Asset Misappropriation, Corruption and Procurement Fraud

Introduction and Context

Asset misappropriation, corruption and procurement fraud are among the most common forms of occupational and organizational fraud. They involve the unauthorized taking, use or diversion of an organization’s resources; the abuse of entrusted authority for private benefit; or the manipulation of purchasing processes to favor particular individuals or suppliers. Although these schemes may begin with a relatively small act, weak controls, concealment and rationalization can allow them to become systematic and financially significant.

Forensic accountants examine these matters differently from ordinary financial auditors. An audit seeks reasonable assurance that financial statements are free from material misstatement. A forensic examination is usually directed toward a specific allegation, suspected scheme, loss calculation, recovery action, disciplinary process or legal proceeding. The forensic accountant must therefore connect transactions to people, authority, opportunity, benefit and concealment while preserving evidence that may withstand scrutiny.

The central question is not merely whether an unusual transaction occurred. It is whether the transaction was authorized, commercially justified, accurately recorded, fairly awarded and beneficial to the organization. Effective examination combines accounting analysis, internal-control evaluation, interviewing, document review, data analytics and, where appropriate, digital-forensic techniques.

Learning Objectives

By the end of this chapter, students should be able to:

1. Distinguish asset misappropriation, corruption and procurement fraud.
2. Explain common cash, billing, payroll, expense and inventory schemes.
3. Identify bribery, conflicts of interest, bid manipulation and third-party risks.
4. Design an evidence-based examination plan.
5. Apply accounting, control and data-analytic techniques to suspicious transactions.
6. Assess loss, responsibility, concealment and control failure without prejudging individuals.
7. Recommend preventive, detective and corrective measures.

1. The Fraud Examination Framework

A useful starting point is the fraud triangle: pressure or incentive, opportunity and rationalization. A person may experience financial pressure, perceive weak controls, and justify the conduct as a temporary loan, deserved compensation or harmless adjustment. More recent analysis also emphasizes capability: the knowledge, authority, confidence and technical ability required to execute and conceal a scheme. These models explain risk; they do not prove that fraud occurred.

A practical examination framework contains five questions:

• Motive or benefit: Who could gain, and what benefit was obtained?
• Opportunity: Which control, approval, system access or relationship made the conduct possible?
• Method: How was the transaction initiated, processed, recorded and concealed?
• Evidence: What documents, data, communications and testimony support or contradict the allegation?
• Loss and response: What was the organization’s financial or operational loss, and what action is justified?

The examiner should maintain a distinction between an allegation, an indicator, a fact, an inference and a conclusion. A duplicate invoice is an indicator. Evidence that two invoices relate to the same goods, were submitted by a controlled supplier and were paid twice may support a conclusion of duplicate payment. Professional reports should state the degree of support for each conclusion and identify unresolved uncertainty.

2. Asset Misappropriation

Asset misappropriation is the theft or misuse of an organization’s assets. It may involve cash, inventory, equipment, information, refunds, receivables or unauthorized personal use of organizational resources. The scheme normally has three stages:

1. Taking or diversion: the asset leaves the organization or is used without authorization.
2. Conversion or benefit: the perpetrator or an associate obtains value.
3. Concealment: records, reconciliations, approvals or physical evidence are manipulated to reduce detection risk.

2.1 Cash Theft and Cash Larceny

Cash schemes include theft before recording, theft after recording, skimming, fraudulent refunds, forged payments, unauthorized transfers and manipulation of cash counts. Skimming occurs when receipts are taken before they enter the accounting records. Because no transaction is recorded, conventional ledger analysis may not reveal the missing amount.

Important procedures include:

• reconciling point-of-sale records to deposits and bank statements;
• comparing cash collections with inventory movement or service volumes;
• reviewing voids, refunds, discounts and canceled sales by employee;
• testing the sequence and authorization of receipts;
• performing surprise cash counts;
• examining unusual deposits, after-hours activity and manual journal entries;
• comparing customer complaints and operational records with recorded sales.

A bank reconciliation is not evidence that cash theft did not occur. A reconciled ledger can conceal theft when the perpetrator controls both the transaction record and the reconciliation process.

