schema: | { “@context”: “https://schema.org”, “@graph”: [ { “@type”: “Article”, “headline”: “The Basics of Procurement Fraud Prevention”, “description”: “How companies detect and neutralize internal vendor kickback schemes and fictitious billing fraud.”, “datePublished”: “2026-03-19”, “dateModified”: “2026-03-19”, “author”: { “@type”: “Person”, “name”: “BATO Editorial Team” }, “publisher”: { “@type”: “Organization”, “name”: “BATO” } } ] }

Of all the categories of Occupational Fraud, procurement and billing schemes are mathematically the most devastating. Because they exploit the legitimate Accounts Payable (AP) infrastructure of a business, these schemes routinely bleed millions of dollars from an organization before detection—averaging 18 months of continuous theft.

When a scaling business rapidly adds aggressive new sales heads and opens international branches, identifying fraudulent vendors becomes impossible without strict, overarching Internal Controls.

Common Procurement Fraud Schemes

To catch fraudulent spending, the Internal Audit Function must understand the mechanics of the crime.

1. Fictitious Billing (The “Shell” Vendor Scheme)

An employee with the authority to approve invoices realizes the AP department pays standard invoices below $10,000 automatically without secondary review.

  • The Scheme: The employee legally registers a fake IT consulting company. They begin submitting monthly invoices for $9,500 labeled “SaaS Optimization Consulting.” The AP department, assuming legitimacy, continually wires money to the employee’s shell company.

2. The Vendor Kickback

An employee responsible for selecting a massive, multi-million dollar software contract is approached by a competing vendor.

  • The Scheme: The vendor promises to secretly wire the employee 10% of the total contract value into a personal account if the employee manipulates the bidding criteria to ensure that specific vendor wins the contract over cheaper, better competitors.

3. Bid Rigging

Multiple external vendors secretly meet before submitting bids to your company. They illegally agree to all inflate their prices simultaneously, collectively agreeing on which of them will submit the “lowest” (but still artificially massive) bid. They rotate the winner over time, ensuring your company systematically overpays for every major infrastructure contract.

AI and Data-Driven Fraud Prevention

Traditionally, auditors detected fraud by manually sampling a tiny fraction of physical invoices. In 2026, relying on physical signatures is a catastrophic failure of Enterprise Risk Management.

Modern AP software employs continuous AI-driven auditing. Before a wire transfer is cut, the system automatically cross-references the vendor master file against the employee database:

  • The Address Match: Do any registered suppliers have the exact same residential home address as a current employee?
  • The Bank Account Match: Does the bank routing number for “Acme Tech Services” match the direct deposit routing number for a VP of Marketing?

Finally, the ultimate deterrent is the Segregation of Duties (SoD). The person who adds a new vendor to the master file must be entirely separated from the person who actually cuts the check. If these two roles are merged into one user profile, massive fraud is a mathematical certainty.

Worked Case: The $1.2m Pass-Through That Ran 14 Months

A facilities manager approves a “cleaning services” vendor at $85k/month. The vendor exists — registered LLC, real bank account — but performs no work; monthly photos are stock images, and the on-site supervisor who would verify is the manager’s brother-in-law. Invoices match the contract, approvals are timely, amounts sit just under the CFO review threshold. Discovery comes from a janitor’s workers-comp claim listing a different employer. Total loss: ~$1.2m over 14 months.

Every control that would have caught it in month 1: (1) vendor setup verification — site visit or video for service vendors over $5k/month, not just paperwork; (2) independent receipt confirmation — someone outside the request chain confirms service delivery quarterly; (3) threshold design — flat monthly amounts just under review limits are the signature pattern, and monitoring should flag persistence, not just size; (4) related-party screening at onboarding — shared addresses, phone numbers, bank details against HR records. No single control is exotic; the failure was running none of them — see AP Fraud Checklist for the monthly tests.

Bid-Rigging Detection (Patterns in the Data)

Collusion leaves statistical fingerprints no individual bid shows:

Signal What to run Follow-up
Identical line-item pricing across bidders Line-level variance report, not totals Demand cost breakdowns; rotate the scope split
Rotating winners with stable shares Win-rate by vendor over 8–12 bids Unbundle lots; introduce a blind-bid round
Losing bids cluster just above winner Bid-spread distribution Interview the losers separately; check communications metadata
Chronic incumbent wins despite higher prices Total-cost comparison including change orders Re-compete with fresh specifications

Rotate evaluation committee members, seal bids until opening with logged access, and log all vendor communications during live tenders. Post-award, compare delivered unit costs to bid — systematic overruns after competitive bids suggest the real margin was always in change orders. Report patterns to the Audit Committee rather than handling vendor-by-vendor, and preserve privilege through counsel when investigations start — see Whistleblower.

Procurement Controls Maturity Ladder

Level Vendor setup Approval Monitoring
1 – Ad hoc Anyone adds vendors Email approvals None
2 – Basic Form + manager sign Thresholds in policy Annual spend review
3 – Controlled Verification + conflict screen, segregated roles System-enforced workflows with delegation rules Quarterly duplicate/exception reports
4 – Assured Periodic re-verification, performance scoring Data-driven (budgets, benchmarks auto-checked) Continuous monitoring + Vendor Due Diligence cycle

Most scaling companies sit at level 1–2 while spending like level 4. The jump to level 3 — enforced workflows plus quarterly monitoring — stops the vast majority of schemes for the cost of one AP analyst’s week per quarter. Audit the maturity annually against Internal Controls and track it in the SOX 404 walkthroughs where in scope.