Fraud Detection Tests: Practical Audit Procedures to Identify Suspicious Transactions

Fraud is rarely discovered simply by looking for one obviously fraudulent transaction. How to detect financial fraud is an important financial skill because fraudulent activity can sometimes appear as ordinary transactions until unusual patterns are identified.

In many cases, the transaction itself may appear legitimate. The warning signs emerge only when transactions, suppliers, employees, approvals, budgets and payment patterns are examined together.

Fraudsters often exploit weaknesses in internal controls and try to make their transactions appear normal. They may split purchases, use related parties, create unusual suppliers, bypass established procedures or conceal transactions among large volumes of genuine activity.

This is why effective fraud detection requires more than simply checking a random sample of transactions.

It requires knowing where to look, what patterns to test and which unusual results deserve further investigation.

This article presents practical fraud-detection tests that can be used by internal auditors, management, compliance teams and organizations reviewing purchasing and payment activities.

How to Detect Financial Fraud: Key Warning Signs

Important: These tests identify potential warning signs. They do not, by themselves, prove that fraud has occurred. Suspicious results require appropriate investigation and a reasonable explanation. Knowing how to detect financial fraud starts with recognizing transactions, requests and behaviors that do not fit the customer’s normal financial activity.

Why Traditional Sampling May Not Be Enough

Random sampling has an important role in auditing, but it may not be the best starting point for identifying concealed fraud.

A fraudster may deliberately structure a transaction so that it looks legitimate when viewed individually.

For example, a purchase may:

• Fall within an employee’s approval limit
• Have apparently valid supporting documents
• Be processed through the normal accounting system
• Involve a genuine supplier
• Appear reasonable when selected in isolation

However, analysis of the wider transaction population may reveal that the same employee repeatedly purchases just below an approval threshold or that several suppliers share the same address.

This is where data analysis and targeted testing can be particularly useful.

1. Budget and Expenditure Tests

Budgets provide an opportunity to identify unusual spending patterns.

For related practical calculations, you can also explore Equicio’s Financial Tools and Calculators.

Test Significant Project Overruns

Identify projects that exceeded their approved budgets by a predetermined percentage.

For example, an organization might initially review projects that exceeded budget by more than 20%.

Then examine:

• The reasons for the overrun
• Changes to the original scope
• Additional purchase orders
• Supplier selection
• Approval history
• Relationships between employees and suppliers
• Whether similar projects experienced similar overruns

A budget overrun is not evidence of fraud. Legitimate changes in scope, inflation or unforeseen circumstances may explain it.

The purpose of the test is to identify transactions that deserve additional attention.

Compare Mid-Year and Year-End Spending

Compare actual expenditure against budget at different points during the year.

Look for projects that were significantly underspent midway through the year but subsequently consumed most or all of their budgets near year-end.

This can identify unusual spending patterns requiring explanation.

Examine Unusual Quarterly Spending

Analyze expenditure by quarter and identify situations where spending is heavily concentrated in the first or final quarter.

For example, unusually high spending near year-end may be legitimate, but it can also warrant review where procurement decisions appear rushed or normal controls were bypassed.

2. Approval-Limit Tests

Approval thresholds are an important internal control.

Employees may have different authority limits depending on their position.

This creates an opportunity for targeted testing.

Look for Transactions Just Below Approval Thresholds

Suppose an employee has authority to approve purchases up to a particular amount.

Extract transactions that fall just below that limit and examine whether unusual patterns exist.

Look for:

• Repeated purchases just below the threshold
• The same supplier appearing frequently
• Similar transactions occurring within a short period
• Multiple transactions that appear connected
• Purchases that could reasonably have been treated as one larger transaction

The objective is to identify possible transaction splitting.

Test for Invoice Splitting

Invoice splitting occurs when what may effectively be one purchase is divided into several smaller transactions.

For example, instead of one purchase requiring higher-level approval, several invoices may be processed separately so that each remains within a lower approval limit.

Data analysis can help identify:

• Same supplier
• Same employee
• Same department
• Similar descriptions
• Closely spaced invoice dates
• Similar amounts
• Sequential purchase orders

Individually, the transactions may appear normal. Collectively, they may require explanation.

The SEC’s Investor.gov also provides practical guidance on recognizing phishing, smishing and vishing attempts involving financial accounts.

3. Procurement and Tendering Tests

Procurement processes can present significant fraud and corruption risks.

Testing should focus particularly on transactions where normal competitive procedures were not followed or where unusual circumstances were cited.

Review Contracts with Unusual Characteristics

Consider selecting contracts that:

• Were awarded just below a higher approval threshold
• Generated complaints from users
• Experienced significant cost overruns
• Had unusual supporting charges
• Used emergency or urgent procurement procedures
• Bypassed normal tendering procedures
• Had significant specification changes after award
• Contained unusually complex technical specifications

These characteristics do not establish wrongdoing.

