| As you know, with proper internal controls along | | | | that new vendors with significant first time |
| with segregation of duties, establishing a new | | | | payments were legit. Also, payments to vendors |
| vendor or updating the Vendor Master file will | | | | who provided only a PO box as a remit to or |
| reduce the exposure of fraud. Without being | | | | address. Back in the days before the internet, we |
| complacent regarding fraud, you are probably | | | | used D&B and any other manual means to |
| comfortable with your current updating process. | | | | confirm their authenticity - like the yellow pages, |
| Many A/P shops are faced with recent or | | | | phone contact, etc. Yet, today it is much easier |
| anticipated A/P system and process changes that | | | | to perform this check on almost every new |
| you know has or will disrupt the Vendor Master | | | | vendor using the internet (web sites and yellow |
| process status quo. To gain increased efficiencies | | | | pages) and on line D&B, Hoover access, etc. |
| and productivity, A/P and procurement | | | | During my A/P audits, I always recommended |
| applications are relying on the use of internet and | | | | this added control to protect my clients against |
| intranet technologies to update the Vendor | | | | any potential fraud. |
| Master. Use of these technologies should present | | | | Why Is Front-End Verification Is Important |
| an opportunity for A/P to improve internal | | | | I bring this to your attention, since there are a |
| controls or in fact may present internal control | | | | number of front end AP systems |
| challenges when updating the Vendor Master. | | | | The employee then prints out the coversheet, |
| Let me first address the latter - The Challenge. | | | | obtains management approval (signatures) on the |
| "According to a recent global study by | | | | coversheet, attaches the invoice to the cover |
| PriceWaterhouseCoopers and the Martin Luther | | | | sheet and forwards the packet to AP for |
| University in Germany, corporate fraud increased | | | | payment. In such front end systems where |
| 22% over the last two years...Despite significant | | | | every field AP needs must be completed by the |
| investment in internal corporate controls in the | | | | invoice submitter, mischief can occur. |
| wake of Sarbanes-Oxley Act. | | | | Therefore, I believe it is critical to have some kind |
| The study also noted that most corporate fraud | | | | of vendor verification to prevent fraud when new |
| was detected by accidental means. Therefore, | | | | vendors can be added by employees or even |
| implementing preemptive internal control | | | | other company assigned employees. You may |
| enhancements will only help in your attempt to | | | | want to address adding another separate vendor |
| minimize your exposure to fraud, especially when | | | | verification control point, if you think vendor |
| the integrity of Vendor Master is to be | | | | verification is worthwhile from your experience? |
| maintained. Let me describe a how a productivity | | | | New Vendor Verification Guidelines |
| enhancement presented a challenge for one | | | | I highly recommend that someone not directly |
| company to protect itself against fraud. During a | | | | involved in setting up the vendor perform a |
| recent recovery audit I conducted, A/P | | | | double check. Any vendor who submits a PO Box |
| headcount was reduced when the company | | | | for an address and no telephone number |
| installed an A/P linked front end intranet application | | | | deserves a little additional scrutiny. Many |
| that allowed and authorized non A/P employees | | | | organizations do not have the staff to verify |
| to enter invoice and account code data, and | | | | every new vendor. The accompanying table |
| access the Vendor Master to identify the vendor | | | | contains a New Vendor Checklist for your staff |
| number, etc. The data was edited for | | | | to use when selecting new vendors to verify. |
| completeness and for valid account coding before | | | | When verifying a new vendor, one of the first |
| it reached the A/P application and A/P processor. | | | | places to check is the yellow pages. Now, not |
| When the invoice and the approved input | | | | every legitimate vendor advertises there. In fact, |
| document were received in A/P the A/P | | | | depending on your business, you will find that |
| processor would perform their normal processing | | | | many don't. If your potential new vendor is not in |
| and approval routines. What caught my attention | | | | the yellow pages, try some other database such |
| was process now allowed employees who now | | | | as D&B, Hoovers, Google, Yahoo, etc. |
| performed the front end invoice processing to | | | | During your cross checking, keep a record of |
| establish a new vendor in the Vendor master. | | | | where you found the verification information. Each |
| Although the new vendor entry into the Vendor | | | | company will need to select the criteria that they |
| Master had to be approved by an independent | | | | want to check, the items that they think will |
| party, I felt new process opened up the A/P | | | | protect them the best. |
| tasks to potential employee mischief and | | | | One Last Technique |
| fraudsters. Although A/P increased its vigilance | | | | Even if you don't actually verify vendors in |
| over the new process, some additional actions | | | | accounts payable, you can tell people that you do. |
| using the Internet to guard against potential fraud | | | | Put a little blurb on your material saying that "New |
| involving the Vendor Master needed to be taken | | | | vendors set up outside AP will be verified by AP." |
| were some of the actions I normally recommend | | | | This warning will help scare off petty theft. Those |
| to my clients. | | | | crooks will have to be a little more creative if |
| I feel that use of the Internet is cost effective | | | | they want to defraud your organization. |
| and is an opportunity to monitor the Vendor | | | | Similarly, you can create a long list of items |
| Master updating process....keeping in mind that the | | | | verified-even if you don't check everything. This is |
| extent of the controls adopted by any business is | | | | one place where it is perfectly acceptable for |
| often limited by cost considerations. Realizing that | | | | accounts payable to less than 100% honest. With |
| it is not feasible from a cost standpoint to | | | | limited staff, a little creative license is sometimes |
| establish controls that provide 100% protection | | | | called for. |
| against fraud, adopting a vendor verification | | | | What this process does is to help protect against |
| process that will add reasonable assurances | | | | collusion within the process since ideally the person |
| against fraud is probably the best that can be | | | | checking in AP is not the person who sets up the |
| achieved. | | | | master vendor list. If your organization does not |
| Confirming New Vendors | | | | do this, your organization is exposed as vendor |
| When I managed an A/P department, we verified | | | | theft is among the easiest of frauds to commit. |