In the CFE framework, procurement fraud is best understood by examining the structure of the procurement process itself, because each element and phase creates distinct opportunities for fraud and corresponding red flags.

The core elements of a procurement system typically include: (1) the procuring entity (the buyer), (2) the vendors or contractors competing for the award, (3) the solicitation documents (specifications, statements of work, terms), (4) the evaluation and award criteria, and (5) the resulting contract and its administration. Supporting elements include approval authorities, budgets, procurement policies, and internal controls such as segregation of duties.

The ACFE generally divides the procurement process into four phases:

1. Presolicitation Phase: Needs are identified, budgets approved, specifications drafted, and the procurement method (competitive bidding, sole source, etc.) is selected. Fraud risks here include need recognition schemes (inflating or inventing needs), bid tailoring (writing specifications to favor a particular vendor), and unjustified sole-source awards.

2. Solicitation Phase: The entity issues requests for proposals or invitations to bid, and vendors prepare and submit offers. Schemes include bid splitting to avoid thresholds, restricting the pool of bidders, bid rigging and collusion among vendors (bid rotation, bid suppression, complementary bidding), and leaking confidential information.

3. Bid Evaluation and Award Phase: Bids are opened, evaluated against criteria, and a contract is awarded. Risks include manipulation of bid openings, accepting late bids, falsifying evaluation scores, and awarding to unqualified or conflicted vendors, often facilitated by kickbacks or bribery.

4. Post-Award and Administration Phase: Performance is monitored, changes approved, and payments made. Fraud includes product substitution, cost mischarging, false invoicing, excessive change orders, and failure to meet specifications.

Understanding these elements and phases allows fraud examiners to map controls to risks, recognize phase-specific red flags, and design targeted detection and prevention measures.

In the CFE Fraud Examiners Manual, bid manipulation and bid tailoring are procurement fraud schemes that typically occur with collusion between a procuring employee and a contractor, undermining the fairness of competitive bidding.

Bid Tailoring (also called specifications rigging) occurs during the presolicitation phase. A corrupt procurement employee, often in exchange for a bribe or kickback, drafts the bid specifications or statement of work so that only a favored contractor can qualify. Red flags include: specifications that are unusually narrow or restrictive without a legitimate business justification; requirements that match one vendor's product features or brand name exactly; specifications that are overly vague, allowing the favored bidder to submit a low bid and later recover through change orders; splitting a large contract into smaller ones to avoid competitive bidding thresholds; and unjustified sole-source justifications. Legitimate bidders may complain that they cannot meet requirements, or very few bids are received.

Bid Manipulation occurs during the solicitation and evaluation phases. Here the procurement employee manipulates the bidding process itself to steer the award. Common methods include: restricting the pool of bidders by limiting advertising or using an abbreviated bid period; improperly disqualifying qualified bidders on technicalities; accepting late bids from the favored contractor; allowing the favored bidder to revise its bid after the deadline; falsifying bid logs or evaluation scores; leaking competitor bid information so the favored party can submit a slightly lower price (bid rigging via information leakage); and voiding or rebidding the procurement after bids are opened when the preferred vendor does not win, giving it a second chance. Red flags include awards to a bidder that was not the lowest responsive bidder without adequate explanation, repeated awards to the same vendor, unexplained changes in evaluation criteria after bids are received, and employees with close personal or financial ties to the winning contractor.

For a CFE, detection involves analyzing bid files, comparing specifications to market standards, reviewing bid logs and timelines, interviewing losing bidders, and examining the lifestyle and relationships of procurement personnel for signs of corruption.

Collusion in procurement fraud occurs when two or more parties secretly cooperate to subvert the competitive bidding process for mutual gain, at the expense of the purchasing organization. The Certified Fraud Examiner (CFE) body of knowledge divides this into two major categories: collusion among contractors and collusion between contractors and employees of the buying entity.

Collusion among contractors (also called bid rigging or cartel behavior) happens when competitors agree in advance on who will win a contract. Common schemes include complementary bidding, where firms submit deliberately high or defective bids to make the chosen winner's offer appear competitive; bid rotation, where cartel members take turns winning contracts; bid suppression, where competitors agree not to bid or to withdraw bids; and market division, where firms allocate customers or geographic territories so they never truly compete. These schemes inflate prices, reduce quality, and eliminate the benefits of competition. Red flags include identical bid pricing, unusual bid patterns, the same contractors repeatedly winning, losing bidders becoming subcontractors, and bids that are suspiciously close in value or contain identical errors.