They simply provide useful criteria for targeted review.

Reperform the Procurement Decision

For selected contracts, reconstruct the procurement process.

Ask:

• Which suppliers were considered?
• Which suppliers were excluded?
• Why was the successful supplier selected?
• Were the evaluation criteria applied consistently?
• Were specifications changed?
• Were there unusual communications or approvals?
• Did the successful supplier have any apparent relationship with employees or decision-makers?

Reperforming a procurement decision from the underlying documentation can reveal inconsistencies that may not be obvious from the final approval.

4. Examine Supplier Relationships

Supplier relationships can sometimes reveal risks that transaction-level testing misses.

Compare Supplier and Employee Information

Where legally and appropriately available, compare supplier records against employee information.

Potential matches may include:

• Names
• Addresses
• Telephone numbers
• Email addresses
• Bank-account information
• Other identifying information

A match does not prove a conflict of interest or fraud.

It indicates that the relationship should be understood and appropriately disclosed.

Learning how to detect financial fraud also means being cautious when emails, messages or websites request financial information or urgent payments.

Review Unusual Supplier Addresses

Analyze supplier addresses for unusual patterns.

Examples include:

• Residential addresses where a commercial operation would normally be expected
• Multiple suppliers using the same address
• Supplier addresses matching employee addresses
• Unusual geographic locations
• Incomplete or inconsistent contact information

Again, there may be legitimate explanations. The objective is to identify relationships that warrant further verification.

Examine Dormant Suppliers Becoming Active

Identify suppliers that were inactive for a significant period and then suddenly became active again.

Review:

• Who reactivated the supplier?
• What transactions followed?
• Which employees were involved?
• Was competitive procurement followed?
• Were supplier details changed before activity resumed?

A previously dormant supplier account may be legitimate, but unusual reactivation patterns can be worth investigating.

5. Look for Unusual Invoice Patterns

Invoice data can provide useful fraud indicators.

Round-Number Invoices

Identify invoices with unusually large round amounts, such as:

• 10,000
• 50,000
• 100,000
• 500,000

The significance depends on the organization and industry.

Ask whether the amount is reasonable for the type of goods or services supplied.

Round numbers are not inherently suspicious, but repeated unusual round-sum transactions can justify additional review.

Sequential Invoice Patterns

Review supplier invoice numbers where the information is available.

Unusual patterns may include:

• Very low invoice numbers from a supposedly established supplier
• Highly sequential invoices submitted over an extended period
• Similar invoice numbers across supposedly unrelated transactions
• Duplicate or near-duplicate invoice references

The purpose is to understand whether the invoice sequence is consistent with the supplier’s normal business activity.

6. Review Invoice Quality and Supporting Information

A focused manual review can be surprisingly effective.

Select invoices using risk-based criteria and examine whether they contain sufficient information to establish that the transaction is genuine.

Pay particular attention to invoices that:

• Have incomplete contact information
• Use unusual or residential-looking addresses
• Contain vague descriptions
• Appear manually altered
• Use inconsistent formatting
• Look unusually similar to invoices from other suppliers
• Contain unexplained corrections
• Lack expected supporting documentation
• Show unusual delivery arrangements

A weak invoice does not necessarily mean that a fraudulent transaction occurred.

It means the transaction may require additional verification.

7. Review Manual and Exceptional Payments

Automated payment systems generally provide stronger controls and audit trails than exceptional manual processes.

Therefore, identify payments that were processed outside normal automated procedures.

Examples include payments described as:

• Urgent
• Exceptional
• Manual
• Emergency
• Special handling
• Alternative payment instructions

Then examine:

• Who requested the payment?
• Who approved it?
• Why was normal processing not used?
• Were supporting documents complete?
• Were bank details changed?
• Was the supplier independently verified?

The greater the departure from normal procedure, the more important it is to understand why the exception occurred.

8. Analyze Vendor Concentration

Another useful test is to examine how purchasing is distributed among suppliers.

Look for situations where:

• One supplier receives an unusually large share of business
• A supplier’s activity increases rapidly
• Several suppliers appear to compete but are connected through common information
• Certain suppliers repeatedly win contracts
• Other suppliers regularly submit bids but never win

A concentration of business may have a perfectly legitimate explanation, such as better pricing, specialized expertise or geographic advantages.

The purpose of the test is to determine whether the pattern is consistent with the organization’s procurement strategy.

9. Review Suppliers That Stop Participating

A useful but often overlooked test is to examine suppliers that previously participated in competitive tenders but later stopped submitting bids.

Where appropriate, ask:

Why did they stop competing?

Possible explanations could include:

• Pricing became uncompetitive
• The supplier changed its business
• Contract terms became unattractive
• The supplier experienced repeated unsuccessful bids
• The procurement process became difficult or costly

Understanding the reason can provide useful information about the procurement environment.

