Third-Party Fraud Risk

1. Why Third-Party Fraud Risk Matters

Modern organizations rarely operate alone. They rely on vendors, suppliers, contractors, consultants, agents, distributors, outsourced service providers, joint venture partners, and customers. Every one of these relationships extends the organization's operations, data, and reputation beyond the walls it directly controls. The ACFE's Report to the Nations consistently shows that a large share of occupational fraud involves collusion with outside parties, and that frauds involving third parties tend to have higher median losses than frauds committed by a single insider. Corruption schemes in particular (bribery, kickbacks, bid rigging, conflicts of interest) almost always require an external participant.

Regulators also treat third parties as an extension of the organization. Under the U.S. Foreign Corrupt Practices Act (FCPA) and the UK Bribery Act, a company can be held liable for bribes paid by its agents or intermediaries on its behalf. Data protection laws hold organizations responsible for breaches caused by their vendors. For a Certified Fraud Examiner, understanding third-party fraud risk is therefore essential to building a complete fraud risk management program, and it is a recurring theme on the CFE Exam in the Fraud Prevention and Deterrence section, which covers fraud risk management.

2. What Is Third-Party Fraud Risk?

Third-party fraud risk is the risk that an organization will suffer loss (financial, operational, legal, or reputational) because of fraud committed by, through, or in collusion with an external party with which it has a business relationship. It differs from pure external fraud (such as a stranger hacking a system) because a third party has an established, trusted relationship and often legitimate access to the organization's funds, data, systems, or decision-makers.

Key categories of third parties include:
• Vendors and suppliers – goods and services providers paid through accounts payable.
• Contractors and subcontractors – particularly in construction, government contracting, and IT.
• Agents, intermediaries, and consultants – sales agents, customs brokers, lobbyists, and distributors who interact with government officials or customers on the organization's behalf.
• Outsourced service providers – payroll processors, cloud providers, call centers, and other firms with access to systems or data.
• Customers and clients – credit fraud, return fraud, chargeback abuse, and false claims.
• Business partners – joint ventures, franchisees, and licensees.

Common third-party fraud schemes tested on the exam include:
• Billing schemes – shell companies set up by employees, overbilling, duplicate invoices, invoices for goods never delivered, and pass-through schemes.
• Corruption – kickbacks to purchasing staff, bribes paid to foreign officials through agents, bid rigging, and undisclosed conflicts of interest where an employee has a hidden interest in a vendor.
• Product substitution and short shipment – delivering inferior or counterfeit goods while billing for specified quality or quantity.
• Contract and procurement fraud – collusive bidding, bid rotation, defective pricing, cost mischarging, and change-order abuse.
• Vendor master file manipulation – changing a legitimate vendor's bank details to redirect payments (often linked to business email compromise).
• Data and cyber fraud – a vendor's weak security used as the entry point for a breach of the organization's data.
• Customer fraud – fraudulent credit applications, friendly fraud chargebacks, and insurance or warranty claim fraud.

3. How Third-Party Fraud Risk Management Works

The COSO / ACFE Fraud Risk Management Guide sets out five principles: fraud risk governance, fraud risk assessment, fraud control activities, fraud investigation and corrective action, and fraud risk management monitoring. Third-party risk must be integrated into each principle rather than handled as a separate silo. In practice, organizations manage third-party fraud risk through a third-party risk management lifecycle:

Step 1 – Planning and Risk Assessment. Identify which third parties the organization deals with and classify them by inherent risk. Factors that elevate risk include: interaction with government officials, operations in high-corruption jurisdictions (see Transparency International's Corruption Perceptions Index), large or unusual compensation structures (success fees, commissions), access to sensitive data or systems, sole-source or non-competitive selection, and being recommended by a government official or a single employee. Risk-tiering allows resources to be focused where the exposure is greatest.

Step 2 – Due Diligence (Know Your Vendor / Know Your Third Party). Before engagement, verify that the third party is real, legitimate, qualified, and free of disqualifying issues. Typical procedures include: confirming legal existence and registration, verifying tax identification numbers and physical addresses, identifying beneficial owners, screening against sanctions, politically exposed person (PEP), and debarment lists, reviewing litigation and adverse media, obtaining references, assessing financial stability, and evaluating the third party's own compliance program and internal controls. Enhanced due diligence is applied to high-risk tiers. The level of due diligence should be risk-based, a phrase that frequently appears in correct exam answers.

Step 3 – Contracting. Contracts should include anti-fraud and anti-corruption representations and warranties, a requirement to comply with the organization's code of conduct or supplier code, right-to-audit clauses, record-keeping requirements, termination rights for violations, requirements to report suspected fraud, and limits on subcontracting without approval. Compensation terms should be reasonable and clearly tied to legitimate services.

Step 4 – Onboarding and Controls Over Setup. Vendor master file controls are a classic exam topic. New vendors should be approved by someone independent of purchasing and accounts payable; vendor setup and vendor payment duties should be segregated; changes to bank account details should be independently verified by calling a known contact (not the number on the change request); and the system should flag vendors sharing addresses, phone numbers, or bank accounts with employees.