Collusion with employees involves an insider in the procurement function assisting a favored vendor, usually in exchange for kickbacks, bribes, gifts, or future employment. Employee-assisted schemes include need recognition fraud, where an employee fabricates or inflates a requirement; bid tailoring, where specifications are written so only one vendor qualifies; leaking confidential bid or budget information; bid manipulation, such as accepting late bids, improperly disqualifying competitors, or allowing a favored bidder to revise its offer; and unjustified sole-source awards. Red flags include unusually close relationships between employees and vendors, employees living beyond their means, frequent emergency purchases, restrictive specifications, and contracts split to avoid approval thresholds.

CFEs detect collusion through bid pattern analysis, vendor and employee background checks, data analytics on pricing trends, and examination of procurement documentation. Strong controls, segregation of duties, rotation of procurement staff, and whistleblower programs are key preventive measures.

Need Recognition Schemes are a category of procurement fraud that occurs at the earliest stage of the procurement cycle—the point at which an organization identifies and defines its need for goods or services. According to the ACFE's Fraud Examiners Manual, these schemes typically involve collusion between a procuring entity's employee (such as a procurement officer or requisitioner) and a contractor or vendor. The employee manipulates the organization into recognizing a 'need' that is unnecessary, inflated, or tailored to benefit a specific supplier, usually in exchange for kickbacks, bribes, or other improper benefits.

Common variations include: (1) creating a false need for goods or services the organization does not actually require; (2) over-ordering or purchasing excessive quantities beyond legitimate requirements; (3) justifying unneeded upgrades or replacements of existing functioning equipment; (4) defining requirements so narrowly that only a favored vendor can satisfy them (a precursor to specification schemes); and (5) splitting a legitimate large purchase into smaller ones to avoid competitive bidding thresholds.

Red flags that a Certified Fraud Examiner should look for include: unusually high requirements for stock or inventory levels; items purchased that are not reflected in operating budgets or strategic plans; frequent purchases of products that are later written off, scrapped, or go unused; a particular employee consistently initiating requisitions for a specific vendor; requests for materials that duplicate existing inventory; and justifications for purchases that are vague, poorly documented, or rely heavily on the vendor's own assessment of need.

To investigate, a CFE should review requisition documentation, compare purchased quantities against actual consumption and inventory records, analyze the relationship between requisitioners and vendors, and examine whether needs assessments were independently verified. Preventive controls include requiring independent justification and approval of needs, segregation of duties between those who identify needs and those who select vendors, periodic inventory audits, and a well-documented procurement planning process aligned with budgets.

Post-award procurement fraud schemes occur after a contract has been awarded, during the performance, billing, and closeout phases. Unlike pre-award schemes (such as bid rigging or collusion), these frauds exploit weaknesses in contract administration, oversight, and payment controls. The ACFE Fraud Examiners Manual groups the major post-award schemes into several categories.

1. Non-conforming goods or services (product substitution): The contractor delivers goods or services that do not meet contract specifications—such as using inferior materials, counterfeit parts, or untested components—while certifying compliance. Red flags include high failure rates, missing test documentation, and discrepancies between samples and delivered items.

2. Change order abuse: Contractors submit a low bid to win the contract, then recover profits through excessive, unjustified, or collusive change orders. A corrupt insider may approve inflated modifications that were never competitively priced.

3. Cost mischarging: On cost-type contracts, the contractor shifts costs improperly. This includes labor mischarging (billing hours to the wrong contract, phantom employees, or falsified timesheets), material mischarging (charging materials used elsewhere), and charging unallowable costs such as entertainment or lobbying.

4. Defective pricing: When contractors must submit certified cost or pricing data (e.g., under the Truth in Negotiations Act), they may knowingly provide inaccurate, incomplete, or outdated data to inflate negotiated prices.

5. False, inflated, or duplicate invoices: Billing for work not performed, overstating quantities, submitting the same invoice twice, or billing progress payments ahead of actual completion.