10. Look for Potentially Coordinated Bidding

Competitive procurement can be affected by arrangements between bidders.

Potential indicators may include:

• Repeatedly similar bid amounts
• Suppliers taking turns winning contracts
• Identical formatting or unusual similarities in tender documents
• Similar errors across supposedly independent bids
• Suppliers sharing contact details or addresses
• One supplier consistently submitting bids that are significantly higher than the eventual winner

These indicators require careful analysis.

They should not be treated as proof of collusion without appropriate investigation.

11. Use Data Analytics to Find Patterns

Modern audit and financial systems can make fraud testing significantly more efficient.

Depending on the organization’s systems and available data, analysts can test for:

• Duplicate payments
• Duplicate invoice numbers
• Sequential invoices
• Round-sum transactions
• Transactions just below approval limits
• Weekend or holiday transactions
• Unusual payment times
• Rapid supplier activity changes
• Multiple suppliers sharing contact information
• Repeated transactions involving the same employees
• Unusual changes to supplier bank details

The advantage of data analytics is that it can examine the entire population of transactions, rather than relying only on a small sample.

12. Investigate the Exception, Not Just the Transaction

The objective of fraud testing is not to produce a long list of suspicious transactions. One practical way to understand how to detect financial fraud is to look for unusual transaction patterns rather than relying on a single suspicious transaction.

It is to identify meaningful exceptions and understand them.

For every significant exception, ask:

1. What happened?
2. Why did it happen?
3. Who initiated it?
4. Who approved it?
5. Is there supporting evidence?
6. Is the explanation consistent with the records?
7. Does the same pattern occur elsewhere?
8. Is there a legitimate business reason?

The answers may eliminate the concern or may identify a need for deeper investigation.

Fraud Indicators Are Not Proof

This distinction is extremely important.

A transaction can have several warning signs and still be completely legitimate.

For example:

A supplier may use a residential address because it operates from a home office.

A purchase may be just below an approval threshold because that happens to be the actual cost.

A year-end expenditure spike may occur because a legitimate project was completed during that period.

Therefore, fraud testing should identify exceptions and risk indicators, not automatically label people or transactions as fraudulent.

The appropriate response is evidence-based investigation.

Investigate Carefully

Fraud investigations can create significant organizational, legal and reputational risks if handled poorly.

When a potentially serious issue is identified:

• Preserve relevant records
• Restrict unnecessary access to sensitive information
• Maintain confidentiality
• Document the investigation
• Avoid premature conclusions
• Follow the organization’s investigation procedures
• Involve appropriate legal, compliance, audit or investigative specialists where necessary

A poorly handled investigation can compromise evidence, alert subjects unnecessarily or create additional organizational problems.

The goal should be to establish facts objectively.

Build Fraud Testing Into the Control Environment

Fraud detection should not be treated as a one-time exercise.

Organizations can incorporate recurring tests into their broader fraud-risk management program.

For example:

Monthly

• Duplicate payment testing
• Approval-limit testing
• Supplier master-file changes

Quarterly

• Procurement analytics
• Vendor concentration analysis
• Budget variance testing

Annually

• Fraud-risk assessment
• Review of high-risk processes
• Targeted forensic testing
• Evaluation of fraud controls

The exact frequency should depend on the organization’s size, risk profile, transaction volume and control environment.

Practical Fraud Detection Checklist

When reviewing purchasing and payment activity, consider whether you have tested for:

• Transactions just below approval thresholds
• Possible invoice splitting
• Significant budget overruns
• Unusual year-end spending
• Dormant suppliers becoming active
• Supplier and employee data matches
• Unusual supplier addresses
• Round-number invoices
• Sequential or unusual invoice numbers
• Duplicate payments
• Manual or exceptional payments
• Unusual changes to supplier bank details
• Repeated procurement winners
• Suppliers that suddenly stop bidding
• Similarities between competing bids
• Unusual or incomplete invoices
• Significant changes to contracts or specifications

The list should be adapted to the organization’s particular risks.

Final Thoughts

Fraud detection is not about finding one transaction that “looks wrong.”

It is about identifying patterns, understanding exceptions and asking better questions. Ultimately, knowing how to detect financial fraud requires a combination of awareness, careful verification and attention to unusual financial activity.

The most effective approach combines:

Good internal controls + targeted testing + data analysis + professional skepticism + careful investigation.

Random testing still has a role in auditing, but organizations can often identify more meaningful fraud indicators by analyzing the full transaction population and targeting areas where fraudsters may have incentives to exploit control weaknesses.

Most importantly, a red flag is a starting point for investigation — not a conclusion.

This article is for general educational purposes and does not constitute legal, audit or professional investigative advice.