Most organizations do not lose money because of procurement fraud. They lose it because of relationships they cannot see.
The invoice is approved. The vendor is empaneled. The three quotes are in the file. Every box is ticked — until one day, they are not. And when the truth surfaces, it is rarely a single rogue transaction. It is a structure: a quiet, patient arrangement of employees, vendors, and paper entities built not to break controls, but to live comfortably inside them.
That is exactly why it survives audit after audit.
When Fraud Stops Being an Event and Becomes a System
For years we treated procurement fraud as a control failure — something a tighter approval matrix or better documentation could fix. In my experience, the most damaging schemes today are not failures of control at all. They are failures of visibility.
Consider what surfaces in investigations. In one recent matter pursued by an economic-offences agency, a company insider had quietly set up multiple firms in the names of himself and his relatives, bought materials cheaply, and resold them to his own employer at markups of 100% to 500% — close to ₹2 crore siphoned over three years, one clean invoice at a time. No control was broken. Every purchase looked ordinary in isolation. Collectively, they formed a system that redirected value.
That is the pattern. Built incrementally. Embedded in standard process. Reinforced by familiarity and trust. These schemes do not disrupt operations — they replicate them.
The Nexus: Where Employees, Vendors, and Shell Entities Meet
Strip away the specifics and the same three-part structure appears repeatedly:
- An insider with decision-making influence
- A vendor positioned to benefit from that influence
- One or more entities that obscure or redistribute the value
The entities do the quiet work. They put distance between the decision and the person who benefits, they fragment ownership so no single name jumps out, and they manufacture complexity where clarity should exist. The question that should keep an audit committee awake is not “Was this invoice valid?” It is “Who is really standing behind this vendor?”
India’s most instructive cases sit precisely on this fault line. A leading hospital chain saw several hundred crores allegedly routed to promoter-linked entities related parties dressed as arm’s-length counterparties. A large housing-finance company collapsed after tens of thousands of crores were allegedly diverted through a web of shell entities. A major infrastructure conglomerate ran circular fund transfers between group entities to mask its true position. Different sectors, same architecture: concealed relationships, layered ownership, commercial legitimacy preserved on the surface.
How Controls Get Bypassed — Without Being Broken
The best schemes do not violate the control environment. They routearound it:
- Transactions are structured to stay just under approval thresholds
- Documentation is complete — requisition, three quotes, goods-receipt note, and invoice, all present
- Vendors look entirely legitimate on paper
- Approvals are formally correct at every step
A forensic review of a government department captured this perfectly: crores paid to “vendors” that turned out to be fake. What gave them away was not a missing signature — it was several vendors sharing the same bank Indian Financial System Code (IFSC) code and contact details, payments split just below approval limits, and a single employee who had created and approved every entry. The controls existed. They simply were not designed to see relationships.
What This Actually Looks Like on the Ground
- Vendors that appear independent but share directors, addresses, or phone numbers
- Intermediaries that add no real value but quietly capture margin
- Legitimate companies with undisclosed ownership links to insiders
- Dormant entities that suddenly become active around a large contract
- Spend that concentrates, over time, around one or two individuals
- Pricing that is always “reasonable” — never questioned, never competed
None of these are obvious violations. They are relationship failures in disguise. The sophistication lies not in the execution of any single transaction, but in the architecture of the network.
Why It Goes Undetected for So Long
Because most detection is still built for a different problem:
- Over-reliance on document-based due diligence (paper is easy to perfect)
- Data fragmented across procurement, human resources (HR) and finance, so no one connects a vendor’s bank account to an employee’s
- Conflict-of-interest declarations collected once, at onboarding, then forgotten
- Audits that test transactions, not the relationships influencing them
- A culture that reads “long-standing vendor” as “trusted vendor”
The Regulatory Ground Is Already Shifting
This is not only an internal-audit concern anymore, the regulators have moved. In February 2025, the Securities and Exchange Board of India, working with the Industry Standards Forum, mandated a standardized minimum-information format that audit committees and shareholders must receive before approving any related-party transaction, explicitly to close the information asymmetry that let opaque related-party dealings slip through. Its enforcement posture has hardened in parallel: In a recent housing-finance matter it penalized multiple entities and individuals, reading the purpose and effect of transactions rather than just their form.
