How to spot a dishonest purchasing manager

Issue: Employees handling your organization's purse strings could be pulling them in the wrong way.

Risk: Lax controls leave your organization wide open to invoice fraud.

Action: Suggest the following control measures to help prevent in-house fraud, and root it out quickly if it occurs.

Organizations with only one employee doing most of the purchasing are the most vulnerable to fraudulent employees skimming off the top or receiving kickbacks from vendors. This is an especially big problem at smaller firms without enough staff to separate key duties.

Advice: Alert your top security leaders to watch for these red flags in the purchasing department, as suggested by the Journal of Accountancy:

• Purchasing manager rarely, if ever, takes vacation time.
• Manager suffers personal financialproblems.
• Close personal relationship between purchasing agent and vendors.
• Excessive purchases from one vendor.
• Expenditures come in just below the limit that would trigger automatic review by a supervisor.
• Accelerated payment of invoices and multiple purchases over a short period.

To prevent invoice fraud in the first place, organizations should follow these four simple but effective measures: (If your organization doesn't, suggest them to the top execs.)

1. Separate duties. Ideally, you'd use different employees to handle vendor ap-proval, purchase requisitions, purchase approval, receiving and payment. While this won't prevent collusion, most invoice scams are committed by one employee acting alone.

2. Job rotation. Because purchasing managers are subject to constant temptation by unscrupulous vendors, they shouldn't deal with the same vendors indefinitely. If possible, rotate the positions of people who handle invoices. If that's not possible, have an outside accountant occasionally examine key risk areas such as purchasing, even if a full audit isn't necessary.

3. Closer supervision. Supervisors should know the signs of invoice fraud and watch for them.

4. Mandate vacations. Many scam artists never take vacation, fearing that their replacement will uncover the truth. So require employees to take at least a week per year; employees who balk will earn your extra attention.