Frauditing the Procure-to-Pay Process: Are Arizona School Districts Doing Enough to Protect Taxpayer Money?
How School District Superintendents, CFOs, Governing Boards, and Audit Committees Should Prevent Procurement Fraud, Vendor Abuse, and Management Override
John C. Blackshire, Jr. - The Accountware Group (TAG) | Public School Governance, Internal Controls, Financial Accountability, and Fraud Prevention
Every year, Arizona's public school districts spend hundreds of millions of taxpayer dollars purchasing goods and services.
These expenditures include instructional materials, technology, transportation, school construction, facility maintenance, consulting services, professional services, food services, insurance, and administrative support.
For a large district such as Tucson Unified School District (TUSD), procurement represents a substantial financial activity involving thousands of transactions and numerous vendors.
But how does a school district know that every payment is legitimate?
How does the Governing Board know that vendors are properly selected, contracts are competitively awarded when required, goods and services are actually received, and invoices are accurate?
Who ensures that district employees and administrators do not direct business to friends, relatives, or companies in which they have undisclosed financial interests?
And who determines whether senior management can bypass established purchasing controls?
These questions go beyond routine accounting.
They concern the effectiveness of the district's internal control framework and the responsibility of management to safeguard public resources.
Traditional procurement auditing asks whether employees followed purchasing procedures. Frauditing asks whether someone could intentionally manipulate or circumvent those procedures to misuse taxpayer funds.
Frauditing is a fraud-focused auditing approach that combines internal control evaluation, data analytics, professional skepticism, and an understanding of how fraud schemes operate.
For Arizona school districts, it can provide a valuable method of identifying financial risks that ordinary compliance testing may overlook.
1. Why School District Procurement Requires Stronger Oversight
Public school districts operate differently from private companies.
Their revenues come largely from public funding sources, including state allocations, local property taxes, federal grants, and other restricted revenues.
Their expenditures must comply with applicable laws, procurement requirements, grant conditions, adopted budgets, and district policies.
The public expects these funds to be spent for authorized educational purposes.
Unlike private companies, school districts are accountable not only to management and investors but also to taxpayers, parents, students, elected Governing Boards, and regulatory authorities.
The financial consequences of weak procurement controls can include:
Payments for goods or services never received.
Excessive prices resulting from ineffective competition.
Contracts awarded to vendors with undisclosed relationships.
Duplicate or unauthorized payments.
Fraudulent changes to vendor banking information.
Improper use of restricted funds.
Purchasing transactions designed to circumvent approval thresholds.
Management override of established procurement requirements.
Each of these risks can reduce the resources available for classroom instruction.
For districts already facing declining enrollment, budget deficits, or financial reserve pressures, preventing waste and fraud becomes especially important.
2. What Is Frauditing, and Why Should School Districts Use It?
Frauditing is not a separate set of professional auditing standards.
It is a practical approach that emphasizes fraud risk assessment and procedures designed to identify intentional misconduct.
A traditional school district procurement audit might determine whether purchase orders were approved, invoices were processed correctly, and payments complied with purchasing policies.
A fraud-focused audit goes further.
It asks whether employees could create fictitious vendors, split purchases to avoid bidding requirements, approve payments for services never delivered, or collude with outside vendors.
It also asks whether senior administrators can override purchasing controls without independent review.
Consider a district that requires three competitive quotations for purchases exceeding a specified threshold.
A traditional audit might examine whether the required quotations were included in the purchasing file.
A frauditing engagement would ask additional questions.
Were the quotations obtained from independent vendors?
Were any vendors controlled by the same individuals?
Was the winning vendor selected before the quotations were requested?
Were the quotations genuine?
Did a district employee have an undisclosed relationship with the selected vendor?
The presence of paperwork does not establish that a transaction was legitimate.
This distinction is particularly important when the individuals responsible for approving transactions also influence the documentation supporting those approvals.
3. Arizona School District Procurement Requirements
Arizona school districts are subject to a combination of statutory procurement requirements, administrative rules, and district-specific policies.
Relevant requirements include Arizona Revised Statutes Title 15 and the Arizona Administrative Code provisions governing school district procurement.
