FDA Plan

There is no entity analysis because the supplier is real.

The fraud data analytics must focus on the line‐item description on the invoice or the purchase order. The analysis is searching for a vendor that the majority of purchases are within a specific expenditure area; therefore the anomaly is line item purchases that are not consistent with the primary expenditure associated with the supplier.

When a company uses a commodity code within its purchasing file, the identification of the anomaly is simple. The fraud data analytics summarizes purchases by vendor by commodity code. Vendors that have only one commodity can be excluded. The fraud auditor then uses data interpretation to review the remaining list for anomalies. If your company does not maintain commodity codes, the use of general ledger account number may provide a similar analysis. The final approach would be a summary by vendor, by line item. The last approach would require the most extensive manual effort by the fraud auditor.

The first audit step should be to review the selected vendor's website to determine if the vendor advertises the anomaly purchase on its website. If the item is not advertised, the fraud auditor has credible evidence to perform an investigation.

FDA Approach

The entity testing relies on the duplicate analysis, which was discussed in Chapter 6.

If the entity testing reveals hidden entities, the first step of the transaction analysis is linking the transactions to the vendor numbers identified in the hidden entity testing. In this way, instead of summarizing all transactions by vendor number, we are able to shrink the population to those transactions that link to the hidden entity number. The transaction analysis searches for duplicate line items between the two companies. If exact matches do not occur on the line item, using a general ledger number may provide a commonality for analysis. If line‐item analysis is not effective, search for duplicate invoice number or invoice date between the two companies. Once the duplicate purchases are identified, summarize the transactions based on dollars and frequency to determine if the combined purchases exceed key control thresholds.

If entity analysis does not reveal hidden entities, then we need to search on all transactions. The first step is finding a common denominator between the transactions. Start with the general ledger code, department code, or cost center. Based on the common denominator match, search for a secondary match for duplicate information between the transactions such as invoice number, invoice date, line‐item description, or purchase order number. The secondary match would be a duplicate test using a duplicate date and common line item between two different vendor numbers or a duplicate invoice number and common line‐item description between two different vendor numbers.

One of the complexities associated with the scenario is how the supplier uses the two companies. In one situation, the second company's sole purpose is to facilitate the structuring of purchases to avoid your company's internal dollar levels. In essence, the second company is similar to a shell company. If this is true, then the fraud data analytics for one of the hidden entities would meet the profile of the false billing shell company.

If the second company is a free‐standing company selling to multiple customers and various product lines, then we will search for duplicate line items between the two vendors and the secondary criterion would be date of purchase. As a practical suggestion, in the data usability analysis determine the quality of the line item descriptions in your files.

FDA Plan

The entity analysis would first focus on those codes that may help identify a government‐preferred supplier. Since the other vendors in this category may be operating from home offices or small offices, the address field may be of use. The fraud data analytics could focus on street addresses or known mailbox service addresses.

The transaction analysis would focus on invoice number and line‐item descriptions. The invoice number pattern would most likely be a sequential pattern or a limited range pattern. The amount of the invoice would not be critical because the supplier was most likely selected on a sole source basis. In my experience, the invoice amount tends to be an even amount.

When the real pass‐through company operates as a shell company, the invoice description tends to be vague or provide limited line‐item descriptions as with a real supplier. The data interrogation should focus on the lack of alpha and numeric in the description. The numeric description may also have limited integers.

Overbilling: The Vendor Alone by Exploiting the Vulnerabilities of the Company's Internal Controls

In this category, the basic assumption is that the internal source is not complicit in the overbilling. However, for whatever reason the internal controls do not prevent or detect the vendor from overbilling your company.

A vendor understands a company's receiving and payment internal controls in some ways better than the company itself. With this knowledge, the vendor exploits the vulnerabilities in the receiving and payment process. Although the illustrations are for tangible goods, the concept is similar for services. Typically the invoices are considered small dollar for the organization. The concept of small dollar is relevant to the organization versus the concept of a small number. The reason for the small‐dollar invoice is the reduced visibility concealment concept, and often the internal controls are less robust for small‐dollar invoices. Due to the volume of transactions in this analysis, filtering of activity is paramount to the success of the analysis. The more common scenarios perpetrated under this category of overbilling are:

