Vendor Controls Prevent Theft

Special thanks to Charles Hall, CPA for allowing Yellowbook-CPE.com to republish this valuable article. Vendor Controls Prevent Theft was originally published by CPA Hall Talk, February 2025.

New Vendor Controls

Do you know how new vendors are added to accounts payable?

You should.

In some of the more damaging thefts I witnessed, the fraudster added fake vendors and made payments to bank accounts they controlled. (In one case, the guy stole $8.7 million, left his family and hid on the Appalachian Trail for years.)

Think about it.

A payables clerk adds a new vendor with his or her address, if a physical check is to be mailed.

Or, for ACH payments, the payables person adds a new vendor with his or her personal bank account number.

Either way, once the fraudster establishes the fictitious vendor, the door is open to repeated thefts.

The person adding the fake vendor sends fake invoices, and payments are made.

How?

If the person setting up the new vendor works in the accounts payable department, they queue the payment (even though there is no approval for it).

Since most payments today are made electronically, no check is printed or signed; the payment is sent electronically.

Or, if the payables clerk needs an approval, he finds someone with that authority (like a department head) and asks them to assist. They later split the stolen money.

If you’re an auditor, pay attention to the controls related to new vendors.

If one person can add a vendor and no one else knows, you have a problem. You want at least two people involved in the new vendor process.

Sure, it’s okay for one person to add the vendor, but another needs to see or approve this (maybe a controller or someone outside of payables).

Transparency decreases fraud.

Existing Vendors

Payables personnel can use old vendors in the manner described above.

How?

The payables person changes an existing vendor’s address or bank account (to their own) and submits fake invoices. For example, the payables person changes the vendor bank account number to their personal account number.

So, monitor changes to existing vendors and understand the related controls.

Looking for high-quality and convenient CPE?

We have you covered! Our live webinars are a great choice if you want the learning to come to you. Just log on at the scheduled time and enjoy wherever you are! Here are a few of our upcoming courses:

• Apr 10: Generative AI Case Studies: Lessons Learned in Public Sector Audit Shops (2 CPE hours)
• Apr 28: Using ChatGPT with Excel for Government Auditors (2 CPE hours)
• May 7: Internal Audit Strategy for Government Auditors (3 CPE hours)
• May 13: Continuous Improvement Tools for Government Auditing (2 CPE hours)
• May 15: Project Management for Government Auditors (3 CPE hours)

Need to do things at your own speed, but still get all your credits? Plan your CPE around your life, not the other way around! Yellowbook-CPE.com has dozens of self-study courses, including the Single Audit Bundle. Tackling a Single Audit or two this year? This bundle is for you! Gain a solid grasp of how grants work and the requirements needed to comply with federal grantor expectations.