Procurement and Fraud Detection Quiz

You analyze 9 months of procurement and see a spike of invoices at Rp9,900,000—just under a Rp10,000,000 approval limit—concentrated in two requesters and one vendor. What is the most effective next step?

• Run Benford’s Law on all invoice amounts

• Pull approval logs and test for split-purchases within 7 days by the same requester/vendor, then escalate exceptions for document review

• Interview the vendor first

• Recalculate budget variances by cost center

You plan a Benford test on 12,000 invoice amounts across three vendors. Two vendors use rate cards with fixed prices; one is market-priced. Which is the best approach?

• Benford on all 12,000 amounts

• Benford only on the market-priced vendor; exclude fixed-price vendors

• Benford on invoice IDs to increase sample size

• Skip Benford and do round-number testing only

Your AP data shows many payments of Rp4,995,000 and Rp5,005,000 to the same vendor within 48 hours. Which analytic best surfaces the issue?

• Linear regression of amount vs. date

• Fuzzy matching with vendor+date window and ±Rp10,000 tolerance on amounts

• Topic modeling on invoice descriptions

• Chi-square on last-digit distribution

Payroll lists 2,412 active employees; building access logs show only ~2,280 unique badge IDs in the last 60 days. HR says 150 are field-based with no badges. What should you test first?

• Benford on net pay

• One-to-many bank account mapping to detect shared accounts across “employees”

• Interview supervisors of all non-badged staff

• Compare PTO balances to payroll amounts

Quarter-end shows a surge in “Equipment Improvements” (CapEx). Vouching finds routine repairs capitalized. Which statement is most accurate?

• Risk is understatement of assets; test for impairment

• Risk is overstatement of assets and income; test additions against capitalization criteria and useful life

• No issue if items exceed the monetary threshold

• Focus on revenue cut-off, not expenses

A D2C firm books revenue on shipment; returns window is 10 days. Quarter-end spikes in shipments; post-quarter returns also spike. Best targeted test?

• First-digit Benford on invoice amounts

• Cut-off testing: shipments near quarter-end vs. proof of delivery + adequacy of returns reserve

• Vendor master file review

• Duplicate invoice check

AP receives a WhatsApp voice note sounding like the CFO ordering a Rp12B urgent transfer to a new beneficiary. Most appropriate immediate action?

• Process the payment but keep the receipt as evidence

• Reply to the same chat asking for written confirmation

• Halt the payment, perform out-of-band callback using a whitelisted number, and preserve the message for IR

• Inform the vendor to expect a delay

EDR alerts show encryption on three servers and outbound traffic to an unknown IP over the last 36 hours. A threat group claims to have “1.5 TB of customer data.” What should incident response prioritize first?

• Public statement assuring no data was stolen

• Network containment (isolate affected hosts/segments), preserve volatile/log data, then start scoping exfiltration

• Immediate full system wipe and rebuild

• Notify all customers before understanding scope

You have 1,000 procurement emails + 3,500 invoice descriptions. You suspect collusion (e.g., “split”, “urgent approval”, “use template 3”). Best low-lift analytic combo?

• Benford on word counts + PCA

• Red-flag dictionary → term frequencies with Z/MAD outlier ranking + co-occurrence network of terms/senders

• Forecasting email volume with ARIMA

• Sentiment analysis only