Preventing Procurement Fraud

Why Preventing Procurement Fraud Matters

Procurement is one of the largest cash outflows in nearly every organization, whether public or private. Because purchasing touches vendors, employees, contracts, inventory, and payments all at once, it offers more opportunity for fraud than almost any other business process. The ACFE's Report to the Nations consistently shows that corruption schemes (bribery, kickbacks, conflicts of interest) are among the most common and costly occupational frauds, and the overwhelming majority of corruption occurs in the purchasing and contracting function. Procurement fraud is also unusually damaging because it frequently involves collusion between an insider and an outside vendor, which defeats many ordinary internal controls and makes detection slow and expensive.

For a Certified Fraud Examiner, understanding prevention is not optional. The CFE Exam tests procurement fraud in the Financial Transactions and Fraud Schemes section under Contract and Procurement Fraud, and prevention concepts also surface in the Fraud Prevention and Deterrence section. Beyond the exam, fraud examiners are routinely asked to assess procurement controls, design anti-fraud programs, and advise on contract language. If you cannot explain how to prevent a scheme, you cannot credibly explain how it happened.

What Is Procurement Fraud Prevention?

Procurement fraud prevention is the set of policies, controls, oversight mechanisms, and cultural measures an organization puts in place to reduce the opportunity leg of the Fraud Triangle in the purchasing cycle. It covers every stage from recognizing a need to paying the final invoice. Prevention differs from detection: detection finds fraud after it occurs, while prevention is designed to stop it from happening or to make it so difficult and risky that a would-be fraudster is deterred.

The ACFE frames procurement fraud around the four phases of the procurement process, and every preventive control maps to one or more of these phases:

1. Presolicitation phase - the need is identified, specifications are developed, and the method of procurement is chosen.
2. Solicitation phase - bids or proposals are requested and received.
3. Bid evaluation and award phase - bids are evaluated and the contract is awarded.
4. Post-award and administration phase - the contract is performed, monitored, changed, and paid.

The exam expects you to know which schemes occur in which phase and which controls are most effective at each point.

How It Works: Schemes and the Controls That Prevent Them

Phase 1 - Presolicitation

Typical schemes: need recognition schemes (an employee convinces the organization it needs goods or services it does not need, or needs them in excessive quantity), bid tailoring or specifications schemes (specifications are written so narrowly that only a favored vendor can qualify, or so vaguely that the favored vendor can win on price and later increase costs through change orders), and bid splitting (breaking a large purchase into smaller ones to stay beneath the competitive bidding threshold or approval limit).

Preventive controls:
- Require written, independently reviewed justification of need, tied to budgets and inventory levels.
- Have specifications developed or reviewed by someone independent of the requesting department and independent of vendor contact.
- Prohibit brand-name-only specifications unless formally justified; use performance or functional specifications.
- Set competitive bidding thresholds and monitor for purchases clustered just below them; aggregate related purchases by vendor and time period.
- Require documented justification and senior approval for sole-source and emergency procurements.

Phase 2 - Solicitation

Typical schemes: bid manipulation by employees (restricting the pool of bidders, inadequate advertising, unreasonably short bidding periods, improperly accepting late bids, leaking confidential information such as competitor pricing or the engineer's estimate), and collusion among contractors (bid rigging through complementary bidding, bid rotation, bid suppression, and market division).

Preventive controls:
- Publicly advertise solicitations with adequate response time; maintain and periodically refresh an approved bidder list.
- Use sealed bids with controlled, time-stamped receipt, locked storage, and a public bid opening attended by more than one official.
- Restrict access to the internal cost estimate and bidder information; log who accesses solicitation files.
- Require bidders to sign non-collusion affidavits and certificates of independent price determination.
- Analyze bidding patterns over time (the same winner, identical or rotating prices, unusually high losing bids, losing bidders becoming subcontractors) to identify cartels.

Phase 3 - Bid Evaluation and Award

Typical schemes: falsified or biased evaluations, improper disqualification of qualified bidders, acceptance of nonresponsive bids from a favored vendor, unbalanced bidding, and awarding to a vendor with an undisclosed relationship to the evaluator.

Preventive controls:
- Publish evaluation criteria and weightings before bids are opened; do not change them afterward.
- Use an evaluation committee rather than a single individual; rotate committee membership.
- Require annual and transaction-level conflict of interest disclosures from everyone involved in purchasing and evaluation.
- Document scoring and the rationale for award, and have it reviewed by someone outside the committee.
- Provide a protest or appeal process for unsuccessful bidders.

Phase 4 - Post-Award and Administration

Typical schemes: product substitution or nonconforming goods and services, change order abuse (low initial bid followed by inflated change orders), cost mischarging (labor, material, and accounting mischarging), defective pricing (failure to disclose accurate cost or pricing data), false or duplicate invoices, and progress payment fraud.