The Arizona Auditor General also maintains the Uniform System of Financial Records for Arizona School Districts (USFR), which establishes accounting and financial control requirements.
School district procurement procedures should address competitive purchasing, contract administration, vendor selection, authorization, documentation, and payment processing.
Requirements vary according to the type and value of the purchase, the applicable procurement method, and any relevant statutory exceptions.
For federally funded purchases, additional federal procurement and grant requirements may apply.
A district's internal controls should ensure that employees understand which requirements govern each transaction.
A critical governance principle
Compliance with procurement rules is not merely the responsibility of the purchasing department.
The Superintendent and CFO are part of management and are responsible for establishing and maintaining effective internal controls within their assigned authority.
The Governing Board provides oversight and approves matters reserved to it by law or policy.
Internal Audit, where established, independently evaluates the effectiveness of the district's controls.
These responsibilities should remain clearly separated.
4. Fraud Scheme One: Fictitious School District Vendors
One of the most direct procurement fraud schemes involves creating a vendor that does not represent a legitimate business relationship.
A district employee with inappropriate system access could create a vendor, submit fictitious invoices, and arrange payments to an account controlled by the employee or an accomplice.
The transactions might be disguised as classroom supplies, consulting services, technology support, or facility maintenance.
What controls should exist?
School districts should require independent approval of new vendors.
Vendor information should be authenticated before the vendor is activated.
The employee who creates a vendor should not also possess unrestricted authority to approve invoices and release payments.
Changes to vendor master file information should be logged and independently reviewed.
What should Internal Audit test?
Internal Audit should examine vendors created during the audit period and identify those receiving payments shortly after activation.
Auditors should also compare vendor addresses, contact information, and banking details with other vendor records and, where lawful and appropriate, employee information.
The objective is to identify unusual relationships requiring additional investigation.
A matching address or banking detail does not, by itself, establish fraud.
5. Fraud Scheme Two: Splitting Purchases to Avoid Competitive Procurement
School districts frequently use purchasing thresholds to determine the level of competition and authorization required.
A dishonest employee or administrator may attempt to circumvent those requirements by dividing a larger purchase into several smaller transactions.
For example, suppose a hypothetical district requires additional competitive procurement procedures above a $25,000 threshold.
Instead of processing a $60,000 purchase through the required process, an employee arranges three purchases of $20,000.
Each transaction may appear acceptable when reviewed individually.
However, the combined activity may represent an intentional attempt to avoid the required procurement process.
The $25,000 figure is illustrative, not a statement of Arizona's current procurement threshold.
Frauditing procedures
Internal Audit should analyze purchases by vendor, requesting department, date, purchasing employee, and contract.
Transactions just below applicable approval or bidding thresholds deserve additional attention.
Auditors should also examine multiple purchases for similar goods or services during short periods.
The key question is whether the transactions represent legitimate separate purchases or an improper division of a larger procurement.
6. Fraud Scheme Three: Consulting Contracts and Professional Services
School districts frequently engage consultants for educational programs, organizational restructuring, school facilities, technology, legal services, financial management, and other specialized activities.
Consulting contracts can present significant fraud and waste risks because services are sometimes difficult to measure.
A vendor may submit an invoice describing services without providing meaningful evidence of the work performed.
A manager may approve payment based on a general statement that services were delivered.
What should district management require?
Every consulting engagement should have an appropriate written agreement identifying the scope of services, deliverables, compensation terms, and responsible district manager.
Management should verify that contracted services were delivered before authorizing payment.
Where appropriate, invoices should be supported by deliverables, project records, work products, or other evidence of performance.
What should Internal Audit examine?
Auditors should select consulting payments and determine whether the district received the services for which it paid.
For example, if a consultant was engaged to prepare a school facility utilization study, the district should be able to identify the study, supporting analysis, or other contracted deliverables.
Approving an invoice is not the same as verifying that the district received value for the expenditure.
7. Fraud Scheme Four: Conflicts of Interest and Related-Party Vendors
School districts may face conflicts of interest when employees, administrators, or Governing
Board members have personal or financial relationships with vendors.
