFO and my own appraisal, and the safeguard applied.
- What I did not do and why - for example, if the trustees were not told immediately, the reason.
Record contemporaneously. A file note written three weeks later, after a merger vote, will read as an attempt to reconstruct a defence rather than as a record of a decision. The test I would apply to the note is whether a reviewer who disagreed with me could still see exactly what I knew, when I knew it, and what I did.