1. Submitting an invoice where the amount or unit price on the invoice exceeds the purchase order. However, the price increase is within the acceptable tolerances that exist in a company's payment system. The fraud data analytics compares invoice amount to purchase order amount searching for invoices that exceed the purchase order amount within tolerances. The analysis may occur on line item or total invoice. The report should provide three columns of data. Each column of data will provide a frequency and aggregate dollar value of the vendor invoices. The first column is frequency and aggregate dollar value of vendor invoices that are equal to or less than the purchase order. The second column is the frequency and aggregate dollar value of invoices exceeding the purchase order within tolerance. The third column is the frequency and aggregate dollar value of vendor invoices exceeding the purchase order tolerance. The first selection process is based on frequency of occurrence of invoices exceeding purchase order within the tolerance and the dollar impact. The second selection is the invoices exceeding the purchase order tolerance level. If internal controls are operating effectively, then invoices exceeding the purchase order should not be paid without a change order, or the overbilling scheme would indicate someone is overriding internal controls, which then indicates collusion between an internal and external party.
2. Submitting small‐dollar invoices that are fictitious and are matched to an open purchase order. The first step is to identify open purchase orders. The attribute is a purchase order than has more than one invoice. The fraud data analytics summarizes by vendor by purchase order the invoices by small dollar and large dollar. The dollar value is based on what is large and small for your company. The report should provide both the aggregate dollar value and frequency of invoices by the two categories. The sample selection is based on data interpretation focusing on the line item descriptions, which tend to be vague, nondescriptive, or illogical for the noted vendor.
3. Submitting small‐dollar invoices that are fictitious and do not require a purchase order. The first step is to identify invoices that have no purchase order number. The fraud data analytics summarizes by vendor the invoices by small dollar and large dollar. The dollar value is based on what is large and small for your company. The report should provide both the aggregate dollar value and frequency of invoices by the two categories. The sample selection is based on data interpretation focusing on whether the frequency and aggregate dollar value of the item on the small‐dollar invoice is logical for the vendor and your company. The sample selection is based on data interpretation focusing on the line item descriptions, which tend to be vague, nondescriptive, or illogical for the noted vendor.
4. In scenarios two and three, the data interpretation is the challenge because of the sheer volume of transactions. The use of inclusion and exclusion theory is important when the analysis has a large number of transactions. So a few thoughts in refining the process:
   1. The starting point is to exclude vendors that have a low number of small‐dollar invoices, based either on frequency or aggregate dollar amount.
   2. Exclude the nuisance vendors from the analysis.
   3. Use the number analysis on the remaining vendors. Exclude large‐dollar invoices because the scenario is searching for a high frequency of small‐dollar invoices. The number anomaly is searching for the vendor submitting small‐dollar invoices of the same amount for goods or services not provided.
   4. Using the description field on the invoice, search for a description that has no numeric integers in the description line. The lack of integers indicates that the line item description was created manually versus from a customer's product database.
5. Submitting an invoice with a false add‐on charge. The false charge might be either a line item on a real invoice or an invoice with just the false add‐on charge. These charges range from shipping to restock charge. The difficulty is how to search and isolate the add‐on charge. The following techniques have been helpful to identify the scenario:
   1. Start by summarizing the line‐item description field on the vendor invoice and provide the frequency of occurrence of the line‐item description. The report, while voluminous, will identify all line‐item descriptions and variations of spellings in your database. The intent of the report is to act as a reference tool more than a sample selection tool.
   2. Establish a table of common names used to describe an add‐on charge. The previous report is useful in identifying common names for add‐on charges. The fraud data analytics creates a table of common names and performs an alpha string search for the common name in the line‐item description. The report should summarize by vendor number by the common name providing the frequency of the line item and aggregate dollar value of the line items. The last line for each vendor should be all line items not on the table of common names. The sample selection is based on data interpretation focusing on whether the frequency and aggregate dollar value of the add‐on charge are logical for the vendor or whether the add‐on charge itself is logical.
   3. A second approach is to summarize by vendor number, by invoice number identifying the invoices having an add‐on charge, and the invoices that do not have an add‐on charge. The report should provide the frequency and aggregate dollar value of vendor invoices for both the have and have‐not occurrence. The sample selection is based on data interpretation based on the anomaly of why some invoices have an add‐on charge and other invoices do not have an add‐on charge. The nature of the line‐item description will be the first clue.
   4. A third approach is to search the invoice line for add‐on charges through the quantity field on the line item. Line items on a vendor invoice tend to have a quantity of zero, blank, or one in the quantity field. The correct answer for the search depends on how accounts payable records line‐item add‐on charges in the database. The fraud data analytics is to identify by vendor invoice by invoice line all invoices that have blank, zero, or one in the quantity line. The sample selection is based on data interpretation focusing on whether the frequency and aggregate dollar value of the add‐on charge are logical for the vendor.
6. The quantity on the invoice is greater than the quantity delivered. This scenario typically occurs for tangible goods that no physical inventory exists for the item—that is, supply items. The fraud data analytics should first identify all tangible goods. Using the general ledger codes is an easy but not perfect way to isolate tangible purchases. The analysis will exclude all purchases associated with inventory because the variance between book and count should reveal a theft scheme occurring. The key is to summarize the quantity purchased from the vendor by line item. The sample selection would start with outlier analysis and then switch to data interpretation based on whether the aggregate quantity for line item is logical for your company.
7. Submitting invoices for items that are not ordered but delivered. The first level of identification is all invoices with no purchase order. The transactions should be summarized by vendor, by line item. Each line item should have the aggregate quantity and aggregate dollar value. The sample selection is based on data interpretation on whether the line item quantity is logical for your company.
8. Vendor invoices that have one line item and a quantity of one. This may be an indicator that the invoice was entered with the line item being one, the unit price is the total value of the invoice, and the extended total equal to the unit price. This would indicate the invoice was entered in a manner to circumvent the three‐way match. In reality, this might be an indicator of either vendor alone or vendor in collusion. If nothing else, it is indicator that something is wrong with your internal controls.
9. Submitting real invoice that one or more line item is a false charge. For invoices with purchases orders, the data interrogation should match line item on invoice to line item on the purchase order. The sample selection would be for invoice line items with no corresponding match to the purchase order.