Such relationships can create opportunities for favoritism, excessive pricing, or improper contract awards.
Arizona has conflict-of-interest requirements applicable to public officers and employees, including provisions in A.R.S. §§ 38-501 through 38-511.
Applicable procurement rules and district policies may impose additional restrictions.
The district should maintain procedures for identifying, documenting, and addressing potential conflicts.
Questions the Governing Board should ask
Are employees required to disclose relevant financial interests?
Are vendor relationships reviewed before significant contracts are awarded?
Are required disclosures maintained and accessible to appropriate oversight personnel?
Do individuals with substantial interests refrain from participating in decisions when required by law?
Are potential conflicts involving senior management independently reviewed?
The district should not assume that a transaction is appropriate simply because the individual involved has a senior position.
8. Fraud Scheme Five: Vendor Banking Changes and Payment Diversion
School districts are vulnerable to payment diversion schemes.
A criminal may impersonate a legitimate vendor and request a change in banking information.
If district personnel accept the request without proper authentication, payments may be redirected to a fraudulent account.
This can occur even when the original purchase was legitimate.
Required control considerations
Vendor banking changes should be independently authenticated using trusted contact information established before the change request.
The district should document who requested the change, who verified it, who entered it, and who approved it.
Access to vendor banking records should be restricted.
Management should periodically review changes to vendor payment information.
Frauditing procedures
Auditors should identify banking changes followed by significant payments.
They should determine whether independent verification occurred and whether the change was properly approved.
A payment processed through the district's accounting system is not necessarily legitimate if the vendor's banking information was fraudulently altered.
9. Fraud Scheme Six: Duplicate Payments and Invoice Manipulation
Duplicate payments can result from administrative errors or intentional misconduct.
A vendor may submit the same invoice more than once using slightly different invoice numbers.
An employee may process duplicate invoices and fail to recover the excess payment.
School districts should use system controls and analytical monitoring to identify potential duplicates.
Useful audit tests
Internal Audit can compare invoice numbers, vendor names, amounts, dates, purchase orders, and payment references.
It can also identify payments made to the same vendor for identical amounts within short periods.
For example, invoice numbers 45018, INV45018, and 45018-A may warrant review.
These transactions could represent legitimate separate invoices, data-entry errors, or attempts to obtain duplicate payments.
The auditor must examine the supporting evidence before reaching a conclusion.
10. Fraud Scheme Seven: School Construction and Facility Maintenance
School construction and facility maintenance can involve substantial expenditures.
Projects may include roofing, HVAC systems, electrical work, building renovations, security improvements, and other capital activities.
Fraud risks may arise through inflated change orders, unauthorized subcontractors, unsupported invoices, improper vendor selection, and payments for incomplete work.
What should management monitor?
District management should establish controls over project authorization, competitive procurement, contract changes, inspection, payment approval, and final acceptance.
Change orders should be reviewed to determine whether they are necessary, properly priced, and authorized.
Payments should be supported by evidence that the relevant work was performed.
What should Internal Audit test?
Auditors should examine project budgets, contracts, change orders, invoices, inspection records, and payment histories.
They should identify projects with unusually frequent change orders, significant cost overruns, or repeated exceptions to normal approval procedures.
For major projects, the district may benefit from specialized construction audit expertise.
11. Fraud Scheme Eight: Management Override of Procurement Controls
Management override may be one of the most significant procurement risks in a school district.
A Superintendent, CFO, department executive, or other senior administrator may have substantial influence over purchasing decisions.
That influence can be legitimate when exercised within applicable law and delegated authority.
However, it becomes a control risk when senior management can circumvent procurement requirements without independent oversight.
Examples include directing staff to process payments without adequate documentation, selecting vendors outside required procedures, approving unsupported contract amendments, or bypassing normal payment controls.
Why management override deserves special attention
A purchasing clerk may be subject to several levels of approval.
A senior executive may be able to influence the individuals responsible for those approvals.
If employees believe they must follow executive instructions even when those instructions conflict with policy, the formal control framework may become ineffective.
