dillon62james

When Sarbanes-Oxley was passed in 2002, many companies were forced to take an in-depth look at internal Accounts Payable controls. Implementing internal controls takes time, but may prove to be a very cost-effective measure if any fraud or leakages are found. Here are a few approaches you can try to tighten up your A/P audit. They require some degree of data mining and programming capability but are fairly straightforward to implement.

1) Duplicate Payments

Duplicate payments in most cases may not be fraud-related, but continue to be a significant A/P leakage that is both preventable and recoverable. Mark Van Holsbeck, Director of Enterprise Network Security for Avery-Dennison, estimates that corporations make duplicate payments at the rate of 2%. Two percent may not sound like much, but if your company’s A/P invoices total $75 million, duplicate payments may account for $1.5 million. Take a look at the statistics:

• Medicare - The Dept. of Health & Human Services’ Inspector General estimated that Medicare made $89 million of duplicate payments in 1998.
• Cingular - We have once again discovered that payments made online as an Electronic funds payment for TDMA accounts, have been deducted twice from the customer's checking account.
• Medicaid - We identified at least $9.7 million in such duplicate payments during our two-year audit period, and estimated that as much as $31.1 million in additional duplicate payments may have been made.”

In a rush to find the overpayments, many companies have emerged: A/P Recap, Automated Auditors, AP Recovery, ACL, CostRecoverySolutions, and more. That these companies are thriving is a testament to the fact that duplicate payments still occur at an alarming rate.

Many software packages have some controls over duplicate invoices but it usually takes some in-depth querying to find them all. For example, many accounting packages do a duplicate invoice check and prevent you from keying in a duplicate invoice number for the same vendor. But just add an “A” to the invoice number or change a penny and you are on your way to a duplicate payment. Another common mistake is found in vendor files; duplicate vendor numbers for the same vendor is the number one cause of duplicate payments.

2) Implement some fuzzy-matching

Implementing “similar” fuzzy-matching instead of exact matching is what makes this approach more accurate and powerful than many.  We define “similar” to mean the following:

Invoice numbers are considered similar if they are exact after stripping out any

Zeros and any alphabetic characters as well as punctuation characters.

Invoice dates are considered similar if the difference between the dates is less than a designated amount such as 7 days.  For example, if you entered "7" days for the date tolerance, then all invoices with a date different of 7 or less would be considered similar.  We generally set the date tolerance to 21 days to catch duplicate payments made 3 weeks apart; this often eliminates catching legitimate rent payments.

3) Rounded-Amount Invoices

People who commit fraud often create invoices with rounded amounts, which are invoices without pennies.  Yes, you would think the fraudster would have “cents” enough to do otherwise.  An easy way to identify rounded-amount invoices is to use the MOD function in Excel.  Suppose your invoice amount is $150.17; then MOD (150.17,1) gives you the remainder of dividing 150.17 by 1, which is .17.  So, using the MOD function with a divisor of 1 on a no-pennies amount would leave us a remainder of 0.  Additionally, try to rank your vendors by those with a high percentage of rounded-amount invoices.  To do this, just calculate each vendor’s number of rounded-amount invoices and divide it by the total number of invoices for that vendor, obtaining the percentage.  Then rank by descending percentage to review the most suspicious vendors first.   

4) Invoices Just Below Approval Amounts

People who commit fraud are not always the “sharpest knife in the drawer.”  Suppose an A/P clerk knows the different dollar thresholds for management approval.  For example, a supervisor may only be allowed to approve invoices of $3,000 or less, while a manager may be allowed to approve invoices of $10,000 or less, and so on.  Suppose this A/P clerk and a manager decides to skim off some extra dollars together.  What is the easiest way to get the most money?  Create an invoice just below the approval level of that manager:  $9,998 when the approval level is $10,000; or $2,978 when the approval level is $3,000.

To identify these potentially fraudulent invoices, try this:  identify invoices that are 3% (or less) LESS THAN the approval amount.  For example, if your approval amount is $3,000, then any invoice that is between $2,910 and $2,999 would be flagged as suspicious. 

5) Check Theft Search

Most Accounts Payable departments conduct a reconciliation of Accounts Payable with the monthly Bank Statement to identify any discrepancies between the two.  This process can also be instrumental in identifying check fraud.  One simple way to spot potential check fraud is to identify missing check numbers or gaps in reconciled checks numbers.  This is usually indicated on the bank statement with a ‘*” or ‘#’ to indicate the check number is not sequential.

Another more advanced way is to conduct a reverse Positive Pay electronically.  By merging your check register, A/P file, and bank statements together, you have the power to identify stolen checks.  Better yet, if your bank has OCR (Optical Character Recognition) abilities, then you can identify the actual payee on the check.

Speaking in technological terms, you have 3 different data bases describing 1 activity.  Use the 3 data sources to find any discrepancies in the 1 payment.  If your check numbers are unique, try merging all 3 data sources by the check number and compare each of the following fields:

-payee

-check amount

-check date

Using SQL code or another programming language, identify all of the checks that are in one data base and not the other.  In addition, identify all of the checks that are in all 3 data sources but have different payee names or different amounts and dates.