Overbilling: By Submitting Duplicate Invoice via the Vendor Alone or Vendor in Collusion Accounts Payable or by Accounts Payable Alone

The scheme occurs by intentionally submitting an invoice twice for payment of the same goods or services. Duplicate payment test depends on how the vendor or accounts payable clerk is submitting or recording the second invoice. The test examines the invoice number, invoice date, invoice amount, and invoice line‐item description. The test is designed to search for the true duplicate with no concealment or a duplicate invoice that uses concealment by a change in the second invoice: invoice number, invoice date, invoice amount, or line item description. For clarification, the concept of first or second invoice is not intended to describe the order the invoice was submitted but rather, the concept of two vendor invoices for the same goods or services. Also, the discussion will describe duplicate testing when there is no purchase order or an open purchase order. The testing could also be relevant when the purchase order is issued after the receipt of the invoice and the purchase order transaction is created by accounts payable. The fraud auditor will need to understand the fraud opportunity question, person committing, as it relates to their organization to properly address the possible combinations of opportunity.

1. The first test should be to search for invoices with an exact match on a duplicate invoice number, duplicate date, and duplicate amount. The test could also focus on duplicate invoice number, date, and amount alone. The analysis could also focus on one data element (e.g., duplicate date); unfortunately, this approach requires the fraud auditor to use data interpretation searching for the duplicate pattern versus specific identification. Remember, always perform the easiest test first and then perform tests in the order of difficulty.
2. Hidden duplicate invoice number occurs when the invoice number on the second invoice, the duplicate invoice, is changed to avoid the internal edit for duplicate invoice number. The typical variations are where a letter, special symbol, or a numeric digit is added or subtracted from the second invoice to avoid the duplicate test or second invoice number has a transposition in the invoice number. In the hidden duplicate invoice number test, the data interrogation plan will need to create a virtual invoice number field and strip out the alpha, special symbol on the beginning or end of the string or embedded somewhere in the invoice string. The report should place the virtual invoice number and the actual invoice number next to each other for easy visual comparison.
   1. If the alpha or special symbol technique is added to the second invoice, the duplicate test on the virtual invoice number should find the duplicate invoice number.
   2. If an extra numeric digit is added, there should be a significant gap between the last and first invoice number. The report should calculate an invoice number range and a date range. Unfortunately, this report may produce a high number of false positives due to data integrity issues.
   3. If an extra digit is added or subtracted from the second invoice number, the anomaly would be the number of digits in the invoice number by vendor number. By vendor number, create a frequency analysis of the number of integers in the invoice number. The report is searching for a vendor that has multiple lines of frequency by integer (e.g., five integers, six integers).
   4. If the approach is a transposition of integers within the invoice number, then there should be an anomaly between the invoice number sequence pattern and the sequence of invoice dates. Assuming the vendor follows an ascending pattern of invoice numbers the dates should also follow an ascending pattern. The report is searching for vendors with invoice numbers and invoice dates that do not follow a logical ascending pattern.
3. Different vendor invoice number with a duplicate date or duplicate line item or duplicate amount or any combination of the three other items. The first problem with the test is described earlier in this chapter as the nuisance vendor. These vendors by their nature submit multiple invoices per day for the same type of service or goods. The different invoice number duplicate payment analysis should create two groups of vendors for the test: the list of nuisance vendors and the list of non‐nuisance vendors. Data interpretation by the fraud auditor will be required for both data sets.
4. Different invoice number, date, and amount. The second invoice contains an additional charge (add‐on charge) that provides the illusion of two different invoices. See the previous section regarding vendor alone exploiting the vulnerabilities of internal controls for discussion of add‐on charges.
5. The accounts payable function may be in collusion with a vendor and the accounts payable function is intentionally paying a vendor invoice twice. The accounts payable function is receiving a kickback from the vendor. The data pattern is a high frequency of duplicate payments to one vendor.
6. In smaller accounting organizations, the accounts payable clerk can commit the duplicate payment scheme alone by intentionally paying a vendor invoice twice. The accounts payable clerk then contacts the vendor, indicating the invoice was paid twice in error. When the vendor remits the refund for the duplicate payment, the accounts payable clerk diverts the refund to a bank account that the accounts payable clerk controls. The data pattern is a regular frequency of duplicate payments to different vendors.