The strength of a school district's internal controls is demonstrated by whether those controls apply to senior management—not merely to lower-level employees.
Internal Audit should evaluate the district's procedures for documenting, reviewing, and reporting management overrides.
Significant concerns involving senior management should be communicated through an appropriate independent reporting channel, potentially including the Audit Committee or Governing Board.
12. Why Three-Way Matching Is Not Enough
Three-way matching is a common accounts payable control.
It compares the purchase order, receiving documentation, and vendor invoice before payment.
This is an important control.
However, it may not detect collusion or fabricated documentation.
For example, an employee could create a purchase order, arrange for a fictitious receiving confirmation, and submit an invoice through a cooperating vendor.
All three documents might agree.
Yet the district may not have received the goods.
The auditor should therefore examine whether the supporting documentation reflects actual economic activity.
For significant transactions, this may require independent confirmation, inspection, review of deliverables, or other appropriate procedures.
Matching documents is not equivalent to verifying the legitimacy of the underlying transaction.
3. Using Data Analytics to Identify School District Procurement Risks
School districts generate substantial amounts of procurement and payment data.
Modern data analytics can help Internal Audit examine entire populations for selected risk indicators rather than relying exclusively on small samples.
A useful procurement fraud analytics program could include:
Analytical test | Potential risk |
Vendors sharing addresses with employees | Undisclosed relationships |
Vendors created shortly before large payments | Fictitious or improperly approved vendors |
Payments just below procurement thresholds | Split purchasing |
Duplicate invoice numbers or amounts | Duplicate payments |
Vendor banking changes before payments | Payment diversion |
Repeated noncompetitive contract awards | Vendor favoritism |
High-value payments without receiving evidence | Unsupported expenditures |
Frequent contract change orders | Cost manipulation or weak project oversight |
Multiple vendors sharing bank accounts | Related vendors or vendor master file problems |
Unusual payments near fiscal year-end | Cutoff, budget, or authorization concerns |
Repeated purchases from a single vendor across departments | Possible aggregation or competition issues |
Payments charged to restricted funding sources | Potential noncompliance with funding restrictions |
The auditor must validate the data and investigate exceptions before drawing conclusions.
These tests identify potential risks, not established fraud.
14. How Artificial Intelligence Can Strengthen School District Frauditing
AI can help school district auditors analyze procurement information, identify unusual transactions, compare policies, and develop fraud-focused audit procedures.
For example, an auditor could ask an approved AI application:
Develop a fraud risk assessment for an Arizona school district's procure-to-pay process. Include vendor onboarding, competitive purchasing, conflicts of interest, receiving, accounts payable, payment processing, and management override. Identify fraud scenarios, preventive controls, detective controls, and proposed audit tests.
Another application might involve analyzing purchasing transactions for unusual vendor concentrations or repeated transactions near approval thresholds.
AI can also help compare district purchasing policies with applicable procurement requirements.
However, AI-generated interpretations of Arizona law must be verified against authoritative sources.
Districts must protect confidential employee, student, vendor, banking, and financial information.
AI should be used only within an approved governance and information security framework.
15. Applying the COSO Internal Control Framework to School District Procurement
The COSO Internal Control–Integrated Framework provides a useful foundation for evaluating procurement controls.
Control Environment
Does the Superintendent establish a culture of integrity and accountability?
Are purchasing policies consistently enforced?
Are senior administrators held to the same standards as other employees?
Risk Assessment
Has management identified the principal procurement fraud risks?
Does the assessment consider collusion, vendor relationships, management override, and restricted funding?
Control Activities
Are purchasing responsibilities appropriately segregated?
Are vendor changes authenticated?
Are contracts and payments properly authorized?
Information and Communication
Does management provide the Governing Board with meaningful information about procurement risks and exceptions?
Can employees report suspected misconduct without retaliation?
Monitoring Activities
Does management regularly review procurement exceptions, unusual vendor activity, and corrective actions?
Are significant weaknesses reported to appropriate oversight personnel?
These components should operate together.
An extensive purchasing manual is not evidence of effective internal control if management does not enforce the procedures.
