The internal audit function is auditing the organization’s procurement process.

Data analytics provides the most effective procedure for identifying potential employee-owned vendors because information from the vendor master file can be compared against employee records. Matching vendor addresses, bank accounts, telephone numbers, tax identifiers, or other attributes to employee data may identify undisclosed relationships and suspicious payments. Reviewing approval documentation demonstrates whether payments were authorized but may not reveal that the vendor is owned by an employee. Interviews depend on personnel disclosing relevant information and are less effective for identifying concealed conflicts. Reviewing approval of vendor-master changes evaluates change controls but does not necessarily detect a vendor that was legitimately created while secretly connected to an employee. Therefore, matching vendor payment or master-file information against employee addresses through data analytics is the procedure most likely to identify the specified fraud risk.