2.2 Billing and Receivables Schemes

Billing fraud may include fictitious sales, inflated quantities, unauthorized discounts, false credit notes, duplicate billing and diversion of customer payments. A common receivables scheme is lapping: a payment from Customer A is stolen, and a later payment from Customer B is posted to Customer A’s account. The process continues until the employee replaces the missing funds or the shortage is discovered.

Examination procedures include tracing customer remittances from receipt through deposit and ledger posting, reviewing aged receivables, analyzing credit notes after period-end, confirming balances independently and testing whether one employee receives cash, posts receipts and resolves customer disputes.

2.3 Payroll Fraud

Payroll schemes include ghost employees, falsified hours, inflated overtime, unauthorized pay-rate changes, duplicate employees and payments to inactive or terminated workers. Red flags include employees sharing bank accounts or addresses, payroll records lacking personnel files, unusual overtime concentrated in one department and payroll changes made outside normal authorization periods.

A useful payroll reconciliation is:

Here, hours are time units and rates are currency per hour; allowances and bonuses are currency amounts. The relationship is applicable when payroll components are separately defined and no additional components, such as commissions or benefits, are omitted. The examiner should reconcile the calculated amount to the payroll register and general ledger, but a numerical match does not establish that the employees or hours were legitimate.

Analytical tests may compare payroll-master data with human-resources records, access-card logs, scheduling systems, tax records and bank-account information. Such comparisons must comply with privacy and employment law.

2.4 Expense Reimbursement Fraud

Expense fraud includes fictitious expenses, personal expenses presented as business costs, altered receipts, duplicate reimbursement, inflated mileage and claims for services not received. High-risk conditions include weak documentation, self-approval, cash advances that are not cleared and supervisors who approve claims without reviewing supporting evidence.

Testing should examine the business purpose, date, location, participants, receipt authenticity, authorization and accounting treatment. Duplicate detection can compare vendor, date, amount, currency, employee and receipt number. Exact matching is insufficient because fraudsters may alter dates, split amounts or submit the same receipt in different formats.

2.5 Inventory and Other Non-cash Assets

Inventory theft may be concealed through false write-offs, unauthorized transfers, quantity manipulation, damaged-goods claims, false returns or collusion with warehouse personnel. High-risk items are portable, valuable, easily resold or difficult to count.

A sound investigation compares perpetual records, purchase records, production records, dispatch documents, returns, shrinkage reports and physical counts. The examiner should distinguish normal shrinkage from unexplained loss and consider timing, custody and measurement error. Serial-number analysis, barcode data and exception reports can connect missing assets to particular locations or users.

3. Corruption and Conflicts of Interest

Corruption is the misuse of entrusted power for private gain. It includes bribery, kickbacks, extortion, facilitation payments where prohibited, favoritism, nepotism and conflicts of interest. A conflict of interest exists when a person’s private interest could improperly influence official duties, even if no improper payment has yet been proven.

3.1 Bribery and Kickbacks

A bribe is a benefit offered, promised, given, requested or accepted to influence a decision or action. A kickback is generally a concealed payment or benefit returned to an employee or intermediary in connection with a contract or transaction. Benefits may be monetary or non-monetary: gifts, travel, employment for relatives, entertainment, donations, discounts or future business.

Investigative indicators include payments just below approval thresholds, vague consulting services, commissions unrelated to market practice, unusual urgency, suppliers recommended by a decision-maker, poor-quality deliverables and personal relationships hidden from the organization. An indicator is not proof. Legitimate commissions and consulting arrangements can also appear unusual, so the examiner must establish services, value, authorization and commercial reasonableness.

3.2 Conflicts of Interest

A conflict may be actual, potential or perceived. The central questions are whether a decision-maker had a private connection to a supplier, whether disclosure was required, whether the person participated in the decision and whether the organization received fair value.

Relevant procedures include reviewing declarations of interest, corporate registries, beneficial-ownership information, social and professional relationships where lawfully available, shared addresses, payment destinations and communications. A conflict does not automatically establish fraud; it becomes more serious when combined with undisclosed influence, unfair pricing, false competition or personal benefit.

