Detecting Procurement Fraud

Why Detecting Procurement Fraud Matters

Procurement is one of the largest areas of spending for almost every organization, and it is also one of the most vulnerable to fraud. Whenever an entity buys goods or services, there are multiple opportunities for dishonest employees, contractors, and vendors to manipulate the process for personal gain. Because procurement fraud is often hidden inside legitimate-looking transactions, it can persist for years and drain enormous sums before anyone notices. For a Certified Fraud Examiner (CFE), the ability to recognize the warning signs of procurement fraud, understand how each scheme operates, and apply appropriate detection techniques is a core competency tested in the Financial Transactions and Fraud Schemes section of the CFE Exam.

Detection is especially important because many procurement schemes involve collusion, either among competing contractors or between a contractor and an insider. Collusion defeats normal internal controls such as segregation of duties, which is why a fraud examiner must rely on red flags, analytical procedures, and knowledge of the procurement lifecycle rather than on standard control reviews alone.

What Is Procurement Fraud?

Procurement fraud refers to any dishonest scheme designed to manipulate the acquisition of goods or services to the benefit of a contractor, vendor, employee, or other party, and to the detriment of the purchasing organization. The ACFE organizes procurement fraud according to the phases of the procurement process, because different schemes occur at different stages. Understanding these phases is essential for both detection and for answering exam questions.

The Four Phases of the Procurement Process

1. Presolicitation Phase – The organization identifies a need, develops specifications, and determines the method of procurement (competitive bidding, sole source, etc.).
2. Solicitation Phase – The organization issues a request for bids or proposals, and contractors prepare and submit their offers.
3. Bid Evaluation and Award Phase – The organization evaluates the bids, selects a winner, and awards the contract.
4. Post-Award and Administration Phase (also called the Performance Phase) – The contractor performs the work, submits invoices, and the organization monitors performance and makes payments.

Major Categories of Procurement Fraud Schemes

1. Collusion Among Contractors (Bid Rigging Among Competitors)
These schemes occur when competing contractors secretly agree to eliminate genuine competition. Common forms include:
• Complementary bidding (also called protective, shadow, or cover bidding) – Competitors submit intentionally high or deficient bids so that a predetermined contractor wins.
• Bid rotation – Competitors take turns being the low bidder on a series of contracts.
• Bid suppression – Competitors agree not to bid, or to withdraw bids, so the designated winner faces no competition.
• Market division – Competitors divide customers or geographic regions and agree not to compete in each other's territory.

2. Collusion Between Contractors and Employees
These schemes involve an insider who abuses his or her position to favor a particular contractor, usually in exchange for a bribe or kickback. They are organized by phase:

Presolicitation phase schemes:
• Need recognition schemes – An employee convinces the organization that it needs goods or services that are unnecessary, excessive, or of a type that only a favored vendor can supply.
• Bid tailoring (specifications schemes) – Specifications are written so narrowly that only one contractor qualifies, or so vaguely that the favored contractor can later submit costly change orders. This includes unjustified sole-source or noncompetitive awards and the improper splitting of purchases to avoid competitive bidding thresholds.

Solicitation phase schemes:
• Bid manipulation – The employee restricts the pool of bidders by shortening the bid window, failing to publicize the solicitation, or accepting late bids from the favored vendor.
• Leaking of bid data – The employee provides confidential information such as competitor pricing or internal cost estimates to the favored contractor.
• Bid splitting – A large contract is broken into smaller pieces to keep each under the threshold that would require competitive bidding.

Evaluation and award phase schemes:
• Bid manipulation during evaluation – Bids are improperly disqualified, scoring is falsified, or the favored bidder is allowed to revise its bid after submission.

3. Performance (Post-Award) Phase Schemes
These schemes occur after the contract is awarded and involve the contractor failing to deliver what was promised or charging improperly:
• Nonconforming goods or services (product substitution) – Delivering inferior, counterfeit, used, or untested products while billing for the specified quality.
• Change order abuse – Submitting an unrealistically low bid to win the contract, then inflating profits through numerous or excessive change orders, often with the help of a colluding employee.
• Cost mischarging – Charging the organization for costs that are unallowable, unreasonable, or not related to the contract. Subtypes include accounting mischarging (shifting costs to the wrong account or contract), material mischarging (billing for materials not used or substituting cheaper materials), and labor mischarging (billing for hours not worked, inflating labor rates, or charging unqualified staff at senior rates).
• Defective pricing – Submitting inaccurate, incomplete, or outdated cost or pricing data during negotiations to obtain a higher contract price.
• Duplicate or false invoicing – Billing more than once for the same work or billing for work never performed.