Step 5 – Ongoing Monitoring. Risk does not end at onboarding. Monitoring includes periodic re-screening, performance reviews, invoice and payment analytics, exercising audit rights, requiring annual compliance certifications, and training third-party personnel on anti-corruption expectations. Data analytics tests include: duplicate payments, sequential invoice numbers from one vendor, invoices just below approval thresholds, round-dollar invoices, vendors with P.O. Box addresses only, vendors added and paid shortly afterward, and Benford's Law analysis of invoice amounts.

Step 6 – Termination and Offboarding. Revoke system access, recover assets and data, settle final payments only after verification, and document reasons for termination so that a terminated fraudulent vendor cannot simply re-enter under a new name.

Supporting program elements include extending the ethics hotline to vendors and customers, publishing a supplier code of conduct, communicating a strong tone at the top to third parties, conducting conflict-of-interest disclosures for employees in purchasing roles, and rotating buyers so that cozy relationships do not develop.

4. Red Flags of Third-Party Fraud

Examiners should be able to recognize warning signs such as:
• Vendor address matches an employee's home address or a mail drop.
• Vendor has no website, no physical presence, or was recently incorporated.
• A single employee insists on using a particular vendor or resists rotation.
• Invoices lack detail, are consecutively numbered, or arrive in round amounts.
• Unusually high commissions, success fees, or requests for payment to a third country or to an unrelated account.
• Agent is related to or recommended by a government official.
• Requests to backdate documents, split invoices, or describe payments vaguely as consulting fees.
• Frequent change orders, cost overruns, or lowest bidder repeatedly winning then increasing price.
• Reluctance to accept audit clauses or anti-corruption representations.
• Employee lifestyle inconsistent with income combined with close vendor ties.

5. Exam Tips: Answering Questions on Third-Party Fraud Risk

Tip 1 – Think risk-based, not one-size-fits-all. When a question asks how much due diligence or monitoring is appropriate, the best answer almost always ties the depth of procedures to the level of risk the third party presents. Answers suggesting identical procedures for every vendor, or no procedures for low-value vendors, are usually distractors.

Tip 2 – Know that the organization remains responsible. Outsourcing a function does not outsource the fraud risk or the legal liability. If a question asks whether a company can be liable for a bribe paid by its agent, the answer is yes, particularly under the FCPA and UK Bribery Act. Willful blindness is not a defense.

Tip 3 – Connect third parties to the corruption and billing scheme categories. The exam often frames third-party risk through the ACFE Fraud Tree. Kickbacks, bid rigging, conflicts of interest, and shell company billing schemes all involve third parties. Recognize the scheme being described so you can identify the matching control.

Tip 4 – Master vendor master file controls. Expect questions about who should approve new vendors (someone independent of purchasing and payables), how to verify bank detail changes (independent call-back using known contact information), and which analytics detect fictitious vendors (address matching against employee records, missing TINs, sequential invoices).

Tip 5 – Remember the right-to-audit clause. If a question asks which contract provision best supports detection of vendor fraud or overbilling, the right-to-audit clause is a very common correct answer. Also remember that audit rights are only useful if they are actually exercised.

Tip 6 – Prevention versus detection. Classify controls correctly. Due diligence, segregation of duties, approved vendor lists, and codes of conduct are preventive. Data analytics, audits, hotlines, and performance reviews are detective. Questions often ask for the best control of a specific type.

Tip 7 – Use the COSO/ACFE five principles as a framework. If a scenario describes a weakness, identify which principle is failing. For example, a company that screens vendors at onboarding but never again has a monitoring gap; a company with no supplier code of conduct has a governance gap.

Tip 8 – Watch for absolute language. Answer choices that say a control guarantees or eliminates fraud are generally wrong. Fraud risk management reduces risk to an acceptable level; it does not remove it.

Tip 9 – Read for the red flag. Scenario questions often bury a single red flag such as an agent requesting payment to an offshore account or a vendor sharing a phone number with an employee. Identify the red flag first, then select the answer that addresses it directly.

Tip 10 – Choose the most complete and proactive answer. When several options seem reasonable, the CFE Exam favors the response that is comprehensive, documented, independent, and performed before the risk materializes, rather than reactive steps taken only after a loss.

6. Quick Review Summary

• Third-party fraud risk arises from vendors, suppliers, contractors, agents, service providers, partners, and customers who hold trusted access.
• The most common schemes are billing schemes, kickbacks and bribery, bid rigging, conflicts of interest, product substitution, and payment redirection.
• Management follows a lifecycle: risk assessment and tiering, risk-based due diligence, protective contract terms, controlled onboarding, ongoing monitoring with analytics and audits, and disciplined offboarding.
• Key controls: independent vendor approval, segregation of duties, call-back verification of bank changes, right-to-audit clauses, supplier codes of conduct, hotlines open to third parties, and continuous data analytics.
• The organization cannot delegate its responsibility or liability for fraud committed by third parties acting on its behalf.

Mastering these concepts will prepare you to answer both direct knowledge questions and scenario-based questions on Third-Party Fraud Risk with confidence on the CFE Exam.