Fraud & assurance
Controls that fire, and admit what they cannot see.
Fraud controls that catch what a value ladder misses. A sanctioned supplier. A bank account changed just before a big payment. Patterns across ordinary purchases.
The commonest loss there is
Invoice redirection works through honest staff.
An honest clerk enters an emailed request and a colleague confirms it. Every rule is met, yet the money goes astray. Watch the timing.
- WatchesChanges just before a large payment, twice in a month, or back to an old account
- OrdersLargest amount owed first. You cannot check everything, so the order is the control
- Your choiceWarn, or refuse payment until confirmed. Refusing will hold a payment run the day it goes on, so warning is the default
- The adviceCall a number you already had, never one from the request
Bank detail changesRecent changes, ordered by what you owe that supplier.
Who you are about to pay
A match is not a finding.
Most matches are a different party with a common name. A person reviews each once and records why.
- The listsOFAC, the UN consolidated list and the UK OFSI list. Refreshed on a schedule, with entry counts and dates
- RefusesA confirmed designation blocks award and payment in every mode. Making funds available to one is an offence
- Honest when emptyAn empty queue with no lists means nothing was screened, not that all is clear. The screen says so
- AuditableEach match keeps its score. A later threshold change cannot rewrite it
Sanctions screeningThree published lists, and matches awaiting a decision.
Patterns, not single acts
Four checks across many purchases.
These find patterns across purchases that each looked normal. Those are the losses found late.
- Duplicate paymentThe same invoice paid twice, across orders
- Retrospective coverA purchase order raised after its invoice
- Threshold huggingValues just under an approval band, repeatedly
- Round-number biasValues rounder than your ledger usually runs. The screen calls it the weakest. Each check lists its blind spots
Fraud indicatorsFour checks over the ledger, with evidence for each lead.
Getting in, and being shut out
What security questionnaires ask first.
A second factor, and a way to cut access during an incident.
- Second factorBuilt-in authenticator codes. No SMS, no third party. Required for admins, or everyone except supplier portal accounts
- Nobody strandedTurning it on locks nobody out. Unenrolled users are signed in and sent to enrolment
- Lock-outBlock everyone, one role or one person. Sessions end at once. Admins stay in to respond
- Single sign-onOIDC with Microsoft Entra ID, Google Workspace or Okta, plus SCIM. The directory never sets roles
Emergency lock-outThree levels, because “everybody” is usually too blunt.