Testing supplier set-up and payment controls

How an auditor can test a client's supplier onboarding, bank detail changes and invoice approval for the risk of fake invoices and diverted payments.

By Achekam · 11 October 2026 · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya

A supplier the finance team has dealt with for years e-mails to say it has changed banks. The letter is on the right letterhead, the new account is at a reputable bank, and the creditors clerk updates the master file before the payment run. A month later the real supplier calls to ask why it has not been paid.

Fake invoices and diverted payments are among the oldest frauds in business, and they still work because they ride on ordinary processes. For an auditor, the question is not only whether the client lost money this year. It is whether the controls over suppliers and payments would stop or catch it, and whether the payments in the ledger went to real suppliers for real goods. This article sets out how to test that.

Who sets up suppliers, who approves, who pays

ICAEW recommends preventing fake invoice fraud by tightening supplier onboarding and verification, separating who sets up suppliers, who approves invoices and who makes payments, independently checking any bank detail changes, and using three-way matching, duplicate invoice checks and limits on manual overrides. Its article on how to identify and deal with fake invoices is a practical read for both the audit team and the client's finance staff.

AccountingTools makes the same point from the segregation side: no single person should control authorisation, recordkeeping and custody of assets for the same transaction, and the employee who enters supplier invoices should not be the person who authorises or processes payments, so that nobody can create a fake invoice and approve it themselves.

In the walkthrough, map the three roles and then check what really happens:

Policy and practice often differ. Ask for the user list and rights on the accounting system and on the banking platform, not just the procedures manual.

Bank detail changes and independent verification

A change to a supplier's bank account is the single riskiest event in the master file. ICAEW lists supplier red flags for fake invoices: a newly created business with little or no trading history, unexplained changes to bank account details, and suppliers that cannot be independently verified through trusted channels.

To test the control, obtain a report or audit log of bank detail changes for the year and, for each change selected, confirm that:

• a written request was received from the supplier;
• someone verified it by calling the supplier on a number already on file, not one supplied in the request;
• a second person approved the change before any payment;
• the first payment after the change was reviewed.

A change "verified" by replying to the e-mail that requested it has not been verified at all.

Matching orders, invoices and payments with analytics

ACCA's examples of procedures performed with data analytics include matching purchase orders to invoices and payments, and testing segregation of duties using transaction metadata. With the client's purchase and payment data, useful tests include:

• payments with no matching invoice, and invoices with no order;
• the same invoice number or amount from one supplier more than once;
• suppliers sharing a bank account with each other or with an employee;
• suppliers created and paid within a short window, or with no tax number;
• invoices clustered just below an approval limit;
• the same user creating a supplier and capturing its invoices.

Walking through in the Controls & Walkthrough Studio

In Achekam, the Controls & Walkthrough Studio saves its work on the server for the chosen engagement. Record the purchases and payments cycle there step by step: who performs each step, the control, and what the walkthrough showed. The ISA numbers on the module's badges are labels, not evidence of compliance; the evidence is what the team records. Walkthroughs and controls covers the walkthrough itself.

For evidence at journal level, Journal Entry Testing lets staff load a whole-population journal extract as CSV and map its columns, and Achekam flags entries such as manual, weekend, after-hours and post-close postings for staff to select and test. Manual postings to creditors or bank, and after-hours entries on supplier accounts, are natural selections when the risk is fake invoices. See journal entry testing.

Sampling supplier changes and payments

In Achekam's Audit Intelligence, staff load a population, Achekam risk-scores it and proposes a sample, and a reviewer who did not prepare the plan approves it before it is drawn; every draw can be reproduced from its stored seed. Load two populations separately. For master file changes, a small client may have few enough bank detail changes to test all of them, and "all items" is one of the methods. For payments, test that each selected payment has an approved invoice matched to an order and to evidence of delivery, that the supplier exists, and that the bank account paid matches the verified master file at the time of payment.

Findings to raise with management

Typical weaknesses worth reporting:

• one person can both create suppliers and release payments;
• bank detail changes are accepted by e-mail without a call-back;
• nobody reviews master file changes;
• invoices are paid without an order or delivery evidence;
• there is no check for duplicate invoices;
• manual overrides are unlimited or unreviewed.

If the team finds an actual fake invoice, the response changes. ICAEW advises the auditor to assess whether it is isolated or points to a wider control failure, to inform management and those charged with governance promptly while considering whether management were involved, to avoid tipping anyone off, to document the findings, and to consider any regulatory, legal or professional reporting obligations.

Supplier fraud rarely needs sophistication; it needs one gap between three roles. An audit that tests where those roles meet will usually find it.

General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.