A fraud risk assessment for a small factory
Which fraud risks a small manufacturer should list and rank, a simple template to do it, and which control or person answers each risk.
By Achekam · · 5 min read · For Manufacturing businesses in South Africa, Nigeria, Kenya
Owners of small factories tend to think about fraud the way they think about fire: something that happens to other businesses, until it happens to theirs. When it does, it is rarely dramatic. It is a supplier nobody remembers appointing, scrap bins that fill faster than they should, or a wage paid every month to someone who left a year ago.
A fraud risk assessment is the exercise of writing those possibilities down before they happen, deciding which matter most, and checking that something or someone stands in the way of each. It does not need consultants or a thick binder. A small manufacturer can do a useful one in an afternoon with the people who know the factory best. This article gives a structure and a template.
Your list, not someone else's
COSO says its Fraud Risk Management Guide, Second Edition, is meant to give organisations of all sizes, in all industries, the information they need to design a plan specific to their own fraud risks. COSO adds that there is no "one size fits all" approach.
That is the point to start from. A generic list of frauds copied from the internet will include risks you do not have and miss the ones you do. A factory that sells through dealers on credit has different exposure from one that sells for cash at a trade counter. Begin with how money and goods actually move through your business.
ACCA groups the frauds a forensic accountant may investigate into three categories: corruption, asset misappropriation and financial statement fraud. It describes asset misappropriation as by far the most common. Those three headings make a good skeleton for the list.
Where the money leaves: purchasing
ACCA describes fraudulent disbursements, a form of asset misappropriation, as using company funds to make fraudulent payments. Its common examples are billing schemes that pay a fictitious supplier and payroll schemes that pay fictitious, or "ghost", employees.
In purchasing, the risks a factory should name include:
- Fake suppliers. A company set up by an employee or an accomplice, invoicing for goods that never arrive.
- False or duplicate invoices. The OECD lists false or duplicate invoicing for goods and services not supplied as a procurement risk after a contract is awarded. In a factory, that can be a real supplier billing twice, or billing for a full delivery when part of it was short.
- Kickbacks. A buyer steering orders to one supplier in return for a payment. This falls under corruption rather than misappropriation, and it is harder to see in the books because the invoices look normal.
- Weak separation of duties. The OECD also lists deficient separation of financial duties, leading to false accounting and cost misallocation, as a risk. If one person can create a supplier, approve the order and release the payment, every other control depends on that person's honesty.
Where the goods leave: stock and scrap
Factories hold value in forms that are easy to carry away: copper offcuts, finished goods, spare parts, fuel. The classic method is to dress theft up as waste. Material is written off as scrap or spoilage, and then sold privately.
Risks to list include scrap recorded but not physically weighed and sold through the business, finished goods leaving without a dispatch record, and stock adjustments that nobody reviews. Controls here are mostly people and procedure: regular counts by someone other than the storekeeper, scrap weighed and sold under a second person's signature, and a monthly review of write-offs by the owner.
Where wages leave: payroll
Ghost workers are the payroll version of a fake supplier, and in a factory with casual or shift labour they can be hard to spot. The related risk is a genuine employee's bank account quietly changed to someone else's.
Ranking the risks and naming an owner
Once the list exists, rank each risk on two simple scales, likelihood and impact, using High, Medium and Low. Do not pretend to more precision than you have. Then name an owner for each: one person responsible for knowing whether the control is working.
COSO's second edition expands its material on data analytics, while continuing to emphasise interviewing and whistleblower systems. For a small factory, that translates into three habits: look at the data for odd patterns, talk to the people who do the work, and give staff a way to report concerns without going through the person they are worried about.
A template, with controls
| Risk | Category | Likelihood | Impact | Control | Owner |
|---|---|---|---|---|---|
| Invoice for goods not received | Misappropriation | Invoice matched to order and delivery; held if different | Accounts | ||
| Fictitious or related supplier | Misappropriation | Integrity review flags supplier paid into an employee's account | Owner | ||
| Rigged quotes | Corruption | Integrity review flags competing quotes sharing contact or bank details | Owner | ||
| Changed employee bank account | Misappropriation | Second person verifies before payment | Payroll | ||
| Scrap sold privately | Misappropriation | Weighed and sold under two signatures | Production manager | ||
| Year-end figures massaged | Financial statement fraud | Owner reviews; external accountant | Owner |
Fill in the likelihood and impact columns yourself; they are your judgement about your factory.
Which controls Achekam provides
Three of the controls in that table come from Achekam:
- Matching supplier invoices. A supplier invoice recorded against an order is matched with what was ordered and what arrived. If price or quantity differ, it is held until someone writes a resolution note. See matching orders, deliveries and invoices.
- The procurement integrity review. Sold as its own add-on, it raises questions about warning patterns such as competing quotes that share contact or bank details, or a supplier paid into an employee's bank account. It raises questions; a person still has to answer them. Its check for purchases split to stay under a threshold does nothing until a threshold is set, and the app cannot set one today, so do not count that check among your controls.
- Verified bank details in payroll. An employee's bank account entered or changed by one person must be verified by another before it is paid in the payment schedule or bank file.
The rest of the table belongs to people. Separation of duties in ordering is covered in why a buyer cannot approve their own orders, and the broader patterns are described in common occupational fraud schemes.
Do it this month
COSO's fraud risk management page describes the guide and what it covers. Book an afternoon with your production manager, your bookkeeper and whoever runs the stores, fill in the template together, and diarise a date a year from now to do it again.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
