A finance director can discover the problem during an ordinary bank-reconciliation exercise. An invoice has an approved purchase order, a goods-received note and a matching payment, yet the money has gone to a supplier bank account changed shortly before settlement. The three-way match appears complete. The control has still failed.
That situation creates more than an overpayment issue. It can trigger disciplinary action, supplier disputes, insurance questions, regulatory scrutiny or litigation. In the UK, public-sector procurement reached £407 billion in gross spending during 2023/24, according to the House of Commons Library material referenced in UK Finance's fraud report, while the Public Sector Fraud Authority estimated wider fraud and error outside COVID-19 schemes at between £39.8 billion and £58.5 billion in 2021/22. That environment makes a properly scoped purchase order audit a high-value control activity, not an administrative box-ticking exercise.
The Moment Everything Started to Unravel
The finance director stared at the payment record, then at the supplier file. The invoice belonged to a familiar contractor. The purchase order had received the correct approval. Operations had posted the goods-received note. Accounts payable had followed the matching workflow.
Only the bank details were wrong.
Nobody had independently confirmed the change with a known supplier contact. The team had accepted an email instruction, updated the master record and released a payment that passed the organisation's normal three-way match. The failure sat outside the documents that everyone had checked.
Why the apparent match wasn't enough
A purchase order audit must establish more than whether three records agree. It should determine whether:
- The commitment was authorised, under the organisation's delegated authority and procurement rules.
- The goods or services were actually received, rather than receipted to release an invoice.
- The price, quantity, tax and terms were agreed, and whether later changes had proper approval.
- The supplier was legitimate, with appropriate onboarding and conflict checks.
- The payment reached the intended account, after any supplier-master amendment was independently verified.
The control objective extends to value for money, legality, accountability and a reliable audit trail. That matters in councils, NHS trusts and mid-market firms, where finance teams face limited capacity while payment processes create increasingly rich digital records.
Practical rule: A matching invoice can prove consistency between records. It can't, by itself, prove that the transaction or supplier is genuine.
The right response is a risk-based investigation. Reconstruct the sequence from requisition to payment, identify where the control environment broke down, quantify the exposure and preserve evidence that supports corrective action. If the organisation later needs to pursue recovery, report suspected fraud or support litigation, the audit file should already show how every conclusion connects to an original record.
Defining Scope, Objectives and the Sample That Will Hold Up
A defensible review starts with a decision, not a spreadsheet. Define the risk being tested, name the control owner and state what management will decide when the work finishes. The objective might involve identifying unauthorised payments, quantifying overpayments, testing procurement compliance or determining whether a supplier bank-account change bypassed approval.
The scope should identify entities, sites, systems, transaction periods and populations. Include invoices with POs, non-PO spend, invoice-only payments, direct purchases, purchasing cards and relevant credit notes where the suspected risk could exist. A review limited to invoices carrying a PO may exclude the maverick spending that caused the concern.
Build the population before choosing the sample
Pull the population from the general ledger, purchase-order system, invoice register, goods-received records, payment file and supplier master. Reconcile totals between sources, remove technical duplicates, standardise supplier names and preserve the original extracts. Keep the query logic, transformation steps and file versions, especially where a solicitor, audit committee or regulator may later challenge the work.
A useful sample combines representativeness with risk targeting:
- Random selection tests the ordinary control environment without allowing the auditor to choose only obvious exceptions.
- Targeted selection focuses on new suppliers, emergency purchases, repeated amendments, round-value invoices, split transactions and payments shortly after bank-detail changes.
- Exception selection examines overrides, late POs, unmatched invoices, unusual receipt timing and transactions that exceed approval limits.
Sample size should follow materiality, control risk, population characteristics and the assurance required. Set inclusion rules, replacement procedures and exception definitions before examining individual records. Otherwise, the team may unconsciously change the test after seeing the results.
For a public body, include the Procurement Act 2023 guidance and relevant UK procurement requirements, standing orders, delegated-authority limits and any grant or regulatory conditions attached to the spend. For litigation support, preserve chain of custody, assign evidence identifiers and use reproducible queries so another reviewer can trace each conclusion back to the source population.
Three-Way Matching and Control Testing That Actually Works
Invoice-to-PO checking provides only one part of the evidence. The full three-way match links the purchase order, the goods-receipting note or service acceptance record, and the supplier invoice. Test the supplier identity, tax identity, bank account, currency, quantity, unit price, tax, freight and settlement terms. Define tolerances before testing, and treat rounded amounts, freight variations and small differences as indicators requiring context rather than automatically harmless exceptions.
Test the workflow around the documents
For each selected item, establish who raised the requisition, who approved it and whether the PO existed before the organisation committed itself. Check whether the purchase required competitive quotes or a compliant tender, whether the approver held sufficient authority and whether segregation of duties stopped one person creating, approving and receiving the purchase.