16. The GAO Green Book and Public-Sector Accountability
The U.S. Government Accountability Office's Standards for Internal Control in the Federal Government, commonly called the Green Book, provides an important public-sector internal control framework.
The Green Book emphasizes management responsibility for establishing and maintaining internal control.
Its principles address integrity, oversight, risk assessment, fraud risk, control activities, information, communication, and monitoring.
For school districts, the Green Book provides useful guidance for evaluating whether management has established an effective control environment.
The Green Book is directly applicable to federal agencies; its application to a particular school district depends on applicable laws, grant requirements, and adopted policies.
Nevertheless, its underlying principles are highly relevant to public education.
Fraud risk assessment
Green Book Principle 8 addresses the consideration of fraud risk.
Management should consider the potential for fraud when identifying and analyzing risks to organizational objectives.
A school district that evaluates only accidental purchasing errors may overlook the risk of intentional misconduct.
Fraud risk assessment should therefore be an identifiable part of management's internal control activities.
17. What Is the Superintendent's Responsibility?
The Superintendent is responsible for district administration within the authority established by law and Governing Board policy.
An effective Superintendent should ensure that management has established a procurement control framework appropriate for the district's size and complexity.
That includes policies addressing purchasing authority, competitive procurement, conflicts of interest, contract administration, vendor management, and fraud reporting.
The Superintendent should also require periodic management assessments of procurement risks.
When significant control weaknesses are identified, management should develop corrective action plans and report material concerns to the Governing Board.
The Superintendent should not treat procurement oversight as solely an accounting department responsibility.
Procurement controls are part of district-wide governance.
18. What Is the CFO's Responsibility?
The CFO has a central role in maintaining financial controls over procurement, accounts payable, vendor records, and financial reporting.
The CFO should ensure that appropriate controls exist to prevent unauthorized payments, duplicate payments, improper vendor changes, and inaccurate accounting.
The CFO should also establish monitoring procedures capable of identifying unusual transactions.
For example, management should routinely examine vendor banking changes, duplicate payments, procurement exceptions, and transactions outside normal approval procedures.
These analyses should not depend entirely on Internal Audit.
Management owns the internal control framework. Internal Audit independently evaluates whether the framework is appropriately designed and operating effectively.
A CFO who relies on Internal Audit to discover every procurement control problem is not fulfilling the full preventive and monitoring responsibilities of financial management.
19. What Should the Governing Board Require?
The Governing Board should establish expectations for financial accountability and receive sufficient information to oversee significant procurement risks.
A useful quarterly procurement oversight report could include:
Total procurement expenditures by major category.
Significant contracts awarded during the period.
Noncompetitive procurements and the documented basis for each.
Contract amendments and significant change orders.
Procurement policy exceptions.
Potential conflicts of interest requiring disclosure or action.
Significant vendor master file changes.
Duplicate payment exceptions and recoveries.
Identified control deficiencies and corrective action status.
Significant suspected fraud matters, subject to appropriate confidentiality and legal considerations.
The Board should also ensure that management maintains a reliable process for reporting significant procurement irregularities.
Board members should not be expected to discover control problems by independently searching payment records.
Management should proactively identify and report significant risks.
20. The Role of the School District Audit Committee
An Audit Committee can provide valuable oversight of procurement controls.
The Committee should evaluate whether management has identified the district's significant fraud risks and established appropriate responses.
It should also review Internal Audit's assessment of procurement controls and monitor management's corrective action plans.
Questions every school district Audit Committee should ask
Has management completed a documented procurement fraud risk assessment?
Are vendor master file changes independently reviewed?
Are potential conflicts of interest identified and addressed?
Does management monitor split purchases and procurement threshold exceptions?
Are consulting contracts supported by evidence of delivered services?
Are construction change orders subject to appropriate independent review?
Can senior management override procurement controls without independent oversight?
Does the district analyze payment data for duplicates and unusual patterns?
Are significant procurement deficiencies reported promptly?
Has management established measurable corrective action plans?
The Audit Committee should not operate the procurement process or assume management's control responsibilities.
Its role is to provide independent governance oversight.
