When a concern about procurement reaches the head of internal audit, fraud, legal or HR, the first days matter more than most people expect. A sound procurement fraud investigation, from the first steps through evidence preservation, determines whether findings can later support disciplinary, regulatory or legal action. This article describes patterns that typically appear in such inquiries and offers a plan for the first fortnight.
The patterns below are anonymized and general. They are not the account of any single organization.
Why the first two weeks matter
Most procurement concerns begin quietly: a complaint, an audit exception, an unusual invoice. The temptation is to ask the people involved what happened. That is usually the wrong first move. Records can be altered, mailboxes cleaned and devices reset within hours of a person learning they are of interest.
The Saudi Central Bank (SAMA) Counter-Fraud Framework (CFF) expects regulated institutions to have a defined approach to detecting, investigating and responding to fraud. In practice that means roles are clear, matters are escalated to the right people and the investigation is handled in a way that can be defended afterwards. A first-fortnight plan is how that expectation becomes action.
Signals that recur
Across banks, insurers, finance companies and payment providers, the same early indicators appear in procurement matters.
Split purchase orders
A requirement that would exceed an approval threshold is divided into several smaller orders, often to the same vendor, raised within days of each other. Individually each order looks routine. Together they show a pattern that avoids a higher level of scrutiny or competitive tendering.
Vendors linked to employees
Vendor master data often holds the first clue. Shared bank account details, addresses, phone numbers or registration contacts between a supplier and a staff member are common. Sometimes the link is indirect, through a relative or a former colleague. A link alone is not proof of wrongdoing, since some are declared and legitimate, but an undeclared one deserves attention.
Approvals just under authority limits
Approvals that cluster just below a delegated authority limit suggest that amounts are being shaped to fit an approver. The same approver and the same vendor appearing repeatedly strengthens the signal.
Supporting indicators
- Vendors created and paid within a very short period
- Invoices with sequential numbers from a supplier said to have many clients
- Deliverables that are hard to verify, such as consulting or maintenance
- Approvers who bypass system workflows or ask others to process urgently
- Reluctance to take leave or to hand over vendor relationships
These indicators justify scoping an inquiry. They do not justify conclusions.
Where early handling goes wrong
In our experience of how these matters unfold, the same mistakes weaken later action.
- Interviewing too soon, which alerts the subject before evidence is secured
- Letting IT or business colleagues browse the suspect's files, changing metadata
- Copying files informally with no record of who held them
- Informing too many people, so confidentiality is lost
- Reassigning or suspending staff in a way that gives access or warning before preservation
- Reaching conclusions in emails or meetings that later become part of the record
Each of these gives a defence lawyer, a tribunal or a regulator reason to question the findings.
A first-fortnight plan
Days 1 to 2: Scope and contain
Define what is suspected, which processes, vendors, time period and people are in scope, and who has authority to decide. Limit knowledge to a named group. Record decisions with dates and reasons.
Inform the right parties in the right order. Typically this means the general counsel, the head of HR, the chief risk or compliance officer and the audit committee chair, depending on seniority of those involved. Consider early whether notification to SAMA is required under your obligations and internal escalation rules, and take legal advice where unclear.
Days 1 to 4: Preserve evidence
Preserve before analyzing. A sensible list includes:
- Vendor master records and change logs, including who created or edited each vendor
- Purchase requisitions, orders, approvals, goods receipt and payment records
- Contracts, tender files, quotations and evaluation records
- Email and messaging data for the people in scope, subject to legal and privacy review
- Laptops, mobile devices and removable media, imaged forensically where justified
- Access logs, workflow audit trails and badge or system records
- HR files, declarations of interest and conflict-of-interest registers
Every item should have a chain of custody: who collected it, when, from where, and who has held it since. Original records stay untouched; analysis is done on copies. Consider data-protection obligations when handling personal data, and document the legal basis for collection.
Days 4 to 10: Analyze
With evidence secured, analyze transactions and records before speaking to anyone. Useful work includes:
- Testing purchase orders for splitting by vendor, requester and date
- Comparing vendor attributes with employee records
- Mapping approvals against delegated authority limits
- Tracing payments to receiving accounts
- Reviewing documents and devices for supporting communications
The aim is to arrive at interviews knowing most of the answers, and to separate control weaknesses from intentional misconduct.
Days 10 to 14: Prepare interviews and decide next steps
Interviews should begin only once key evidence is preserved and analysis has shaped clear lines of questioning. Start with those who hold context, such as process owners and administrators, and approach the main subjects later. Agree beforehand with HR and legal on interview conduct, attendance, record keeping and any rights of the employee.
At the end of the fortnight, decide with the accountable executives whether to continue, widen scope, suspend access, involve authorities or move to disciplinary steps. Keep a decision log.
What a defensible record looks like
A defensible file lets a third party follow the path from allegation to conclusion. It shows what was preserved and when, how analysis was done, what each interview contributed and why decisions were made. It also records the root cause: which control failed, whether segregation of duties was absent, whether vendor onboarding checks were skipped, and why the pattern went unseen.
How we support institutions
Our Fraud Investigation and Forensic Accounting service is an independent investigation of suspected internal or external fraud, with evidence handling suitable for disciplinary, regulatory and legal action. The work follows four stages: contain, analyze, establish and report. It includes case scoping and evidence preservation, transaction and ledger analysis, interviews and fact-finding, and root-cause and control-failure analysis. The deliverables are an investigation report, an evidence file and recommendations to prevent recurrence.
On confidentiality, access is limited to named people and every piece of evidence has a recorded chain of custody. We usually start within one to two business days of engagement, faster for urgent cases.
If you are weighing whether a concern warrants an inquiry, or want your first-fortnight plan reviewed before you need it, we are glad to discuss it with you.