A practical test involves inspecting the record, independently reperforming the match, observing the workflow and, where system data proves reliable, testing the entire population. The auditor should verify that the goods-received note reflects an actual inspection or delivery confirmation. For services, the authorisation should evidence performance, milestones or acceptance, not merely repeat the invoice approval.
| Record or control | Test performed | Red flag to investigate |
|---|---|---|
| Requisition and approval | Trace the request to the responsible budget holder and delegated authority | Approval after commitment, missing rationale or an approver outside the limit |
| Purchase order | Compare issue date, supplier, contract, price and terms with the underlying decision | Retroactive PO, repeated amendments or a PO raised after delivery |
| Goods receipt | Reperform the link to delivery evidence, inspection or service acceptance | Receipt posted solely to unlock payment |
| Invoice | Compare line items, tax, freight, currency and settlement terms with the PO and receipt | Rounded values, unusual freight, duplicate references or altered descriptions |
| Supplier master | Review change history, approval, effective date and independent verification | Bank details changed shortly before payment |
| Payment | Trace the approved invoice to the payment file and bank account | Payment to an account not independently confirmed |
Matching doesn't establish authenticity
A fictitious or inflated PO can match a fictitious receipt and a legitimate-looking invoice. A genuine invoice can also be paid twice, while all three records can point to a fraudulent supplier. Supplier-master testing therefore needs independent verification through a known contact, documented approval, effective dating and a clear change log. An email confirmation alone may not be sufficient where an account has been compromised.
For UK public expenditure, record the applicable delegated limits, Procurement Act 2023 route, conflict-of-interest declarations and retention requirements. Document every exception and reperformed calculation. That discipline separates an isolated processing mistake from a control weakness that could affect a much wider population.
Where Standard PO Audits Miss the Real Fraud
The most dangerous blind spot is assuming that every risky payment begins with a PO. Maverick spending sits outside the purchase-to-pay workflow, sometimes through purchasing cards, emergency buying, direct invoices or informal supplier arrangements. NHS Counter Fraud Authority guidance specifically identifies purchases made without a PO, contract, framework or preferred-supplier route as a procurement-fraud concern, because the usual matching controls never get a chance to operate. Read the practical implications alongside this accounts-payable fraud guidance.
Threshold behaviour creates another gap. Northern Ireland procurement-fraud guidance says organisations should analyse aggregate supplier spend and look for multiple invoices of similar value that may indicate splitting. It identifies purchases below £5,000 as procurement expenditure not subject to procurement rules, while contracts between £5,000 and £30,000 should seek at least two tenders to demonstrate value for money, as explained in the Northern Ireland Audit Office procurement fraud risk guide. Those thresholds require jurisdiction-specific interpretation, but the red flag is clear: repeated transactions just below an approval or tender boundary deserve attention.
Post-award risks need separate tests
Supplier bank-account changes, duplicate payments and overbilling often arise after contract award. A supplier may submit repeated service claims, split an invoice, alter a beneficiary account or exploit weak links between sister entities. Standard PO matching may confirm the description and amount without connecting the transaction to the wider pattern.
| Fraud Scheme | Typical UK Indicator | Standard Audit Detection |
|---|---|---|
| Maverick spend | Invoice, card or direct purchase without a valid PO or contract | Often missed if the population includes PO invoices only |
| Split invoicing | Similar invoices to one supplier, each below an approval or tender boundary | Missed unless aggregate supplier spend is analysed |
| Bank-account diversion | Supplier-master amendment shortly before payment | Missed if auditors test the invoice but not master-data history |
| Duplicate payment | Same gross amount, invoice reference or service period across entities | Missed when supplier names vary or systems remain separate |
| Post-award overbilling | Repeated claims, price drift or services billed without acceptance evidence | Missed when the audit stops at PO creation |
UK public-sector evidence reinforces the need for broader testing. The Public Sector Fraud Authority reported over £480.8 million in audited counter-fraud benefits in 2024/25, an increase of 28.5% year on year, in its counter-fraud benefits reporting. Data-led detection can identify exposure that transactional matching leaves untouched.
Data Analytics Techniques That Surface the Anomalies
A forensic team starts with a clean transaction population, then layers tests that expose relationships a manual sample cannot see. Tools such as IDEA, ACL and Power Query can support repeatable analysis, but the software doesn't replace judgement. Every anomaly needs a business explanation, supporting records and a clear conclusion.
Start with amount, timing and duplication tests
Benford's Law testing can highlight unusual digit patterns in invoice amounts, although it shouldn't determine fraud on its own. Investigate weekend and out-of-hours postings, particularly where the user, approver or supplier-master administrator acted outside normal working patterns.
Duplicate detection should combine exact and fuzzy matching. Compare invoice references, gross amounts, tax values, dates, service periods, purchase-order numbers and supplier names after standardising spelling and punctuation. Search across sister entities, not just within one ledger, because a duplicated invoice may pass through separate AP teams.
Year-end cut-off work should focus on transactions around 31 March and 5 April, testing whether goods or services belonged in the correct accounting period and whether staff accelerated receipts or invoices to meet reporting pressures.