Overbilling: Understanding the Fraud Risk Structure When Collusion Occurs between the Vendor and the Internal Person without the Involvement of the Procurement Process

The concept is simple: The vendor operating in collusion with a budget owner or senior manager overcharges your company. Overcharging that occurs through the procurement function is discussed in Chapter 9. In this chapter, overcharging does not involve the procurement function but is linked to the approval process, receipt process, or payment process. Collusion is the key word in this scheme. The internal person is a control owner. The variables in overcharging are the expenditure category, the industry, responsibilities of the control owner participating in the scheme, and where the scheme occurs in the expenditure cycle. It would be impossible for anyone to describe all the overcharging permutations by industry, so this book will focus on the methodology and allow the fraud auditor to adapt the methodology to the industry and expenditure category.

The first step is to understand the inherent scheme structure of how overbilling occurs:

1. Overcharging on unit price occurs through a change in price after procurement, or the unit price is inflated. If inflated, the approach is to use either trend analysis, outlier analysis, or benchmarking a vendor unit price to another source.
2. Charging for a higher quantity than delivered—the methodology should differentiate between inventory items and supply items. Inventory items should eventually reflect a variance or excessive adjustments, whereas non‐inventory items will use outlier analysis by identifying a quantity that exceeds business use.
3. False charges on real invoices simply stated—either the service was not performed or the tangible item was not received.
4. Intentional duplicate items on real invoices—the test focuses on duplicate description field. For tangible good expenditures, obviously this will create an extensive list of false positives. For services, the test may not be as effective because of the nature of service descriptions on invoices.
5. Intentional duplicate payment of an invoice—the fraud data methodology will focus on duplicate date, invoice number, or amount for exact matches.
6. False add‐on charges will vary by services and tangible goods. The fraud data analytics searching for falsely added charges should have two homogeneous data sets: service expenditure and tangible good expenditures. For service, using keyword searches that relate to the service will prove effective. For tangible goods, search line items that have no quantity or a line‐item description that does not have a numeric string.
7. Charging for a higher quality than delivered (product substitution). The nature of product substitution does no lend itself to fraud data analytics because the fraud is in the tangible item versus the data. However a line item description that does not provide standard industry information may be a red flag.
8. Charging for goods/services that are not needed by the company. In this scheme the goods and services are received. The nature of the scheme does not lend itself to fraud data analytics. Outlier analysis may help, but without an allegation, finding a starting point is difficult.

Fraud data analytic routines need to be designed around the opportunity to commit the scheme and the method of overbilling. The fraud data analysis starts by creating homogeneous data files based on the opportunity to commit the scheme, then the search for the overbilling techniques. The analysis typically requires creating multilayers of files to identify the specific fraud scenario. The reason for the opportunity analysis is to establish the intent factor through frequency analysis. The technique analysis is to identify the method of overbilling. In this book, we will discuss opportunity analysis from three perspectives:

1. False administration of the properly issued purchase order. The starting point is the change order.
2. Budget owners circumventing purchasing but providing the illusion of compliance. The starting point is to identify all invoices with no purchase order, open purchase orders, small‐dollar invoices, and invoice splitting.
3. Budget owner that purchases directly from the supplier by design of purchasing policies. The starting point is invoices with no purchase order or the purchase order is issued after receipt of the invoice.