How Detection Works: Red Flags by Phase

Because procurement fraud is often concealed by collusion, detection depends heavily on recognizing red flags. The CFE Exam frequently tests whether you can match a red flag to the phase or scheme it indicates.

Red Flags of Collusion Among Contractors:
• Bids that are consistently a fixed percentage apart
• The same contractor repeatedly wins while others rotate as low bidders in a predictable pattern
• Losing bidders become subcontractors to the winner
• Qualified contractors fail to bid or withdraw without explanation
• Bid prices drop sharply when a new or outside competitor enters
• Different bidders make identical errors, use the same handwriting, letterhead, or metadata
• Bids from different companies arrive from the same fax number, email domain, or postmark

Red Flags of Need Recognition and Specification Schemes:
• Unusually high inventory or excess purchases of a particular item
• Needs identified that only a specific vendor can satisfy
• Specifications that are overly narrow, name a specific brand, or are copied from a vendor's own literature
• Specifications that are vague or incomplete, inviting later change orders
• Unjustified sole-source or emergency procurements
• Repeated purchases just below the competitive bidding threshold

Red Flags of Bid Manipulation and Leaked Data:
• Unusually short bid windows or solicitations that are poorly advertised
• Acceptance of late bids or bids with irregularities from one vendor
• The winning bid is just slightly below the next lowest bid or the internal estimate
• Unexplained changes to bid evaluation criteria after bids are received
• The same employee is always involved in the procurement when a particular vendor wins
• Communication between the employee and vendor outside normal channels

Red Flags of Performance Phase Fraud:
• High frequency or large dollar value of change orders shortly after award
• Low initial bid followed by cost overruns
• Missing or altered test certificates, inspection reports, or materials certifications
• Discrepancies between invoiced and delivered quantities or quality
• Labor charges exceeding hours physically possible for the staff assigned
• Invoices lacking detail, sequential invoice numbers from one vendor, or round-dollar amounts
• Complaints from end users about quality or performance

Red Flags Related to the Employee:
• Employee lifestyle beyond apparent means
• Close personal relationship or shared address with a vendor
• Employee insists on handling a particular vendor personally or resists rotation
• Vendor information matches employee information (address, phone, bank account, tax ID)

Detection Techniques and Methods

1. Data Analysis
Fraud examiners use data analytics to identify patterns that would be invisible in manual review. Useful tests include:
• Comparing employee master file data (addresses, phone numbers, bank accounts) to the vendor master file
• Identifying vendors with post office box addresses, missing tax identification numbers, or incomplete records
• Searching for duplicate invoices, duplicate invoice numbers, or identical amounts from one vendor
• Identifying purchases clustered just below approval or bidding thresholds (split purchases)
• Analyzing bid results to detect rotation patterns, consistent percentage spreads, or identical bid amounts
• Benford's Law analysis to detect fabricated invoice amounts
• Tracking change order frequency and value by contract and by approving employee
• Reviewing payments issued shortly before or after contract award to detect kickbacks

2. Document Examination
• Compare bid documents for identical formatting, typos, metadata, or handwriting
• Review sole-source justifications for adequacy and supporting evidence
• Examine specifications against vendor product literature
• Compare invoices to receiving reports, delivery tickets, and contract terms
• Verify test and inspection certificates with the issuing laboratory or manufacturer

3. Interviews and Tips
Tips remain the most common way fraud is detected. Hotlines accessible to employees, vendors, and losing bidders are particularly valuable in procurement because losing competitors often suspect rigging. Interviews with end users, receiving personnel, and procurement staff can reveal performance problems or unusual vendor relationships.

