Frauditing the Procure-to-Pay Process: How Internal Auditors Can Detect Fraud That Traditional Audits May Miss
A Practical Guide to Identifying Fictitious Vendors, Duplicate Payments, Conflicts of Interest, Management Override, and Procurement Fraud
John C. Blackshire, Jr. Corporate Compliance Seminars (CCS) | Internal Auditing, Fraud Risk Management, Procurement Controls, and Data Analytics
The procure-to-pay (P2P) process is one of the most significant areas of fraud exposure in almost every organization.
Companies, banks, insurance organizations, government agencies, and school districts spend substantial amounts of money purchasing goods and services. These transactions involve purchasing personnel, vendors, contract administrators, receiving departments, accounts payable employees, and financial managers.
Each participant has an opportunity to influence how money is spent.
An effective procure-to-pay process should ensure that purchases are authorized, vendors are legitimate, goods and services are received, invoices are accurate, and payments are made only to appropriate parties.
But what happens when the people responsible for these controls intentionally circumvent them?
What happens when employees collude with vendors, management overrides purchasing requirements, or fraudulent banking instructions redirect payments?
These are the questions that internal auditors must address.
Traditional auditing asks whether established controls are functioning. Frauditing asks how someone could intentionally defeat those controls to steal organizational resources.
Frauditing combines fraud risk assessment, investigative thinking, internal control evaluation, data analytics, and professional skepticism to identify fraud schemes that routine compliance testing may overlook.
For internal auditors, the procure-to-pay process is an ideal place to apply this approach.
1. What Is Frauditing?
Frauditing is a practical approach to auditing that places greater emphasis on identifying fraud opportunities, understanding potential schemes, and developing procedures specifically designed to detect intentional misconduct.
It is not a separate professional auditing standard.
Rather, it is a way of integrating fraud-focused procedures into risk-based internal auditing.
A traditional procurement audit might examine whether purchase orders were properly approved, invoices were matched to receiving records, and payments complied with company policies.
A frauditing engagement asks additional questions:
Could an employee create a fictitious vendor and approve payments?
Could two employees collude to bypass segregation of duties?
Could management authorize purchases from a company owned by a relative?
Could a legitimate vendor submit duplicate or inflated invoices?
Could fraudulent banking changes redirect payments?
Could purchasing personnel divide transactions to avoid approval limits?
Could an employee receive kickbacks in exchange for awarding contracts?
The objective is to identify how fraud could occur, what evidence might reveal it, and which controls would prevent or detect it.
Frauditing does not presume that employees or vendors are dishonest. It recognizes that an effective fraud risk assessment must consider the possibility of intentional control circumvention.
2. Understanding the Procure-to-Pay Process
The procure-to-pay cycle begins when an organization identifies a need for goods or services and ends when the vendor receives payment.
A typical process includes:
Purchase requisition.
Vendor selection and onboarding.
Purchase order authorization.
Contract execution.
Receipt of goods or services.
Invoice processing.
Accounts payable approval.
Payment authorization and disbursement.
Accounting and financial reporting.
Vendor performance monitoring.
Fraud can occur at virtually every stage.
For example, a purchasing employee may influence vendor selection, an accounts payable employee may manipulate invoices, or a manager may approve payments for services never received.
The fraud auditor should understand the entire process rather than examining individual controls in isolation.
Fraud schemes frequently exploit the gaps between departments, systems, and approval responsibilities.
3. Fraud Risk Assessment: Think Like Someone Trying to Defeat the Controls
A fraud-focused audit begins by identifying potential fraud schemes.
The auditor should understand the organization's purchasing volume, vendor population, approval structure, technology, and management oversight.
The auditor should then consider how employees, vendors, or managers could exploit weaknesses.
For example, suppose an employee can create vendors, change banking information, enter invoices, and release payments.
That combination of access rights creates an opportunity to establish a fictitious vendor and direct payments to an unauthorized account.
Even if each transaction appears to contain the required approvals, the underlying control structure may be ineffective.
Questions for the fraud auditor
Who can create or modify vendor records?
Who approves new vendors?
Can the same employee initiate and approve a payment?
Who can change vendor banking information?
Can management override purchasing controls?
How are conflicts of interest identified?
Who investigates unusual transactions?
How does management monitor exceptions?
These questions help the auditor identify fraud opportunities before selecting transactions for detailed testing.
