A procurement audit checks that the organisation buys what it needs, at a fair price, from suppliers chosen openly, and that nobody gained improperly along the way. The main red flags are purchases split to stay under approval limits, bids that look too similar, repeated single-source awards, and links between buyers and suppliers.
Last reviewed: 17 October 2026. Facts checked. We searched for common procurement red flags and tests. The results came from forensic consultancies, an anti-corruption resource and a UK public-sector risk matrix. They agree on the main red flags, and they warn that collusion often leaves little evidence. We did not open any Indian government procurement rules or your own policy. We give no approval limits, thresholds or percentages because they are set by each organisation. Check your own policy.
Why procurement is a fraud and error hotspot
Buying decisions involve money, discretion and relationships. A buyer can favour a friendly supplier, a supplier can bribe, bidders can agree among themselves, and honest mistakes can cost real money. Audit scope should cover the whole cycle, not only the payment.
Scope: the cycle
- Need and specification
- Choice of method (open tender, limited quotation, direct award)
- Bid invitation and evaluation
- Award and contract
- Receipt of goods or service
- Invoice, approval and payment
Our key controls for procure-to-pay gives control examples for the back end of this cycle.
Red flags by stage
| Stage | Red flag | Why it matters |
|---|---|---|
| Specification | Wording that only one supplier can meet | May be steering the award |
| Method | Repeated single-source or direct awards, with weak justification | Competition avoided |
| Splitting | Related purchases from one supplier, each just under an approval or tender limit | Limits evaded |
| Bids | Bids very close together, too consistent, or oddly far apart | Possible collusion or cover bids |
| Bidders | Shared addresses, phone numbers, directors or staff among bidders | Bidders may not be independent |
| Evaluation | Winning price far above estimates or similar past jobs | Possible rigging |
| Aftermath | Losing bidders appear later as the winner's subcontractors | Possible bid rigging pay-off |
| People | Buyer shows unusual loyalty to one supplier or lifestyle beyond known means | Possible conflict of interest |
| Contract | Low bid followed by many price-raising change orders | Low-ball then recover |
A red flag is a reason to look, not proof. Collusion can leave almost no paper trail, so one flag alone is rarely enough.
Tests you can run
Split purchases
Sort purchases by supplier and date. Look for groups of invoices to one supplier within a short time, each below the limit but together above it. Compare amounts to the approval and tender thresholds in your policy.
Single-source awards
List contracts awarded after one bid or by direct award. Read the written justification for each. Ask whether one bidder was realistic for that market.
Supplier and employee links
Match the supplier master with the employee master on bank account, address, phone number and tax registration. A match is not proof, but it needs an explanation. Check that conflict-of-interest declarations exist and are current.
Bid analysis
For tenders, line up the bids. Check whether the winning bid is out of line with the estimate. Check bidders' registered addresses and directors if records are available. Check whether late or changed bids were accepted.
Price and quantity
Compare the price paid with earlier purchases, market quotes or the contract rate. Compare quantities ordered, received and invoiced (a three-way match).
Payments
Test for duplicate invoices, round amounts and payments to new suppliers soon after set-up. The duplicate payment test kit can help. Our article on vendor fraud detection goes further on pattern matching.
Vendor master
Review how suppliers are created and changed. Is a second person involved? Are inactive suppliers blocked? Who can change bank details?
Sample audit programme
| Step | Test | Evidence |
|---|---|---|
| 1 | Obtain policy, limits and delegations | Approved policy |
| 2 | Obtain purchase and payment data for the period | System extract, agreed to the ledger |
| 3 | Run split, duplicate and link tests | Exception list |
| 4 | Select tenders and trace the full file | Tender file |
| 5 | Review single-source justifications | Approvals |
| 6 | Interview procurement staff and, if suitable, unsuccessful bidders | Notes |
| 7 | Report and agree actions | Draft report |
Agree the data extract to the ledger first. If the data is incomplete, every later test is weak.
What good looks like
Clear thresholds, competition by default, a documented reason for exceptions, rotation of buyers where possible, conflict-of-interest declarations, an independent check on new suppliers, and a way for staff and suppliers to report concerns safely.
Frequently Asked Questions
What is the most common procurement red flag?
Splitting is one of the most commonly listed, along with single-source awards and conflicts of interest. Frequency varies, and we do not quote a figure.
Can data analytics prove fraud?
No. It finds patterns worth investigating. Proof needs documents, interviews and sometimes a specialist. See our forensic audit guide.
Who should audit tenders for a large project?
The internal auditor with technical help where needed. For capital works, see our capital project audit guide.
What if a supplier is the only one able to supply?
That can be valid. The test is whether the reason was written down, reviewed and genuinely tested before the award.
Do the tests change for small businesses?
The ideas stay the same. The scale is smaller, so you may test the full population of purchases instead of a sample.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error