6. Accelerated or improper payments and kickbacks: Insiders may expedite payments or overlook deficiencies in exchange for bribes from the contractor.

Detection involves comparing invoices to receiving and inspection reports, analyzing change order patterns, auditing labor and material records, conducting site inspections, performing trend analysis, and interviewing project staff. Strong segregation of duties, independent inspection, and whistleblower channels are key preventive controls.

Preventing procurement fraud, from a Certified Fraud Examiner (CFE) perspective, means designing the purchasing cycle so that opportunity, rationalization, and undetected pressure—the elements of the fraud triangle—are minimized at every stage: needs assessment, solicitation, bid evaluation, contract award, and performance/payment. Because procurement fraud frequently involves collusion between insiders and vendors (bid rigging, kickbacks, bid splitting, phantom vendors, product substitution, and change-order abuse), prevention must combine strong internal controls with organizational culture and ongoing monitoring.

Key preventive controls include: (1) Segregation of duties, so no single person can create a vendor, approve a requisition, receive goods, and authorize payment. (2) A rigorous vendor master file process with verification of tax IDs, addresses, bank accounts, and ownership, plus periodic matching against employee records to detect conflicts of interest. (3) Competitive, transparent bidding with sealed bids, documented evaluation criteria established before solicitation, and independent review of sole-source justifications. (4) Approval thresholds and monitoring for purchases just below limits, which signals bid splitting. (5) Three-way matching of purchase orders, receiving reports, and invoices, with independent inspection of delivered goods to prevent substitution or short shipments. (6) Controls over change orders, requiring justification and approval by someone other than the original project manager.

Equally important are soft controls: a code of conduct addressing gifts and conflicts of interest, annual disclosure statements, mandatory vacations and job rotation in purchasing roles, a confidential whistleblower hotline (the most common way fraud is detected), and fraud awareness training for procurement staff and vendors alike. Management should set the tone at the top and enforce consequences consistently.

Finally, CFEs recommend proactive data analytics—testing for duplicate invoices, round-dollar payments, vendors sharing employee addresses, unusual bid patterns, and favored-vendor concentration—and periodic independent audits of high-risk contracts. Together, these measures reduce opportunity, increase perceived detection, and make procurement fraud far less likely to occur or persist.

Detecting procurement fraud, within the Certified Fraud Examiner (CFE) framework, involves identifying schemes that corrupt the acquisition of goods and services. Procurement fraud typically occurs across the procurement lifecycle: presolicitation (need recognition and specifications), solicitation (bidding), evaluation and award, and contract performance. Common schemes include bid rigging (bid suppression, complementary bidding, bid rotation), collusion between employees and vendors, kickbacks, conflicts of interest, bid splitting to avoid approval thresholds, product substitution, false invoicing, and change-order abuse.

CFEs rely on red flags as the starting point for detection. During the presolicitation phase, warning signs include specifications tailored to one vendor, unjustified sole-source awards, and vague or restrictive requirements. In the solicitation phase, indicators include unusually short bid windows, leaked bid information, and unqualified bidders winning. Evaluation red flags include low bidders being disqualified for questionable reasons, bid prices clustered suspiciously or showing identical errors, and the same vendors repeatedly winning in rotation. During performance, look for excessive change orders, cost overruns, substandard materials, duplicate payments, and invoices for undelivered work.

Data analytics is a core detection tool. CFEs use techniques such as Benford's Law analysis, vendor master file reviews (matching employee addresses, bank accounts, or tax IDs to vendors), trend analysis of pricing, identification of round-dollar or just-below-threshold purchases, and analysis of bidder patterns across contracts. Comparing contract prices to market benchmarks and reviewing vendor concentration can reveal anomalies.

Behavioral and organizational indicators also matter: employees living beyond their means, refusing to take vacations, maintaining close relationships with vendors, or overriding controls. Weak segregation of duties between requisitioning, approving, receiving, and paying is a significant vulnerability.

Finally, effective detection combines hotlines and whistleblower reports (historically the most common detection method per ACFE studies), periodic internal audits, surprise reviews, vendor due diligence, and a culture emphasizing ethics. CFEs document findings carefully, preserving evidence for potential legal proceedings.