4. Fraud Scheme One: Fictitious Vendors
A fictitious vendor scheme involves creating a vendor that does not represent a legitimate supplier relationship.
An employee may establish a vendor using a false business name, an address under the employee's control, or banking information associated with the employee or an accomplice.
The organization then pays invoices for goods or services that were never provided.
Fraud indicators
Potential warning signs include vendors with addresses matching employees, vendors sharing banking information, missing tax identification information, recently created vendors receiving unusually large payments, and vendors with limited transaction histories.
Frauditing procedures
Auditors can compare vendor master file information with employee records, identify duplicate addresses and bank accounts, examine vendor creation dates, and evaluate the supporting documentation for selected vendors.
They should also determine whether the vendor has a legitimate business relationship with the organization.
A matching address or banking detail is an indicator requiring investigation, not proof of fraud.
5. Fraud Scheme Two: Duplicate and Inflated Invoices
Duplicate payments may result from processing errors or intentional fraud.
A dishonest vendor may submit the same invoice multiple times with minor changes to the invoice number, date, or description.
An employee may also deliberately process duplicate payments and arrange for improper refunds or other benefits.
Frauditing procedures
Auditors should analyze invoice populations for identical or similar amounts, repeated invoice numbers, payments to the same vendor within short periods, and invoices containing minor numbering variations.
For example, invoices numbered 100458, 100458-A, and INV100458 may represent legitimate separate transactions—or attempts to obtain duplicate payment.
AI-assisted analytics can help identify these relationships.
The auditor must investigate the exceptions and determine whether the payments were valid.
6. Fraud Scheme Three: Vendor Banking Changes and Payment Diversion
Business email compromise and payment diversion schemes are significant threats to the procure-to-pay process.
A fraudster may impersonate a legitimate vendor and request that future payments be sent to a new bank account.
If employees accept the request without independent verification, the organization may send payments to a fraudulent account.
Frauditing procedures
Auditors should examine vendor banking changes, especially those occurring shortly before large payments.
They should determine whether banking changes were independently authenticated using established contact information.
They should also examine whether the system maintains a reliable history of changes, including the employee who made the change and the person who approved it.
An email from someone appearing to represent the vendor is not sufficient independent authentication.
One of the strongest preventive controls is independently verifying banking changes through a trusted communication channel established before the change request.
7. Fraud Scheme Four: Split Purchases to Avoid Approval Limits
Organizations frequently establish purchasing approval thresholds.
For example, purchases exceeding $25,000 may require additional approval.
An employee seeking to circumvent the requirement might divide a $60,000 purchase into three transactions of $20,000.
Each transaction may appear to comply with the approval policy.
However, the combined activity may represent an intentional circumvention of purchasing controls.
Frauditing procedures
Auditors should identify multiple purchases involving the same vendor, department, requester, and time period.
They should also analyze transactions immediately below approval thresholds.
For example, repeated purchases of $24,750 may warrant further examination when the approval threshold is $25,000.
The auditor should determine whether the transactions represent legitimate separate purchases or an attempt to avoid required approvals.
8. Fraud Scheme Five: Conflicts of Interest and Related-Party Vendors
Procurement fraud may occur when employees or executives direct business to vendors in which they have undisclosed financial or personal interests.
For example, a purchasing manager might award contracts to a company owned by a family member.
The vendor may charge excessive prices, provide inferior services, or receive preferential treatment.
Frauditing procedures
Auditors should evaluate conflict-of-interest disclosure processes, vendor ownership information where lawfully available, competitive bidding documentation, and unusual vendor selection patterns.
They should also examine whether purchasing personnel have the authority to influence vendor selection without independent oversight.
Potential conflicts should be investigated objectively.
A personal relationship does not automatically establish improper conduct, but undisclosed relationships may indicate a control or governance weakness.
9. Fraud Scheme Six: Kickbacks and Vendor Collusion
Kickbacks occur when a vendor provides something of value to an employee in exchange for favorable treatment.
This may involve cash payments, gifts, travel, entertainment, or other benefits.
The vendor may recover the cost through inflated pricing, unnecessary purchases, or unfavorable contract terms.
Kickback schemes are difficult to detect because the purchasing documents may appear legitimate.
Frauditing procedures
Auditors should examine unusual vendor concentration, repeated awards without competition, pricing inconsistent with market conditions, unexplained contract amendments, and deviations from procurement policies.
They should also evaluate the effectiveness of employee conflict-of-interest disclosures and gift policies.
