Fraud Auditing, Detection, and Prevention Blog

Complex Fraud Scheme: Vendor Overbilling Part 1

Aug 2, 2018 9:07:00 AM / by Leonard W. Vona

In our fraud risk registers, we have identified over 100 procurement fraud schemes and over 100 overbilling fraud schemes. When these kinds of numbers are involved the idea of finding complex fraud schemes in your core business systems may seem overwhelming. However, fraud data analytics can simplify and improve the process.

In this blog we have selected a complex corruption scheme and a complex overbilling scheme to illustrate how fraud auditing can detect even the most complex schemes. The starting point is to identify the fraud risk statement and then understand how and where the scheme can occur in your organization.

Vendor overbilling schemes that involve collusion between the budget owner and a vendor are difficult to detect thorough traditional audit procedures because on the face of the transaction, it appears that all internal controls are fully complied with. As a general rule, vendor over billing can occur before the procurement process by communication of information to one vendor or can occur after the vendor selection process by post approving changes.  

Fraud Risk Statement: Complex Scheme

The following fraud risk statement is an example of a complex scheme that we will use as an example:

A budget owner or a senior member of management provides a real complicit supplier with advance information on future changes to the purchase requirements listed on the bid documents providing the real complicit supplier an unfair competitive advantage in the bidding process. After the purchase order is issued to the complicit vendor, the budget owner or senior member of management allow or cause changes to the original purchase commitment which may or may not cause a change to the purchase order total amount. The changes allow the real complicit supplier to invoice for items with higher margins than originally stated in the bid response by the budget owner and:

  1. Change line item quantities with no change to the original purchase order amount.
  2. Change the items purchased allowing the supplier to provide inflated prices on the changed item (product mix) within the original purchase order amount.
  3. Change line item quantities and increase the purchase order amount.
  4. Change product mix and increase the purchase order amount.


The complicit vendor provides a kickback to the budget owner in consideration of the advance communication of information which results in a corruption scheme and an overbilling fraud scheme.

The corruption scheme itself is how the budget owner and the vendor collude to rig the bid. The asset misappropriation scheme is the overbilling scheme.  The fraud auditor can find the scheme through fraud data analytics by analyzing data for the specific pattern of data associated with the scheme.

Defining Kickbacks and Overbilling

In this blog, we will also consider the concept of the bribe (kickback) tax, which is the money paid by the vendor (kickback) to the budget owner for the corrupting the bid process.

It is important to understand this concept in order to properly develop your fraud audit program. Bribe tax is funded via an overbilling scheme. In the example scheme that we have chosen the budget owner and vendor in collusion create changes for items that have a higher margin than the items in the original vendor bid.  

In the examination of vendor overbilling schemes that were successfully prosecuted in a federal court, the overbilling occurred through price inflation, product substitution or false charges. In this scheme, the overbilling occurs through margin inflation due to the changes in quantities or product mix.

How the Corruption Scheme Occurs: Step-by-step

In this example, the request is for supply items or inventory items.

First: The budget owner causes procurement to issue a request for proposal for items needed in the normal course of business. Procurement issues the request to authorized vendors. Procurement receives three bids and the lowest cost vendor is selected.

Next: The request for proposal falsely states anticipated quantities of each item or falsely states the mix of items that will be purchased for a specified period of time. It is important to note that the person committing the scheme could be either the budget owner or a procurement officer depending on your procurement processes and what is being procured.

Then: The corruption starts when the budget owner provides the complicit vendor with information that is not provided to the other vendors. The corrupt act occurs by changing the quantity or product mix after the purchase order is awarded to the vendor with the lowest total cost. This may or may not result in a change order to be issued at later date.

The advance communication of information provides the complicit vendor with an unfair advantage. Since the complicit vendor knows that changes will occur, the vendor is able to structure their bid to win the bid by providing a low unit price on items with high quantities (low margin) in the bid and high unit prices on items with low quantities (high margins) in the bid.

The corruption scheme causes non complicit vendors to provide unit prices based on the anticipated quantities stated in the bid. Thereby, causing the non-complicit vendors bids to have a higher bid cost. Therefore, at time of bid opening, the complicit vendor will have the lowest total cost.

The overbilling scheme occurs by a change to the quantity ordered or changes in product mix. The budget owner intentionally orders less of the items with low margins and more of the items with higher margins. Therefore, the vendor loses less money on the unit prices with low margins and reaps large profits on unit process with high margins.  

Importantly: From an internal control process, all procedures seemed to be followed. Three bids were received. The lowest cost vendor was selected. As invoices are submitted, the invoice will match the original purchase order or the changed purchase order. All change orders are authorized by the budget owner and procurement approves the purchase order change based on the budget owner’s statement that an unforeseen condition caused changes to the original requirements.

How The Concealment Occurs

The concealment of the scheme occurs because the budget owner creates the illusion of complying with internal controls. The bid process fully complies with all internal controls. The concealment strategy:

  • At the highest level is the advance communication of information through oral communication of the information providing no overt audit trail.
  • At the lowest level the budget owner would leave an audit trail thorough emails or telephone records.


The overbilling concealment occurs because at the highest level there is no change to the purchase order amount. Whereas, when the purchase order needs to be changed it provides an audit trail. Yet, the change order is in full compliance with stated procedures.

How the Overbilling Scheme Occurs: Step-by-Step

The budget owner places orders for items needed by your company, but the budget owner orders more of the item with a higher margin and less of an item with a lower margin. The vendor submits an invoice for items received by your company. The goods maybe received through a receiving function or directly by the budget owner. Accounts payable matches the vendor invoice to the purchase order and receiving documentation and obtains all the proper approvals. Then accounts payable pays the invoice. 

The internal control vulnerability occurs because accounts payable is applying invoices to an open purchase order based solely on remaining total dollars. This will allow the change in quantity to occur without detection. If accounts payable is matching line items on an invoice to the line item of the purchase order, then the budget owner will need a change order. However, then the purchase order will correspond to the vendor invoices, thereby allowing the scheme to go undetected.  

In one sense, you could call this the perfect crime. The budget owner corrupts the selection process, the vendor overbills, the budget owner receives a kickback, the vendor reaps higher profits and scheme is never detected.

Next Steps

The second part of this series we will explain the fraud data analytics designed to uncover the fraud scheme and the fraud audit procedures designed to provide creditable evidence that the scheme is being perpetrated by the budget owner.

At Fraud Auditing Inc. we have over 38 years of diversified experience. Contact us today if you need help building a comprehensive fraud audit program to detect complex fraud schemes.

Demystifying Fraud eBook CTA

Topics: Fraud Data Analytics, Fraud Risk Statements, Fraud Schemes, Fraud Auditing, Fraud Definitions

Leonard W. Vona

Written by Leonard W. Vona

Leonard W. Vona has more than 40 years of diversified fraud auditing and forensic accounting experience. His firm, Fraud Auditing, Inc., advises clients in areas of fraud risk assessment, fraud data analytics, fraud auditing, fraud prevention and litigation support.