Split Purchases, a Related-Party Vendor, and an Unpreserved Laptop
A hotline allegation at a public works department says a supervisor approved 17 purchase orders to a vendor owned by his brother-in-law, each between $4,800 and $4,950, just under the $5,000 competitive-bid threshold. The vendor was added to the approved supplier list three weeks before the first order. The supervisor signed the vendor onboarding form and the receiving reports. The department has no segregation between ordering and receiving for small purchases. The audit team's charter limits fraud work to preliminary reviews; the CAE has not been trained in fraud. The supervisor's director says the purchases were for emergency road repairs and asks the auditor to close it out quietly. The auditor also learns the supervisor has access to the procurement system as a backup approver. No one has preserved the supervisor's laptop or email.
1. What should the auditor do first, and who should be involved given the charter limits?
Read the worked answer
The auditor should stop routine fieldwork and avoid confronting the supervisor or the vendor. First preserve evidence: the supervisor's laptop, email, procurement system audit trail, vendor master file, purchase orders, receiving reports, emergency justifications, and access logs. Notify the CAE immediately and follow the organization's fraud policy; if the policy requires referral to an investigative or legal unit, do that.
Because the charter limits audit to preliminary reviews and the CAE lacks fraud training, the CAE should arrange a qualified fraud examiner or refer the matter, not run an investigation beyond competence. The director's request to close it quietly must be refused and documented. The auditor should not promise confidentiality that cannot be kept.
Consider interim controls: suspend the supervisor's backup approver access and vendor onboarding rights pending review. Keep the audit committee informed at the appropriate stage, and protect the hotline reporter from retaliation. The auditor's role is to assess controls and report, not to determine criminal liability.
2. Assess the fraud risk indicators and control failures, and outline the procedures needed to test them.
Read the worked answer
The pattern is a classic split-purchase indicator: 17 orders between $4,800 and $4,950 sit just below the $5,000 threshold, and the vendor was created shortly before the first order. The relationship with the brother-in-law is an undisclosed related-party conflict. Control failures include vendor onboarding by the same supervisor who orders and receives, no segregation for small purchases, and backup approver access that may allow self-approval. Fraud risk is high because the same person could create the vendor, approve the order, and confirm receipt.
Procedures should include data analytics across all purchase orders near the threshold, a review of vendor master changes and bank details, employee-vendor relationship screening, tests of emergency justifications, and interviews with receiving staff and finance. Review system logs for the supervisor's approvals and any after-hours changes. Quantify the total value and identify other vendors with similar patterns. Do not conclude fraud solely from the pattern; test whether goods were received and priced competitively.
3. How should the matter be reported given the director's pressure and the fraud-work limitation?
Read the worked answer
The report should be factual and avoid legal conclusions such as 'fraud occurred' unless the investigative authority has established it. It can state that the transactions bypassed competition, that a related-party relationship was not disclosed, and that segregation of duties was absent, with the dollar amounts and sample results.
The scope limitation should be disclosed: the charter permits only preliminary fraud review and the auditor is not a fraud examiner. The CAE should report to the audit committee and the head of the department, and refer the matter to the appropriate investigative body. The director's request to close quietly should not be included as an agreement; document it as a management request and the CAE's response.
Recommendations should address vendor master controls, threshold monitoring, conflict-of-interest declarations, mandatory leave and rotation for approvers, and removal of incompatible access. Follow-up should be mandatory and reported to the committee. If management retaliates or blocks access, escalate under the Standards.