When appropriate, fraud specialists may need to conduct additional procedures.
Internal auditors should avoid making accusations without sufficient evidence.
10. Fraud Scheme Seven: Payments for Goods or Services Never Received
An organization may pay an invoice even though the goods were not delivered or the services were not performed.
This can occur through collusion between employees and vendors, fabricated receiving records, or ineffective approval procedures.
Frauditing procedures
Auditors should examine purchase orders, receiving reports, service completion evidence, and payment records.
For service contracts, the auditor should determine whether management has evidence demonstrating that the services were actually delivered.
For example, a consulting invoice stating "professional services rendered" may not provide sufficient evidence that the organization received the contracted services.
The auditor may need to examine deliverables, project records, correspondence, and evidence of management's acceptance of the work.
11. Fraud Scheme Eight: Management Override
Management override is particularly important because senior managers may possess the authority to bypass established controls.
An executive may direct employees to process payments without normal approvals, select a favored vendor, waive bidding requirements, or approve transactions outside established policies.
The existence of management approval does not automatically establish that a transaction is appropriate.
Frauditing procedures
Auditors should identify transactions processed through exception procedures, purchases approved outside normal authority limits, unusual sole-source contracts, and payments involving senior management.
They should determine whether exceptions were justified, documented, and subject to appropriate independent oversight.
When a potential issue involves senior management, reporting arrangements must preserve Internal Audit's independence.
Significant matters may require direct communication with the Audit Committee.
12. Using the Fraud Triangle and M.I.C.E. to Understand Procurement Fraud
Two frameworks can help auditors develop fraud risk scenarios.
The Fraud Triangle
The Fraud Triangle identifies three conditions commonly associated with fraud:
Pressure: Financial or other incentives that may motivate misconduct.
Opportunity: Weak controls or access that allow fraud to occur.
Rationalization: Justifications individuals may use to excuse improper conduct.
For example, an employee experiencing financial pressure may exploit weak vendor creation controls and rationalize the misconduct as a temporary loan.
The M.I.C.E. Model
M.I.C.E. identifies four possible categories of motivation:
Money: Personal financial benefit.
Ideology: A belief used to justify the conduct.
Coercion: Pressure or threats from another person.
Ego: Status, entitlement, or a desire to demonstrate power.
In procurement fraud, money and ego may be particularly relevant to some schemes, while coercion may be relevant when an employee is pressured to approve an improper transaction.
These frameworks help auditors develop hypotheses.
They do not establish the actual motivation of a particular individual.
13. Data Analytics: Moving Beyond Small Samples
Traditional internal audits often rely on relatively small samples of procurement transactions.
While sampling remains useful, modern analytical tools allow auditors to examine entire transaction populations for selected indicators.
A fraud-focused analytical program might examine:
Data analysis | Potential fraud indicator |
Duplicate invoice numbers and amounts | Duplicate payment schemes |
Vendor and employee address matches | Undisclosed relationships or fictitious vendors |
Vendor banking changes before payments | Payment diversion |
Transactions just below approval thresholds | Split purchasing |
Weekend or after-hours payments | Unusual processing activity |
Repeated sole-source awards | Vendor favoritism or collusion |
Multiple vendors sharing bank accounts | Related vendors or suspicious master data |
High-value payments to newly created vendors | Fictitious or improperly approved vendors |
Payments without receiving evidence | Unsupported purchases |
Unusual credit memos and refunds | Potential concealment or payment manipulation |
These analyses can help identify transactions requiring investigation.
However, auditors must validate the completeness and accuracy of the underlying data.
An exception report is not a fraud finding.
It is a tool for directing audit attention.
14. Using AI to Frauditing the Procure-to-Pay Process
Artificial intelligence can improve the efficiency of fraud risk assessment and transaction analysis.
Auditors can use approved AI tools such as ChatGPT, Claude, or enterprise analytical applications to develop fraud scenarios, analyze data, compare policies, and prepare preliminary audit procedures.
Example 1: Develop fraud scenarios
Identify potential fraud schemes in a procure-to-pay process involving vendor onboarding, purchasing, receiving, accounts payable, and payment processing. For each scheme, identify possible perpetrators, control weaknesses, red flags, and audit procedures.
Example 2: Analyze purchasing data
Analyze this purchasing dataset for possible split purchases, unusual vendor concentrations, repeated payments just below approval thresholds, and significant changes in vendor spending. Identify the analytical criteria and produce an exception report.