3.3 Third-party Intermediaries

Agents, distributors, consultants and subcontractors create risk because they may obscure the ultimate recipient of a benefit. Due diligence should address ownership, reputation, qualifications, government connections, services, compensation, bank accounts, geographic location and contractual compliance obligations.

Payments should be proportionate to documented services and made to accounts in the contracting party’s name, subject to lawful exceptions and enhanced review. The use of an intermediary does not necessarily transfer responsibility away from the organization. Organizations may be accountable for misconduct performed on their behalf, depending on applicable law and the facts.

4. Procurement Fraud

Procurement fraud undermines competition, value for money and public or organizational trust. It can occur before solicitation, during bidding, at award, during contract performance or at payment.

4.1 The Procurement Cycle and Control Points

A typical procurement cycle includes needs identification, specification, supplier solicitation, bid receipt, evaluation, award, contracting, delivery, acceptance, invoice approval and payment. Each stage creates distinct risks.

4.2 Bid Manipulation and Collusion

Bid manipulation may involve tailored specifications, selective invitations, leaked competitor prices, false competition, bid suppression, rotation of winning suppliers, complementary bids and improper disqualification. Collusion may be difficult to establish from one transaction; patterns across tenders are more informative.

Indicators include identical formatting or errors across bids, sequential submission times, unusual geographic patterns, predictable rotation of winners, bids that are consistently just above thresholds and suppliers sharing contact details or ownership. These patterns should be tested against legitimate explanations such as industry structure, transportation costs and specialized capacity.

4.3 Contract and Invoice Fraud

After award, fraud may involve change-order abuse, inflated quantities, substitution of inferior goods, false completion certificates, unauthorized subcontracting and payments for work not performed. A three-way match compares the purchase order, evidence of receipt and supplier invoice. It is a useful control, but it can fail when receiving personnel collude or approve without inspection.

For construction and service contracts, the examiner may compare progress certificates with site records, photographs, timesheets, inspection reports, measurement books and independent technical assessments. Contract amendments should be evaluated for justification, timing, pricing and approval.

5. Investigative Methodology

5.1 Intake, Scope and Preservation

An examination begins with a written allegation assessment. The investigator should record who reported the matter, what conduct is alleged, relevant dates, entities, systems, estimated exposure and immediate risks. Scope should be sufficiently specific to remain manageable but flexible enough to follow evidence.

Evidence preservation may require securing accounting data, email, messaging records, procurement files, access logs, surveillance footage and physical documents. Legal counsel or information-security specialists should be consulted regarding privacy, privilege, cross-border transfer and retention obligations. Investigators must avoid altering original evidence and should document collection, custody, hashing or other integrity procedures where appropriate.

5.2 Document and Data Examination

A practical sequence is:

1. Understand the process and control environment.
2. Identify relevant systems, accounts, vendors and employees.
3. Extract complete populations where feasible rather than relying only on samples.
4. Normalize dates, supplier names, currencies and identifiers.
5. Test duplicates, thresholds, round amounts, weekend activity, unusual timing and split transactions.
6. Link transactions to approvals, delivery evidence, users, bank details and communications.
7. Investigate exceptions using source documents and interviews.
8. Recalculate loss and obtain corroboration.

Analytical tools should generate leads, not automatic findings. Benford-style digit analysis, for example, may be useful in some naturally occurring large data sets but is unreliable for assigned numbers, highly constrained prices, small samples or data shaped by thresholds. It cannot prove fraud.

5.3 Interviews

Interviews should be planned around known facts, missing explanations and contradictions. Begin with open questions, then use specific documents and progressively narrower questions. Preserve neutrality and avoid revealing all evidence prematurely. Interviewees should have an opportunity to explain unusual transactions and provide exculpatory information.

The order of interviews depends on evidence-preservation risk. Routine process owners may be interviewed early; a suspected central actor may be interviewed after key records are secured. Interview notes should distinguish exact statements from the interviewer’s interpretation.