4. Physical Verification
• Site visits to confirm the vendor exists and has the capacity to perform
• Physical inspection or independent testing of delivered goods
• Observing work in progress to verify labor charges

5. Review of Procurement Controls
• Confirm that bid openings are public and witnessed
• Verify rotation of procurement duties and mandatory vacations
• Check that specifications and vendor selection are reviewed by independent parties
• Confirm that change orders require independent approval above a threshold

How to Answer Exam Questions on Detecting Procurement Fraud

CFE Exam questions in this area generally fall into a few predictable patterns:

Pattern 1: Identify the scheme from a scenario. You will be given a fact pattern and asked which scheme is described. Focus on who is involved (contractors only, or contractor plus employee) and when it happens (which phase). For example, if competitors take turns winning, it is bid rotation. If an employee writes specs only one vendor can meet, it is bid tailoring. If a contractor delivers inferior parts but bills for the specified grade, it is product substitution or nonconforming goods.

Pattern 2: Identify the red flag. You may be asked which indicator suggests a specific scheme. Remember that a low bid followed by many change orders points to change order abuse, a winning bid barely under the internal estimate points to leaked bid data, and losing bidders becoming subcontractors points to collusion among contractors.

Pattern 3: Choose the best detection method. When asked how to detect a scheme, match the method to the evidence. Matching employee and vendor records detects employee-vendor conflicts; analyzing bid price patterns detects bid rigging; comparing invoices to receiving reports detects billing for undelivered goods.

Pattern 4: Phase identification. You may simply be asked in which phase a particular scheme occurs. Memorize the phase-to-scheme mapping: need recognition and bid tailoring belong to presolicitation; bid manipulation, leaking data, and bid splitting belong to solicitation; improper evaluation belongs to the evaluation and award phase; and product substitution, change order abuse, cost mischarging, and defective pricing belong to the performance phase.

Exam Tips: Answering Questions on Detecting Procurement Fraud

• Learn the vocabulary precisely. The exam uses ACFE terminology. Know the difference between complementary bidding, bid rotation, bid suppression, and market division, and be able to recognize their alternate names (for example, complementary bidding is also called cover, protective, or shadow bidding).

• Think in phases. When you read a scenario, first ask which phase of the procurement process it is in. This immediately narrows the possible answers.

• Distinguish collusion among contractors from collusion with employees. If only vendors are involved and no insider is mentioned, the answer is a bid rigging among competitors scheme. If an insider manipulates needs, specs, or evaluations, the answer is a contractor-employee collusion scheme.

• Remember that bid splitting and sole-source abuse are about avoiding competition. Any scenario involving purchases kept just below a threshold or unjustified emergency or sole-source awards indicates an attempt to bypass competitive bidding.

• Connect low bids with later profit recovery. A contractor who bids unrealistically low and then profits through change orders or substitution is a classic exam scenario. The low bid is the setup, not the fraud itself.

• Know the three types of cost mischarging. Accounting mischarging (wrong account or contract), material mischarging (materials not used or substituted), and labor mischarging (hours or rates inflated). Questions often test the labor type because it is the most common.

• Tips are the number one detection method. If a question asks about the most common or most effective general way procurement fraud is uncovered, remember that tips and complaints, often from losing bidders or employees, lead the list.

• Data analysis questions usually have a logical best answer. Ask yourself what two data sets, when compared, would expose the fraud. Employee file versus vendor file exposes conflicts of interest; invoices versus receiving reports expose phantom deliveries; bid histories expose rotation.

• Watch for absolute words. Answers using words like always or never are usually incorrect. Red flags indicate possible fraud; they do not prove it.

• Read every answer choice. Several options may describe real schemes, but only one matches the specific facts given. Eliminate options that involve the wrong phase or the wrong parties.

• Do not confuse defective pricing with product substitution. Defective pricing involves inaccurate cost or pricing data submitted during negotiation; product substitution involves delivering something other than what was specified.

Summary

Detecting procurement fraud requires understanding the four phases of procurement, the schemes that occur in each phase, the red flags associated with those schemes, and the detection methods that expose them. On the CFE Exam, success comes from careful reading of scenarios, correctly identifying the parties and the phase, applying precise ACFE terminology, and selecting the detection technique that logically targets the evidence the scheme would leave behind. Master the phase-to-scheme mapping and the red flag lists, and you will be well prepared for any question in this area.