Once the opportunity homogeneous data files are created, the second step of the analysis is to search for the various overbilling techniques. Based on my experience, the fraud auditor should start with an inflated unit price, false add‐on charges, and excessive item purchases scheme.

To avoid confusion, within the context of this chapter, the term purchase order includes either a purchase order or a contract. In regard to bidding procedure, the approach described will not distinguish between oral quotes, written quotes, or sealed bid procedures.

The basic assumption in this overbilling category is that procurement controlled the acquisition and the procurement function is not involved in the scheme. A purchase order is issued and the overbilling occurs through falsely approving changes to the purchase order, overriding the purchase order with invoice approvals, or the budget owner provides advance communication of a future change of the purchase mix and no change to the purchase order.

The overbilling in this scheme occurs after procurement through the false administration of the purchase order. So, do not be fooled by the evidence of written bids, written quotes, purchase orders, and contracts. The bidding process provides the illusion of sound internal controls, which effectively conceals the budget owner's intent to corrupt the procurement process.

The good news is that overbilling after procurement leaves an audit trail of change. Now the bad news: Since most vendors on your master file are real vendors, the sheer volume of data is a general concealment condition. Furthermore, changes to purchase orders are common, and changes to projected needs do occur. Whatever the reason, the key word is change.

The change fraud data analytics methodology in the false administration scenario is the search for change through the purchase order file or through the invoice file. This is not a matter of style but the search for different types of changes.

Overbilling: When the Budget Owner or Senior Manager Operates in Collusion with the Vendor to Avoid Bidding Levels but Complies with Purchasing Procedures

In the circumvent scheme, the budget owner circumvents the procurement function by creating requisitions below the bidding level and recommending a preferred vendor, or the budget owner purchases directly from the vendor through small‐dollar purchases; however, the purchases in the aggregate would require bidding procedures. The key word is circumvention through compliance with purchasing procedures.

The circumvention fraud data analytics strategy is based on small‐dollar purchase orders, small‐dollar invoices, and split invoices. The circumvention is how the internal source avoids the intent of procurement controls and provides the illusion of full compliance with procurement. A second avoidance strategy is the time extension of the purchase order, which effectively allows for avoidance of the procurement procedures. Circumvention can also occur when a real supplier operates under multiple names.

Overbilling When the Vendor Is in Collusion with an Internal Source (Budget Owner) and the Internal Source Negotiates the Purchase and Administers the Contract, Effectively Bypassing Procurement

In this scenario, the entity is real, the fraud profit is embedded in the invoice or purchase order, and no change is required to the documents. Therefore, the red flags are not visible in one transaction but would be visible over a period of time. A caveat: If the fraud auditor has superior knowledge about a specific purchase, the fraud auditor would be able to see the anomaly in a transaction. In a classroom setting, using one invoice from an equipment rental fraud scheme, a gentleman with 25‐plus years in the equipment rental business was able to see the fraud in two seconds. For the fraud auditor without superior knowledge, fraud data analytics is the methodology for identifying overbilling.

Fraud data analytics is a multi‐tiered approach, starting with internal control circumvention, use of change analysis followed by specific identification, and then the use of data interpretation through the use of change, trend analysis, or benchmarking to similar purchases. The fraud auditor will need to make a few assumptions in the analysis based on fundamental fraud theory. For example, the greed factor will cause the perpetrators to want more money. The fraud will continue until some event stops the fraud. The supplier and internal person are friends.

The first step in the circumvention strategy is to identify purchase orders that avoided procurement. By avoiding procurement, it means that no meaningful procurement procedures were performed on the selection of the vendor. The mere fact that a purchase order is issued does not indicate that meaningful procurement procedures were performed. The problem becomes how to identify such acquisitions. In this analysis, the fraud data analytics plan will need to make assumptions regarding how to identify circumvention. So, any invoice issued on the same day as the purchase order, or the purchase order is issued after the invoice date, becomes the first homogeneous data file. Therefore, all invoices where the purchase order is issued first are excluded from the analysis. The assumption in this decision is that procurement selected the vendor versus a budget owner.