5.4 Loss Quantification

Loss calculation must define the appropriate measure. Possible measures include the amount stolen, overpayment, cost of replacement, profit avoided, recovery received and consequential costs. The calculation should avoid double counting and should separate proven loss from estimated exposure.

For a simple overpayment, the direct loss may be expressed as:

Each term is measured in the same currency and relates to the same transaction or population. The formula is appropriate when the reasonable value received and recoveries can be reliably established. It should not be used without adjustment where the organization received partial value, where market prices are uncertain or where legal damages require a different measure.

6. Illustrative Case: The Northbridge Medical Supplies Scheme

This is a fictional illustrative case designed for educational purposes.

Background

Northbridge Medical Supplies, a regional distributor, used competitive bidding for hospital consumables. The procurement manager, Elena, had authority to recommend suppliers and approve receiving reports. The accounts-payable supervisor could release payments after approval. A new supplier, Medistar Trading, won several contracts despite submitting bids only shortly before deadlines.

Problem

Internal audit noticed that Medistar’s invoices were frequently just below the level requiring executive review. A whistleblower alleged that Elena’s relative controlled Medistar through another company. The organization had no recent conflict-of-interest declarations from procurement staff.

Analysis

The forensic team preserved procurement files, email, vendor-master data, purchase orders, receiving reports and bank-payment records. Data analysis showed:

• Medistar won 8 of 11 tenders in which it participated.
• Three competing bids contained identical typographical errors.
• Medistar’s bank account details had been changed twice by a user account associated with procurement administration.
• Several invoices were split into two payments on the same day.
• Receiving reports were approved before delivery dates recorded by the warehouse.
• Corporate records and shared contact information linked Medistar to Elena’s relative.

These findings were indicators requiring corroboration. Investigators obtained delivery records from the carrier and found that two shipments were short by 15% and one was never delivered. An independent price comparison indicated that comparable goods could have been purchased for 12% less. Elena initially stated that she had no relationship with Medistar but later acknowledged recommending the supplier and receiving hospitality from its director. Bank records, obtained through lawful process, showed payments from an intermediary associated with Medistar to an account controlled by Elena’s relative.

Approach and Solution

The team reconstructed each tender, separated delivered value from undelivered goods, compared prices with reliable market evidence and traced approval and payment authority. It interviewed the warehouse manager, procurement panel members and supplier representatives. The organization suspended further payments, notified appropriate authorities, corrected vendor-master controls and commissioned an independent review of other tenders.

The loss assessment did not treat every Medistar contract as fraudulent. It calculated separately: the value of undelivered goods, the documented overpayment supported by comparable quotations, and amounts recovered through credit notes. Uncertain consequential losses were reported as potential exposure rather than proven loss.

Outcome and Learning Points

Northbridge recovered part of the overpayment, terminated the supplier relationship and introduced mandatory conflict declarations, independent receiving confirmation, automated threshold reporting and dual control over supplier-bank changes. The case demonstrates that procurement fraud is often revealed by the interaction of multiple modest indicators rather than one decisive anomaly. It also shows why relationship evidence, delivery verification, pricing analysis and payment data should be examined together.

7. Governance, Ethics and Professional Judgment

Fraud examinations affect reputations, employment, contracts and sometimes liberty. Investigators must observe due process, confidentiality, independence, competence and proportionality. They should not assume guilt from an unusual transaction, use unlawfully obtained personal data or disclose allegations beyond those with a legitimate need to know.

Organizations should establish clear policies for gifts, conflicts, third parties, procurement exceptions, whistleblower protection, records retention and investigation escalation. Anti-fraud controls are most effective when senior management models ethical conduct and consequences apply consistently to high-status employees and ordinary employees alike.

A report should describe scope, procedures, evidence limitations, findings, alternative explanations, quantified loss and recommendations. It should distinguish factual findings from opinions and legal conclusions. Unless qualified to do so and instructed within the relevant jurisdiction, a forensic accountant should avoid declaring that a person committed a criminal offense.

