ACCT 432 Week 8 Individual Project 8 Example

Who Can Create a Vendor and Pay It? An ERP Segregation-of-Duties Mini-Case and the Shell Company It Uncovered

Case Background

Ironwood Fabrication, a composite manufacturer with $310 million of revenue, replaced several separate systems with an integrated ERP system two years ago. To meet the go-live date, the implementation team copied broad roles from the old systems and gave several accounting and purchasing staff extra permissions to resolve problems quickly. An emergency access account, intended for urgent fixes, was shared by the IT team. No one had reviewed user access since go-live, and staff who changed jobs kept their old permissions along with their new ones. Hall (2016) explains that ERP systems integrate business processes around a common database, which improves the consistency of information but means that access controls within the system, rather than separate departments and paper documents, now enforce segregation of duties. That shift is easy to miss during implementation, when the priority is getting transactions to flow, and it means a role granted for convenience can quietly undo a control that the old paper process enforced automatically.

Segregation-of-Duties Review

The auditor extracted user-role assignments and compared them with a conflict matrix of sensitive functions.

Grabski et al. (2011) note that ERP implementations create new control challenges, including complex authorization structures that organizations often configure incompletely at go-live, which is the pattern seen here. The emergency account is the most serious finding, because it carries every permission in the system and leaves no record of which person used it; the auditor cannot even determine whether the 140 uses were legitimate.

The Fraud Scheme

One of the 11 users with vendor-creation and payment rights was a purchasing supervisor. Joining the vendor master file to payment and employee records showed a vendor, "Northline Advisory Group," created by the supervisor 18 months earlier, with a post office box address and a bank account that also received the supervisor's expense reimbursements. Northline was paid $286,000 in 31 payments, each below the $10,000 threshold that would have required a second approval, for consulting services with no purchase order, contract or receiving record. Accounts payable staff had noticed the invoices but assumed someone else had approved the engagement. The ERP system recorded every step of the scheme; no one had asked it the right question. Hall (2016) describes this kind of scheme, a shell company paid for services never provided, as one of the most common forms of asset misappropriation. The integration that made the fraud easy also made it traceable: the vendor record, the invoices, the payments and the user who entered each were all in one database, linked by keys, waiting for a query.

Detection Procedures

The tests that exposed the scheme were simple once the data were extracted: matching vendor bank accounts and addresses to employee records, listing vendors created and paid by the same user, flagging recurring payments just below approval limits and identifying service vendors with no purchase orders. Tips are still how most occupational frauds come to light, in the Association of Certified Fraud Examiners (2024) global study, which is a good reason to pair these analytic tests with a confidential reporting line. The auditor would also expand testing to the other ten users with the same conflict, examine every use of the emergency account and estimate whether any other vendor shows similar patterns, so that the scope of the loss is known before the financial statements are issued.

Recommendations

Ironwood should redesign roles so that no user can both create vendors and release payments, assign vendor master changes to a small team outside purchasing and accounts payable, require independent approval of any change to vendor bank details and replace the shared emergency account with individual, logged emergency access reviewed within one business day. The vendor-employee match and the below-threshold payment test should run monthly as continuous monitoring. Finally, the chapter's ethics material suggests that the company's code of conduct and reporting line be reintroduced to staff, since controls and culture work together. These changes are within reach of a company Ironwood's size, since most require reconfiguring roles rather than buying new software, and the monthly tests can be scripted once and reused.

References

Association of Certified Fraud Examiners. (2024). Occupational fraud 2024: A report to the nations. https://www.acfe.com/fraud-resources/report-to-the-nations

Grabski, S. V., Leech, S. A., & Schmidt, P. J. (2011). A review of ERP research: A future agenda for accounting information systems. Journal of Information Systems, 25(1), 37-78. https://doi.org/10.2308/jis.2011.25.1.37

Hall, J. A. (2016). Information technology auditing (4th ed.). Cengage Learning.