Where money is lost.
WHAT COMMON SCHEMES EXIST
False invoices from suppliers that do not exist Changed bank details, diverting payment Inflated invoices, with the difference shared Purchases for personal use Suppliers connected to staff, undisclosed Duplicate invoices paid twice
WHAT THE MOST COMMON EXTERNAL SCHEME IS
An email purporting to be from a supplier, advising new bank details.
WHY IT WORKS
It arrives at a plausible moment, and it looks routine.
WHAT TO DO ABOUT IT
Verify every change of bank details by telephone, using a number you already hold.
WHY NOT THE NUMBER IN THE EMAIL
It is part of the fraud.
WHAT CONTROLS REDUCE INTERNAL RISK
Separation of ordering, receiving and payment Quotations above a threshold Approval before commitment Regular review of the supplier list Declaration of interests by staff
WHY DECLARING INTERESTS MATTERS
Connected suppliers are legitimate if disclosed and improper if concealed.
WHAT TO REVIEW PERIODICALLY
New suppliers added Suppliers with addresses matching staff Suppliers with no verifiable existence Payments just below thresholds
WHAT TO VERIFY FOR NEW SUPPLIERS
Registration A verifiable address and telephone number That someone met them
WHAT TO DO ABOUT DUPLICATE PAYMENTS
Match invoices against orders and receipts.
WHAT TO NEVER DO
Pay from a statement rather than an invoice Pay without evidence of receipt
WHAT TO ESTABLISH
That controls apply to everyone, including the owner.