21. What Should TUSD and Other Large Arizona School Districts Consider?
Tucson Unified School District provides a useful example of why procurement oversight matters.
As a large public school district, TUSD manages significant expenditures involving facilities, transportation, technology, instructional programs, professional services, and administration.
The complexity of these activities creates numerous opportunities for purchasing errors, inefficiency, conflicts of interest, and fraud.
That does not mean fraud has occurred.
It means that the district should maintain controls appropriate to its size and financial exposure.
A comprehensive fraud-focused procurement review could examine:
Vendor master file integrity: Are all active vendors legitimate and properly approved?
Consulting contracts: Are contracted deliverables documented and verified before payment?
Competitive purchasing: Are transactions structured to comply with applicable procurement requirements?
Conflicts of interest: Are employee and management relationships with vendors appropriately disclosed?
Facilities expenditures: Are construction and maintenance payments supported by actual work performed?
Payment processing: Are vendor banking changes independently authenticated?
Management override: Are exceptions to procurement controls documented and independently reviewed?
Data analytics: Does management routinely identify unusual procurement and payment patterns?
Audit Committee reporting: Are significant procurement risks and control deficiencies communicated proactively?
For a district facing financial pressure, the potential value of strengthening these controls is substantial.
Every dollar lost through fraud, waste, duplicate payment, or ineffective procurement is a dollar unavailable for educational purposes.
22. A Recommended Frauditing Program for Arizona School Districts
The Accountware Group recommends that large Arizona school districts consider implementing a recurring fraud-focused procurement review.
The program should include five major activities.
First: Management fraud risk assessment
The Superintendent and CFO should ensure that management identifies significant procurement fraud risks and evaluates the controls intended to address them.
Second: Vendor master file review
Management should periodically evaluate vendor legitimacy, duplicate records, banking changes, inactive vendors, and unusual vendor relationships.
Third: Transaction analytics
The district should analyze procurement and payment populations for potential duplicate payments, split purchases, unusual approvals, and transactions requiring further review.
Fourth: Independent assurance
Internal Audit should evaluate whether procurement controls are appropriately designed and operating effectively.
The audit plan should address fraud risks, including management override and collusion.
Fifth: Governing Board and Audit Committee reporting
Management should report significant procurement risks, exceptions, and corrective actions through established governance channels.
Internal Audit should independently communicate significant findings and monitor the implementation of agreed corrective actions.
The district should measure whether these activities reduce procurement errors, strengthen compliance, and improve financial accountability.
Conclusion: School District Procurement Controls Must Protect Taxpayers, Not Just Produce Paperwork
Arizona's public school districts are responsible for safeguarding substantial public resources.
The procure-to-pay process is one of the most important areas of financial control because it determines how district money is committed and disbursed.
A procurement system may appear compliant because purchase orders, invoices, receiving reports, and approvals exist.
But documentation alone does not establish that a transaction was legitimate.
Frauditing challenges management and Internal Audit to examine how those documents could be manipulated, how employees might circumvent controls, and whether senior management is subject to meaningful oversight.
For Arizona school districts, an effective procurement fraud prevention program should include strong vendor controls, competitive purchasing safeguards, conflict-of-interest procedures, independent payment verification, transaction analytics, and meaningful management oversight.
The Superintendent and CFO must take ownership of the internal control framework.
The Governing Board must establish clear expectations for accountability.
The Audit Committee should provide independent oversight.
Internal Audit should evaluate the effectiveness of the controls and identify significant weaknesses.
The ultimate test of a school district's procurement system is not whether every payment has an approval signature. It is whether the district can demonstrate that public money was spent for a legitimate purpose, in compliance with applicable requirements, and that the goods or services paid for were actually received.
Taxpayers, parents, and students should expect nothing less.
References and Further Reading
Arizona Auditor General — Uniform System of Financial Records for Arizona School Districts
Arizona Administrative Code — School District Procurement Rules
U.S. Government Accountability Office — Standards for Internal Control in the Federal Government
The Institute of Internal Auditors — Global Internal Audit Standards
The Accountware Group publishes analysis and commentary on public-sector governance, financial management, internal controls, and accountability in public education.
Comments