In those companies that have bid codes in their procurement systems, the fraud data analysis would start by identifying which purchase orders were issued with a code, which indicates the purchase order was issued without a bidding process (e.g., sole source selection). Unfortunately, most companies do not have such a code. Therefore, your first internal control recommendation is for your company to require that a bid code become part of your data files.

The next step is to filter out what I have referred to as distraction vendors. To illustrate, payments to utilities, office rental, and mail delivery services usually match the data selection assumption. Since these vendors are not what the fraud data analysis is searching for, the vendors should be excluded from further analysis.

The next step is to summarize the purchases that circumvented purchasing by person, department, or line item of purchase, searching for the following change patterns:

• Change of internal person and change to vendor for a specific line item.
• Change of vendor for the specific line item and no change to the internal person.
• No change of internal person and no change to vendor.

Searching for change in vendors in large companies sounds good, but in reality is very difficult. The use of general ledger categories can facilitate the process because the general ledger category does create a common denominator of like purchases.

A second approach to search for vendor changes is to summarize by line item, sort the line items in date order, then by vendor number. The first record and last record analysis in the software is a great tool for this analysis. The process is searching for a change in vendor on a line‐item basis. Data filtering should be considered after the data summarization.

Using the change analysis, we now have two homogeneous data files: purchase orders with a change to supplier or internal person and purchase orders with no change to supplier or internal person.

The next step for both files is specification identification using a form of trend analysis by searching for increases in price or quantity of a line item over a period of time.

Using the exclusion theory, exclude from your analysis all line items that had no change in price or quantity consistent with your fraud theory. The next step is to determine the size of the resulting file. If the resulting files are large, data filtering based on the dollar size of the line item may be an effective technique to further reduce the size of the file.

Disguised Expenditures: Internal Person Purchases the Goods with the Intent of Committing a Theft Scheme

In this scenario, the internal person purchases items with the intent to commit a theft scheme for the purpose of selling the item. In some ways, this is one of the most difficult fraud scenarios to detect, because where does the fraud auditor start? The auditor's experience and knowledge of the company is paramount to selecting the starting point. It becomes an educated guess.

The good news about the scenario is that the frequency of purchase and aggregate dollar value are the best clues. If the item is inventory based, variances or write‐offs may provide a clue. Maybe the frequency and aggregate can be linked to a person.

Data interpretation is the best strategy for this fraud scenario. The fraud data analytics will start with the data summarization by expenditures, followed by the use of outlier analysis. The first summary is all about creating homogeneous data sets. The second summary is all about data interpretation. The sample selection is based on the fraud auditor's knowledge of the business. The fraud auditor is encouraged to select a department, expenditure area, a specific item to summarize. Trying to summarize all company data for this fraud scenario is too overwhelming. There are three overall strategies for data summarization:

1. Identify tangible items in which the consumption exceeds company requirements.
2. Identify tangibles items that have an easy resell value.
3. Identify assets recorded in the balance sheet—inventory or equipment that have known shortages—or focus on asset write‐off schemes.

The fraud data analytics should summarize purchases by a category by specific line items in the category. The analysis should focus on aggregate quantity of the specific item and aggregate dollar value of the purchase. The use of disaggregated analysis is critical to identify items that fit the theft pattern versus normal internal consumption. The sample selection is based on the quantity of the item purchased consistent with company needs.

For recorded assets, the data summarization should focus on the frequency and aggregate value of the write‐off. Hopefully, the fraud data analysis can link the write‐off to a person.

Service expenditures do not fit the concept of theft; however, services paid by the company that inure to the benefit of a company employee would fit the parameter of theft. The fraud auditor should consider expenditures that would have a personal benefit.

In one project, a factory supply manager was purchasing all supply items from one supplier. Closer examination of all the supply purchases revealed a high quantity of ladders. The supply manager was selling the ladders. To further illustrate expenditure areas involving theft‐for‐resale schemes based on my experience: copy paper, copper cabling, IT supplies, and small tools.

Personal Expenses: Paying for Personal Expenses That Inure to the Benefit of the Internal Person

The first place to look for this scenario is in the procurement card purchases. Chapter 10 will cover these expenditures. The difficulty associated with the personal expense analysis is that by the nature of the scenario, the expenditure is typically small dollar and low frequency.

The targeted expenditure approach is effective for finding personal expense scenarios. One approach is to subjectively identify departments that by the nature of the department purchase items in the normal course of the business that would also have a personal nature to the expense. To illustrate the concept, think about the types of items purchased by IT or marketing.