8. Technology and Contemporary Practice

Enterprise-resource-planning systems, continuous monitoring, supplier databases and machine-learning tools can improve detection. Useful applications include entity resolution, duplicate-invoice detection, payment-network analysis, unusual access monitoring and comparison of procurement outcomes across departments.

However, technology introduces risks. Poor-quality master data produce false positives; algorithms may reproduce historical bias; automated alerts can overwhelm investigators; and personal-data processing may breach law or policy. Artificial intelligence can summarize records or prioritize transactions, but important findings require human validation, explainable criteria, source-document review and secure handling of confidential information. A model’s risk score is an investigative lead, not proof of misconduct.

9. Best-Practice Control Design

A mature anti-fraud program combines preventive, detective and corrective controls:

• separate requisition, approval, receipt, recording and payment duties;
• require competitive procurement and document justified exceptions;
• maintain accurate vendor-master data with independent review;
• verify beneficial ownership and conflicts of interest;
• use purchase orders, receiving evidence and invoice matching;
• rotate responsibilities and conduct surprise counts;
• monitor overrides, split transactions, unusual refunds and bank-detail changes;
• provide confidential reporting channels and protect good-faith reporters;
• investigate allegations promptly and preserve evidence;
• recover losses and update controls after confirmed incidents.

Controls should be risk-based. Excessive controls can delay legitimate operations and encourage workarounds, while weak controls create opportunity. Management should periodically assess whether controls operate in practice, not merely whether policies exist.

Chapter Summary

Asset misappropriation involves unauthorized taking or use of organizational resources and includes cash theft, billing fraud, payroll manipulation, expense abuse and inventory theft. Corruption involves misuse of entrusted power, including bribery, kickbacks and conflicts of interest. Procurement fraud can affect every stage from needs definition through payment and may involve tailored specifications, collusive bidding, false delivery and invoice manipulation.

A forensic examination links people, authority, transactions, benefit and concealment. It uses preserved evidence, complete data where feasible, document analysis, interviews, control evaluation and careful loss quantification. Indicators generate investigative leads but do not prove fraud. Ethical practice requires independence, confidentiality, lawful evidence collection, fair treatment and clear distinction between facts, inferences and legal conclusions. Strong governance combines segregation of duties, supplier due diligence, conflict disclosure, receiving verification, analytics, reporting channels and continuous improvement.

Key Terms

Asset misappropriation: Unauthorized taking, use or diversion of organizational assets.

Bribery: Offering, giving, requesting or accepting a benefit to influence conduct or a decision.

Bid rotation: A collusive arrangement in which suppliers take turns winning contracts.

Conflict of interest: A private interest that could improperly influence official duties.

Corruption: Abuse of entrusted power for private benefit.

Direct loss: The value lost by the organization after considering relevant value received and recoveries.

Ghost employee: A fictitious or inactive person maintained in payroll records for improper payment.

Kickback: A concealed benefit returned in connection with a transaction or contract.

Lapping: Concealing a stolen customer payment by applying later receipts to earlier accounts.

Occupational fraud: Fraud committed by individuals against the organization employing or entrusting them.

Procurement fraud: Deception or abuse connected with acquiring goods, services or works.

Skimming: Theft of receipts before they are recorded in accounting records.

Three-way match: Comparison of a purchase order, evidence of receipt and supplier invoice.

Vendor-master data: Core records identifying suppliers, ownership, addresses and payment details.

Whistleblower: A person who reports suspected wrongdoing through an internal or external channel.

Forensic examination: A systematic investigation designed to establish facts and support decisions or proceedings.

Review Questions

Short Answer Questions

1. What are the three stages commonly involved in asset misappropriation?
2. How does skimming differ from theft of recorded cash?
3. Why does a conflict of interest not automatically prove fraud?
4. What documents are compared in a three-way match?
5. Why should an analytics alert not be treated as proof of misconduct?

Long Answer Questions

1. Explain the fraud triangle and capability perspective, and discuss how they assist a forensic accountant without proving an allegation.
2. Describe a complete examination approach for suspected payroll fraud, including data sources, interviews and control evaluation.
3. Analyze the principal forms of procurement fraud across the procurement cycle.
4. Explain how bribery and third-party risk can be investigated while respecting privacy, due process and confidentiality.
5. Discuss the distinction between proven loss, estimated exposure and consequential loss in forensic reporting.