Example 3: Evaluate vendor controls
Review this vendor onboarding procedure. Identify control design weaknesses involving vendor authentication, conflicts of interest, segregation of duties, banking changes, and independent approvals.
Example 4: Improve audit findings
Review this draft procurement fraud risk finding. Identify the condition, criteria, cause, effect, and recommendation. Highlight unsupported conclusions and distinguish potential fraud indicators from confirmed misconduct.
AI-generated results must be verified against reliable source information.
Auditors must also protect confidential employee, vendor, and financial information.
AI can help identify suspicious patterns, but it cannot independently establish intent or prove fraud.
15. Evaluating the Procure-to-Pay Process Under COSO
The COSO Internal Control–Integrated Framework provides a useful structure for evaluating procurement fraud risks.
Control Environment
Does management demonstrate integrity and ethical values?
Are conflicts of interest disclosed?
Are purchasing policies consistently enforced, including for senior management?
Risk Assessment
Has management identified fraud risks involving vendors, purchasing, invoices, and payment processing?
Does the assessment consider management override and collusion?
Control Activities
Are vendor creation, purchase authorization, receiving, invoice processing, and payment responsibilities appropriately segregated?
Are banking changes independently authenticated?
Information and Communication
Are employees informed about procurement fraud risks?
Can employees report suspected misconduct without fear of retaliation?
Monitoring Activities
Does management monitor unusual purchasing patterns, vendor changes, duplicate payments, and policy exceptions?
The five COSO components should work together.
A well-designed purchasing policy will not prevent fraud if management routinely ignores it.
16. Frauditing and the IIA Global Internal Audit Standards
The IIA Global Internal Audit Standards reinforce the need for risk-based audit planning, professional skepticism, sufficient evidence, and effective communication.
Internal auditors should consider fraud risks when developing engagement objectives and evaluating controls.
They should also recognize the limits of their responsibilities and competencies.
An internal audit engagement may identify indicators of possible fraud.
However, a formal fraud investigation may require specialized investigative procedures, legal counsel, forensic accountants, or other qualified professionals.
The auditor should follow the organization's established escalation and investigation protocols.
Internal Audit should not compromise evidence, accuse individuals prematurely, or undertake investigative procedures beyond its authority and competence.
17. How to Develop a Fraud-Focused Procure-to-Pay Audit Program
An effective frauditing program should address the entire procure-to-pay process.
Phase One: Understand the process
Document how purchases are initiated, vendors are approved, goods are received, invoices are processed, and payments are released.
Identify key systems, personnel, and approval responsibilities.
Phase Two: Identify fraud schemes
Develop scenarios involving fictitious vendors, duplicate payments, conflicts of interest, kickbacks, split purchasing, payment diversion, and management override.
Phase Three: Evaluate control design
Determine whether controls are capable of preventing or detecting the identified schemes.
Pay particular attention to segregation of duties, independent verification, access rights, and exception monitoring.
Phase Four: Perform data analytics
Analyze vendor, purchasing, invoice, and payment populations for unusual patterns.
Document the analytical methods and validate the underlying information.
Phase Five: Examine exceptions
Investigate selected transactions using appropriate evidence.
Determine whether the exceptions represent errors, legitimate transactions, control deficiencies, or indicators requiring further investigation.
Phase Six: Evaluate root causes
Determine why identified deficiencies occurred.
Possible causes may involve inadequate policies, ineffective system controls, insufficient supervision, or management override.
Phase Seven: Report findings
Communicate supported deficiencies using the condition, criteria, cause, effect, and recommendation framework.
Avoid presenting suspicions as established fraud.
Phase Eight: Follow up
Evaluate whether management has implemented effective corrective actions.
Management owns the internal control framework and remediation plans.
Internal Audit provides independent assurance regarding their effectiveness.
18. What Should Management Be Doing to Prevent Procurement Fraud?
Management should establish a comprehensive fraud prevention and detection program for the procure-to-pay process.
Important measures include independent vendor authentication, effective segregation of duties, appropriate purchasing approval limits, three-way matching where applicable, monitoring of unusual transactions, conflict-of-interest disclosures, and secure payment authorization.
Management should also establish procedures for investigating exceptions and reporting significant matters to the appropriate governance body.
A particularly important consideration is whether management monitors the effectiveness of controls rather than merely documenting that the controls exist.