On the corporate-registry side, the Ministry of Corporate Affairs and the Registrar of Companies have intensified their shell-company drive — striking off well over a lakh non-compliant firms and now using an analytics-driven, rule-based system on the MCA-21 platform, integrated with the securities regulator, the Income Tax Department and the Enforcement Directorate, to flag entities with nil activity, no real registered office, or suspicious fund movement. The direction of travel is clear: Relationship transparency is becoming a compliance expectation, not a best practice.
The Audit Committee’s Missed Opportunity
Audit committees often stay control-focused and backward-looking, confirming that controls exist rather than asking whether those controls can even see network-based fraud. The shift required is simple to state and hard to practice:
From “Are our controls working?” to “Are we seeing the full picture?”
Concretely, that means challenging vendor concentration and ownership clarity, demanding cross-functional data integration, and commissioning relationship-based reviews rather than another sample of invoices.
The Internal Audit Gap — And the Opportunity
The gap is familiar: sample-based testing, transaction-level focus, siloed reviews of procurement, and HR and finance in isolation.
The opportunity is a genuine capability shift — moving to network-based detection. Use analytics to surface hidden links across vendor, employee, and finance masters (common addresses, bank accounts, phone numbers, and directorships). Focus on patterns, not exceptions. This is not an incremental upgrade to the audit plan; it is a change in what audit is able to detect at all.
What Can Organizations Do Differently?
- Look past documentation to the relationships behind it
- Connect procurement, HR, and finance data into one lens
- Treat conflict-of-interest management as continuous, not an onboarding formality
- Be suspicious of patterns that look too smooth — the vendor that is never late, never disputed, and never competed
- Deploying analytics to map connections humans cannot see across siloed systems
- Reward informed skepticism instead of penalizing it
A Final Thought
Procurement fraud has not disappeared. It has evolved — into systems that appear to function flawlessly precisely because they were designed to.
The challenge is no longer faster reaction. It is clearer visibility.
The most significant risks today are not the ones that break the system. They are the ones that operate seamlessly within it.
How Ankura Can Help
Uncovering the nexus between vendors, employees, and shell entities takes more than another report. At Ankura, we help organizations move from transaction-level testing to relationship-level insight — supporting internal audit and audit committees in adopting network-based detection to surface these structures earlier and prevent them sustainably.
- Expert-Led, Not a Checklist
Former investigators, forensic accountants, and data scientists lead the work, directly combining forensic accounting, digital forensics, field intelligence, and analytics to piece together relationships hidden across data, documents, and people. Findings are built to withstand scrutiny, from the audit committee to the regulator. - Curated and Right-Sized
We calibrate scope, depth, and cost to your size, sector, and maturity — focused high-impact reviews for lean teams, or enterprise-wide analytics and continuous monitoring at scale. The rigor stays constant; the footprint flexes. - AI That Lifts Efficiency and Accuracy
Our investment in AI-enabled review is not only about speed. We test the full population rather than a sample — compressing weeks of review into days, while entity-resolution catches shared addresses, bank accounts, and directorships across siloed systems. The result: fewer missed findings, fewer false positives. Proven with clients and global teams, not a pilot. - Practical and Implementable
A finding that ends at “you have a problem” helps no one. We deliver specific, prioritized actions, embed monitoring into existing systems, and upskill your teams to sustain network-based detection — capability transfer, not dependency.
Expert judgement, right-sized to you, powered by AI that is both faster and sharper — and always built to be put to work.
Whether you want a focused review of a high-risk area or a broader shift to network-based detection, we would welcome the chance to discuss where your exposure is most likely to sit and how quickly it can be brought into view.
© Copyright 2026. The views expressed herein are those of the author(s) and not necessarily the views of Ankura Consulting Group, LLC, its management, its subsidiaries, its affiliates, or its other professionals. Ankura is not a law firm and cannot provide legal advice.
