Procurement Controls at Harbourline Facilities Services
Harbourline Facilities Services Ltd provides cleaning and maintenance to 40 commercial sites in Lagos and Abuja. Its admin and procurement unit has 11 staff and processes about 1,100 vendor invoices a month. The accounts clerk who creates new vendors in the ERP also raises purchase orders and releases payments; the finance manager approves everything above ₦200,000. In the first quarter, three-way matching was waived for 61% of invoices, marked urgent site request. Stationery and cleaning-supply spend rose 47% year on year while headcount fell 10%. A vendor master review has not been done in three years. Internal audit is outsourced and reports to the managing director; its last fieldwork was six days. A new vendor, BrightPath Supplies, shares a registered address and phone number with the procurement officer's brother's company and has received ₦8.9 million since January. The board asks for a control review.
1. Identify the control design and operating failures in the procure-to-pay process and rank them by risk.
Read the worked answer
(1) Incompatible duties: one accounts clerk creates vendors, raises purchase orders and releases payments. This is the classic fraud triangle opportunity and is the highest-ranked failure because it allows a fictitious vendor to be created and paid without a second pair of eyes. (2) Vendor master ungoverned: no review in three years and no independent approval of changes. This is high risk and links directly to BrightPath. (3) Three-way matching waived for 61% of invoices: the control exists on paper but is not operating. Urgent is being used as a routine loophole, so invoice accuracy and receipt of goods are unverified. (4) Internal audit independence is compromised: it reports to the MD, receives only six days of fieldwork and does not audit procurement. Detection is therefore absent, which raises the risk of all the other failures. (5) Approval concentration: the finance manager approves all payments above ₦200,000 with no evidence of review, and there is no second approval at higher values. (6) No spend analytics: a 47% rise in supplies against a 10% headcount fall should have triggered an inquiry.
Ranking: vendor creation and payment by one person, together with the related-party vendor, is critical; matching waiver is high; internal audit weakness is high because it removes assurance; approval concentration and analytics gaps are medium-high.
2. Design a revised control set with preventive and detective controls, including compensating controls feasible for an 11-person team.
Read the worked answer
Preventive: separate vendor master creation from purchase ordering and payment. The finance manager or a shared-service unit should create vendors, the procurement head should approve, and no purchase-order raiser should be able to create a vendor. Purchase orders should be raised by procurement, goods received notes by the site supervisor, and invoices matched by accounts. Payment should be released by finance with dual approval above ₦200,000. Bank-account changes should require a call-back to a known number and dual approval. Urgent requests should be pre-approved by the MD and reported monthly to the board.
Compensating controls for a small team: monthly independent vendor master review by internal audit or an outsourced firm; a pre-approved urgent supplier list; quarterly end-to-end sample testing of 25 purchase orders; annual vendor master data cleanse; mandatory related-party declarations and CAC searches for new vendors; and a rule that any vendor sharing an address, phone number or bank account with an employee is escalated.
Detective analytics: duplicate invoices, sequential invoice numbers, vendor addresses matching employee addresses, round-sum invoices, after-hours master-file changes, payments just below approval thresholds, and spend-versus-headcount trends. Key risk indicators: matching waiver rate below 5%, 100% of master-file changes independently reviewed, duplicate payment rate, percentage of vendors with verified CAC and bank details, and related-party declarations completed.
3. Explain how you would investigate BrightPath Supplies without tipping off the procurement officer, and what evidence and legal or HR steps matter.
Read the worked answer
Plan before acting. Brief legal counsel and HR, then preserve evidence: ERP vendor master history, purchase orders, goods received notes, invoices, payment records, emails, phone records and approval logs. Make forensic copies and keep a chain-of-custody record.
Covert checks: CAC search of BrightPath and the brother's company for directors, shareholders and registered address; bank-account signatories; the approval trail for each payment; whether the procurement officer declared an interest; and whether the goods were actually delivered to sites. Do not confront the procurement officer first. Interview in sequence: the accounts clerk, site supervisors, then the procurement officer, with HR and a note-taker present. Give the officer the opportunity to be accompanied, avoid threats or promises, and preserve the presumption of innocence. Suspend system access immediately; consider suspension on full pay if the contract allows.
If the evidence supports fraud, refer the matter to the EFCC or police, notify insurers, and consider civil recovery. Report to the audit committee, not to the MD alone. Protect any whistleblower. Limit personal data to those who need it. The investigation must be independent of procurement and finance line management.