Preventive controls:
- Segregation of duties among requisitioning, purchasing, receiving, and accounts payable; no single person should control more than one of these.
- Independent receiving and inspection with random testing of goods against specifications; retain samples and test reports.
- Require independent review and approval of all change orders, and compare cumulative change orders to the original award.
- Perform three-way matching (purchase order, receiving report, invoice) before payment.
- Include right-to-audit clauses in contracts and actually exercise them, especially on cost-reimbursable contracts.
- Use data analytics for duplicate invoices, round-dollar invoices, sequential invoice numbers from one vendor, vendor addresses matching employee addresses, and vendors with P.O. box-only addresses.

Organization-Wide Controls

Beyond phase-specific controls, the ACFE emphasizes foundational measures:

- A written procurement policy defining authority levels, roles, responsibilities, and documentation requirements.
- A code of conduct and ethics training covering gifts, entertainment, and vendor relationships, with a clear gift policy.
- A robust vendor master file process: independent vendor setup, verification of tax ID and address, periodic purging of inactive vendors, and management review of changes.
- Vendor due diligence and background checks before approval, and periodic re-screening.
- Rotation of buyers and mandatory vacations to break up long-term employee-vendor relationships.
- An anonymous reporting hotline available to employees and vendors; tips are the most common way procurement fraud is uncovered.
- Management and audit oversight, including surprise audits of purchasing and contract files.
- Written contract clauses: anti-kickback provisions, ethics certifications, and consequences for violations.

Red Flags That Prevention Programs Should Monitor

- Purchases just under approval or bidding thresholds.
- Repeated sole-source or emergency awards to the same vendor.
- A buyer who insists on handling a particular vendor personally or resists rotation.
- Employees living beyond their means who have vendor-facing roles.
- Specifications that match one vendor's product literature.
- Last-minute bid changes, late bids accepted, or losing bidders subsequently hired as subcontractors.
- Rising change orders shortly after award.
- Vendors with missing documentation, no physical presence, or shared addresses and phone numbers with employees.

Exam Tips: Answering Questions on Preventing Procurement Fraud

1. Identify the phase first. Many questions describe a scenario and ask which phase it belongs to or which control fits. Mentally classify: presolicitation (need and specifications), solicitation (bid request and receipt), evaluation and award, or post-award (performance and payment). The correct control almost always lives in the same phase as the scheme.

2. Identify who is committing the fraud. The ACFE distinguishes schemes by employees (bid tailoring, leaking information, need recognition), by contractors (collusive bidding, product substitution, cost mischarging), and by employees and contractors together (kickbacks, conflicts of interest). Controls like non-collusion affidavits target contractors; conflict of interest disclosures and buyer rotation target employees.

3. Know the collusive bidding vocabulary cold. Complementary (cover) bidding, bid rotation, bid suppression, and market division are frequently tested. Expect definition questions and scenario questions where you must name the scheme.

4. Match the control to the risk precisely. When asked for the best or most effective control, prefer the one that directly removes the opportunity: segregation of duties for payment fraud, independent specification review for bid tailoring, sealed bids and public openings for bid manipulation, independent receiving and inspection for product substitution, and right-to-audit clauses for cost mischarging.

5. Remember the segregation-of-duties quartet. Requisition, purchasing, receiving, and payment should be separated. Any answer choice that combines two of these in one person describes a weakness, not a control.

6. Prevention versus detection. Read whether the question asks how to prevent or how to detect. Hotlines, data analytics, and audits are primarily detective; policies, approvals, segregation, and independent review are primarily preventive. Some controls do both, but choose according to the wording.

7. Watch for absolute and negative wording. Questions containing not, least likely, or except are common. Slow down and eliminate the three choices that are true before selecting the one that is false.

8. Bid splitting is about thresholds. If a scenario describes a single need divided into several purchase orders, the answer involves avoiding competitive bidding or approval limits, and the preventive control is aggregating and monitoring purchases by vendor and period.

9. Sole-source awards are not inherently fraudulent. The exam may test whether you understand that sole-source procurement is legitimate when properly justified and approved; the red flag is the absence of documented justification or repeated unjustified use.

10. Use the Fraud Triangle as a tie-breaker. If two answers both seem reasonable, choose the one that most directly reduces opportunity, because that is the leg of the triangle that internal controls are designed to address.

11. Practice with scenario-based questions. The CFE Exam rarely asks for bare definitions in this area. Rehearse reading a short fact pattern, labeling the phase, the perpetrator, and the scheme, and then selecting the control or red flag. This three-step habit will carry you through nearly every procurement fraud question.

Summary

Preventing procurement fraud means building controls into every phase of the purchasing cycle, enforcing segregation of duties, demanding transparency and competition, scrutinizing vendors and conflicts of interest, and sustaining an ethical culture backed by oversight and a reporting mechanism. On the exam, success comes from classifying each scenario by phase and perpetrator, knowing the scheme terminology precisely, and choosing the control that most directly eliminates the opportunity described.