Examine the supplier master, not just the invoice file
Look for dormant suppliers that suddenly reactivate, shared bank accounts across apparently unrelated payees, ghost employees or suppliers with overlapping addresses, contacts and bank details. Round-number invoicing, repeated descriptions and PO text that resembles another supplier's wording can indicate copied documentation or a concealed relationship.
A useful sequence is:
- Normalise the data, including supplier names, account identifiers, dates and invoice references.
- Join the datasets, linking PO, receipt, invoice, payment, user and supplier-master history.
- Rank anomalies, using combinations such as a new supplier, a changed bank account and an urgent payment.
- Validate with documents, contracts, delivery evidence, user interviews and independent supplier contact.
- Quantify exposure, separating confirmed loss, recoverable value, control exposure and unresolved risk.
A worked example illustrates the point. A gross-amount matching routine identified a £38,000 duplicate payment across two sister entities. The invoices used different references and slightly different supplier naming, so entity-level checks did not flag them. The recovery depended on corroborating the service period and payment records, not on treating the analytics result as proof by itself.
The government's counter-fraud strategy describes increasing data sharing to corroborate supplier information, while the National Fraud Initiative matches records across bodies to detect fraud and error. That direction matters for PO audits because the strongest findings often emerge from connections between datasets rather than from a single invoice.
Why UK Teams Bring in Forensic Accountants and What Changes
Finance teams often resist external help for understandable reasons. They worry about fees, losing control of the investigation, exposing internal weaknesses or disrupting an already stretched AP function. An SME may also believe its accountant can complete the work with a spreadsheet and a sample of invoices.
Those concerns deserve a practical response. An external specialist should agree boundaries, reporting lines, data access and decision points before fieldwork begins. The engagement can support the finance team rather than displace it, while giving management an independent view where staff may have approved, processed or inherited the transactions under review.
The value sits in evidence and recoverability
The National Fraud Initiative, managed by CIPFA, gives a UK benchmark indicating that external fraud losses average 5% of expenditure, as stated in its fraud loss measurement material. Separately, PO fraud is often described in UK practice as returning 8 to 15 times the audit fee once recoveries and prevented losses are counted. That recovery multiple isn't a universal outcome, so a responsible adviser should model it as a scenario rather than promise it.
A forensic accountant adds value when the issue may move beyond routine remediation. The work can include evidence-preserving data imaging, documented analytical trails, litigation-ready working papers and independent reporting for a board, audit committee, external auditor, insurer or solicitor. Where a referral may follow, the team should preserve an ACAMS-style trail of decisions, evidence and escalation, without assuming that every anomaly represents criminal conduct.
Lighthouse Consultants is one UK option for this type of work. Its Chartered Management Accountants undertake forensic accounting, internal audits, risk assessments and financial analysis, with reports designed for negotiations, disciplinary hearings and court where appropriate. The practical scope of a forensic accountant in the UK should match the decision facing management.
Pick up the phone when payments have gone to changed accounts, supplier records look connected, staff can't explain non-PO spend, duplicate claims keep recurring or a dispute requires independent quantification. Early evidence preservation usually gives management more options than a late review after records have been overwritten or memories have faded.
Reporting Findings, Remediation and Next Steps
A purchase order audit report should drive decisions. It needs an executive summary, defined scope, methodology, risk-ranked findings, quantified financial impact and recommendations with named owners. Each conclusion should link to working papers, analytical output and sample schedules so an audit committee, the National Audit Office, an external auditor or a court can understand how the result was reached.
Match the report to the audience
The board needs the exposure, root cause and decision required. Finance and procurement need the failed control, affected population and practical fix. Internal audit needs reproducible testing and control design implications. Counter-fraud teams need evidence, suspects or supplier relationships handled carefully, together with a documented escalation route. External regulators may require specific records, procurement decisions and explanations of compliance.
Remediation works best in layers:
- Immediate containment: Freeze suspicious supplier-master changes, review open invoices, hold affected payments and preserve relevant records.
- Process correction: Enforce no purchase order, no payment, strengthen independent bank-detail verification, review override logs and require evidence of receipt or service acceptance.
- Governance improvement: Maintain a reliable contract register, refresh delegated authorities, separate requisition, approval, receipt and payment duties, and monitor non-PO spend.
- Continuous assurance: Repeat duplicate, split-invoice, threshold and supplier-relationship analytics, then report unresolved exceptions to the responsible owner.
UK public-sector guidance recommends a “no purchase order, no payment” control because it blocks invoices without a valid PO and creates a clear trail for exception management, as set out in the UK procurement fraud review checklist. A local-government review also illustrates how organisations can formalise controls, including dual authorisation for POs over £1 million, monthly quality checks for payments over £1 million and a 5p per-item tolerance for order-versus-invoice differences, as recorded in the Barnet accounts-payable review.
Use an investigation report template that records actions, owners and deadlines, then track implementation rather than filing the report away. Lighthouse Consultants can scope a UK purchase order audit, test the full procure-to-pay trail, apply forensic data analytics and quantify recoverable exposure. Visit Lighthouse Consultants to arrange a confidential discovery discussion and turn unexplained payments or control concerns into evidence-based next steps.