Analytical / Application Questions

1. A purchasing officer repeatedly approves invoices just below the executive approval threshold. What evidence would you obtain, what alternative explanations would you consider and how would you quantify any loss?
2. A payroll analysis identifies five employees sharing one bank account. Design a sequence of corroborative tests before reaching a conclusion.
3. Three suppliers submit bids containing identical errors, while one supplier wins most tenders. Develop an investigation plan that distinguishes collusion from legitimate explanations.

Multiple Choice Questions with Answers

Question 1

Which condition most directly describes skimming?

A. Theft of cash after it has been recorded and reconciled

B. Theft of receipts before they enter the accounting records

C. Payment to a fictitious employee through payroll

D. Inflation of an approved supplier invoice

Correct Answer: B. Theft of receipts before they enter the accounting records

Question 2

Which combination is most appropriate for examining a suspected ghost employee?

A. Only a review of the general ledger

B. Comparison of payroll, personnel files, attendance records and payment details

C. Only interviews with external suppliers

D. Comparison of inventory counts with sales invoices

Correct Answer: B. Comparison of payroll, personnel files, attendance records and payment details

Question 3

What is the principal purpose of a three-way match?

A. To compare employee performance with budgets

B. To compare a purchase order, evidence of receipt and supplier invoice

C. To identify conflicts between directors

D. To calculate depreciation expense

Correct Answer: B. To compare a purchase order, evidence of receipt and supplier invoice

Question 4

Which fact is an indicator of a possible undisclosed conflict of interest?

A. A supplier submits a complete bid before the deadline

B. A procurement decision-maker has an undisclosed family connection to the winning supplier

C. A receiving report is independently verified

D. A contract is reviewed by legal counsel

Correct Answer: B. A procurement decision-maker has an undisclosed family connection to the winning supplier

Question 5

Why is a duplicate-invoice test based only on exact invoice numbers inadequate?

A. Fraudulent invoices may use altered numbers, dates or formats

B. Invoice numbers are never recorded in accounting systems

C. Exact matching always produces too many false negatives in legitimate data

D. Invoice numbers cannot be compared with supplier records

Correct Answer: A. Fraudulent invoices may use altered numbers, dates or formats

Question 6

In the simple loss relationship Direct loss = Amount paid − Reasonable value received − Recoveries, all terms must be expressed in:

A. Different currencies to improve comparability

B. The same currency and measurement basis

C. Units of employee time

D. Supplier invoice numbers

Correct Answer: B. The same currency and measurement basis

Question 7

Which pattern may indicate bid rotation?

A. One supplier wins every tender because it is the only legal provider

B. Different suppliers predictably take turns winning comparable tenders

C. All bids are evaluated by an independent panel

D. A tender is cancelled before bids are opened

Correct Answer: B. Different suppliers predictably take turns winning comparable tenders

Question 8

What is the most appropriate interpretation of a fraud analytics alert?

A. It conclusively proves criminal conduct

B. It is an investigative lead requiring corroboration

C. It replaces the need for source documents

D. It establishes the precise amount of legal damages

Correct Answer: B. It is an investigative lead requiring corroboration

Question 9

Which control most directly reduces the risk of unauthorized supplier-bank changes?

A. Allowing one procurement employee to create and approve changes

B. Independent verification and dual authorization of changes

C. Removing all supplier records after payment

D. Permitting suppliers to edit bank details without review

Correct Answer: B. Independent verification and dual authorization of changes

Question 10

Why should a forensic report distinguish facts from legal conclusions?

A. Because forensic accountants should avoid unsupported legal determinations outside their authority

B. Because facts are irrelevant in legal proceedings

C. Because legal conclusions never affect organizational decisions

D. Because investigators are prohibited from documenting evidence

Correct Answer: A. Because forensic accountants should avoid unsupported legal determinations outside their authority