What to do when you find a fake invoice
What an auditor should do on finding a fake supplier invoice: warning signs, whom to tell without tipping anyone off, what to record and reassess.
By Achekam · · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
The junior brings you a purchase invoice from the creditors sample. The logo is slightly blurred, the supplier's address is a residential flat, the description says only "consulting services", and the amount is just under the level that needs a second signature. Nobody in the client's operations team has heard of the supplier. Payment went out two days after the invoice date.
What happens in the next hour matters. Handled well, the firm protects the evidence, informs the right people and adjusts the audit. Handled badly, the person responsible hears about it before the board does. This article sets out what an auditor should do on finding what looks like a fake supplier invoice.
Warning signs on the invoice and the supplier
ICAEW lists warning signs within an invoice: duplicate invoice numbers, unusual formatting, strange logos, wrong addresses, spelling or grammatical errors, vague descriptions of goods or services, and amounts just below approval limits. It also warns that mismatches between invoices, purchase orders, delivery notes or contract terms, including pricing, quantities or VAT treatment, are warning signs, as are invoices marked "urgent" or accompanied by pressure to bypass controls.
On the supplier side, ICAEW points to a newly created business with little or no trading history, unexplained changes to bank account details, and suppliers that cannot be independently verified through trusted channels.
Quick checks that firm up or dispel a suspicion:
- search the supplier on the companies registry in the client's country: CIPC in South Africa, CAC in Nigeria, the Business Registration Service in Kenya;
- check the VAT number on the invoice is valid and belongs to that supplier;
- compare the supplier's bank account with employees' bank details in the payroll;
- look for other invoices from the same supplier and their pattern.
Do these quietly, using the client's records and public sources. Do not phone the supplier or ask the person who approved the invoice.
An isolated mistake or a wider control failure
ICAEW advises that an auditor who finds a fake invoice should assess whether it is isolated or points to a wider control failure. The questions:
- How did the supplier get onto the master file, and who approved it?
- Who approved the invoice and the payment? Was the approval limit avoided?
- Are there other payments to the same supplier, or to suppliers sharing its bank account, address or directors?
- Did the same person create the supplier, approve the invoice and release the payment?
A single fake invoice is rarely alone. Extend the search before drawing conclusions about size.
Telling management and those charged with governance without tipping anyone off
ICAEW advises informing management and those charged with governance promptly, while considering whether management were involved, so as to avoid tipping anyone off.
In practice:
- The engagement partner decides who is told, and when. The team does not raise it with client staff.
- Consider who might be involved. If the approver is the finance director, telling the finance director first is tipping off.
- Go to the right level. That may be the chair of the audit committee, a non-executive director or, in an owner-managed company, the owner who is not involved in the finance function.
- Put it in writing after any conversation, factually, without accusing anyone.
Our article on communicating with those charged with governance covers the general requirements for these communications.
Documenting the finding and restricting the file to named people
ICAEW advises documenting the findings. Record what was found, how, the checks made and their results, who was told, when and what they said. Keep copies of the invoice and the supporting records as they were found.
Achekam lets partners and administrators restrict a client or a single engagement to named people, with a reason. The restriction is lifted rather than deleted, and who did what and when is recorded. The account manager and the engagement's partner and manager can always open it. Where a suspected fraud may involve someone connected to the firm's contacts at the client, restricting the engagement keeps the working papers to the people who need them.
The finding itself can be raised from the working paper and, if the invoice was expensed, the team can record an audit adjustment on the affected line with a reason. Where the partner wants a second view, staff can take a technical consultation on the engagement from question to conclusion and closure, which records how the firm reached its position.
Reporting obligations to consider
ICAEW advises the auditor to consider any regulatory, legal or professional reporting obligations. These differ by country and by the client's sector, and some carry strict time limits. Before concluding, the partner should check what applies under the law of the country concerned and the rules of the firm's regulator or professional body: IRBA or SAICA in South Africa, the FRC or ICAN in Nigeria, ICPAK in Kenya. Take advice where unsure; our article on laws and regulations under ISA 250 covers the auditor's wider responsibilities.
Revisiting the audit risk assessment
ACCA explains that the auditor is not responsible for preventing or detecting fraud, but must identify and assess the risk of misstatement due to fraud and respond appropriately to obtain sufficient appropriate evidence about those risks. The IAASB states that ISA 240 (Revised), effective for periods beginning on or after December 15, 2026, has been revised to set out the auditor's fraud responsibilities more clearly; check it for audits of those periods.
A confirmed fake invoice changes the risk assessment. Revisit:
- the assessed risk for purchases, payables and payments;
- the reliance placed on controls over supplier set-up and payment approval;
- the integrity of management and the reliability of their representations;
- the nature, timing and extent of further procedures, including whether to test the full population of payments.
ICAEW's guide to identifying and dealing with fake invoices sets out the warning signs and the steps for an auditor who finds one, and is worth circulating to audit staff.
If your audit programme does not already include a step for supplier master-file changes, add one before the next engagement. A fake invoice needs a supplier record to pay, and someone had to create that record.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