For example, a vendor banking verification policy has limited value if employees can routinely bypass it.
Similarly, an approval policy is ineffective if senior management can override it without appropriate documentation and oversight.
The strongest fraud prevention programs combine effective control design, management accountability, data analytics, and an organizational culture that does not tolerate control circumvention.
19. What Should the Audit Committee Ask About Procurement Fraud?
The Audit Committee should understand whether management has identified and evaluated significant procurement fraud risks.
Important questions include:
Has management completed a fraud risk assessment of the procure-to-pay process?
Are vendor master file changes independently verified?
Does management monitor duplicate payments and unusual purchasing patterns?
Are conflicts of interest and related-party vendor relationships adequately disclosed?
Can senior management override procurement controls without independent review?
Are significant procurement exceptions reported to appropriate governance personnel?
Has Internal Audit evaluated the design and operating effectiveness of key procurement controls?
Are corrective action plans assigned to responsible management personnel and monitored through completion?
The Audit Committee should focus on the effectiveness of management's fraud risk management processes.
It should not assume responsibility for operating procurement controls.
20. Why Frauditing Is Different From a Traditional Compliance Audit
A traditional procurement audit may conclude that most transactions complied with established procedures.
A fraud-focused audit asks whether those procedures could be intentionally circumvented.
For example, an invoice may have a purchase order, receiving report, and management approval.
But what if the purchase order was created after the invoice?
What if the receiving report was approved by someone who never saw the goods?
What if the vendor is owned by the employee who approved the purchase?
What if the manager approving the transaction has an undisclosed financial interest?
These questions illustrate why frauditing requires more than checklist-based compliance testing.
Frauditing examines the substance of transactions, the incentives and opportunities surrounding them, and the possibility that apparently valid documentation was created to conceal misconduct.
Conclusion: Frauditing Makes Procure-to-Pay Audits More Valuable
The procure-to-pay process presents significant opportunities for fraud because it involves the movement of organizational funds through multiple departments, systems, and approval processes.
Fraud risks include fictitious vendors, duplicate payments, inflated invoices, payment diversion, split purchasing, conflicts of interest, kickbacks, unsupported purchases, and management override.
Traditional internal auditing provides an important foundation for evaluating these risks.
Frauditing builds on that foundation by requiring auditors to think more critically about how controls could be intentionally defeated.
Modern data analytics and AI can strengthen this approach by helping auditors examine large transaction populations, identify unusual patterns, and develop more targeted audit procedures.
However, the auditor must continue to rely on sufficient evidence, professional skepticism, and sound judgment.
The ultimate objective is not simply to discover suspicious transactions.
It is to help the organization strengthen fraud prevention, improve detection capabilities, and protect its financial resources.
The most effective procure-to-pay auditors do not stop after determining whether a control exists. They determine whether the control can actually prevent or detect the fraud schemes that threaten the organization.
Strengthen Your Fraud Auditing Skills With Corporate Compliance Seminars
Corporate Compliance Seminars (CCS) provides professional CPE training in fraud risk assessment, internal auditing, procurement controls, vendor data management, forensic techniques, data analytics, and artificial intelligence.
Our programs help auditors develop practical skills for identifying fraud opportunities, evaluating internal controls, analyzing transactions, and communicating meaningful findings to management and Audit Committees.
Recommended CCS Training Topics
Frauditing and Fraud Risk Assessment
Learn how to identify potential fraud schemes, evaluate opportunities for control circumvention, and develop fraud-focused audit procedures.
Vendor Data Management
Examine vendor onboarding, vendor authentication, banking changes, duplicate payments, and controls designed to prevent payment diversion.
Internal Auditing and Fraud Detection
Develop practical approaches to identifying fraud indicators, performing data analytics, and evaluating the effectiveness of fraud prevention controls.
AI Boot Camp for Auditors & Finance Professionals
Learn how to use AI to analyze transactions, identify unusual patterns, develop audit procedures, and strengthen fraud risk assessments.
Explore Upcoming CCS CPE Events
Visit Corporate Compliance Seminars to explore upcoming live webinars, in-person training, and specialized CPE programs.
Better fraud risk assessments lead to stronger internal controls, more effective audits, and better protection of organizational resources.
Corporate Compliance Seminars — Professional CPE Training in Internal Auditing, Fraud Risk Management, Internal Controls, Data Analytics, and Audit Tradecraft.
Comments