Internal Control Tip: Managing Your Vendor List

The reason districts have internal controls is to address the “What Could Go Wrong?” question. In 2017, a fraudster stole $4 million from a Texas school district and was able to conceal his fraud by creating a vendor that had a slight spelling variation as to not draw attention. Nathen Mueller also defrauded ING of several millions of dollars after creating a fictitious vendor that was similar in name to a legitimate ING vendor. These stories are unfortunate but they do encourage entities to evaluate their processes and controls.

Segregation of duties becomes a critical internal control when creating new vendors or editing existing vendor information in the financial software. That is, the person(s) with the ability to pay vendors should not have the ability to create new vendors or edit existing vendor information. We all know that in smaller districts with limited finance personnel, segregation of duties becomes a challenge. As such, preventative controls are a bit more difficult to implement but should be implemented, nonetheless. Periodically, either the superintendent or someone not involved in the accounts payable process should ensure that there is proper vendor documentation such as a vendor profile and a Form W-9. In addition, the superintendent can be more involved in the review of vendor payments when the district’s size limits the ability to segregate duties properly

As time passes, a district’s vendor list can become quite cluttered with duplicates, spelling variations and/or inactive vendors. The vendor list should be reviewed at least once a year so that the vendors can be inactivated and the ability to create fraudulent transactions minimized. Again, for smaller districts, someone other than those that have the ability to pay vendors should perform the review. Microsoft Excel, provides an excellent, free add-in called Fuzzy Lookup. This tool will allow you to identify duplicate vendors much easier without having to spend money on other costly tools. This article provides some information about the add-in

Most importantly, before funds are disbursed to vendors, someone that does not have the ability to pay vendors should review the disbursement listing. When the Board of Trustees/Directors become part of the entity-level controls because of the limited number of finance personnel, it is important that the board with disbursement information on a timely basis. Instead of exporting the payment information to Excel,  the board should be provided a report directly from the financial software so that there is no question that the data has been manipulated.

It is important to remember that once someone believes internal controls are weak, they exploit that weakness. The Texas school district fraud mentioned above is a perfect example: the perpetrator(s) knew they had unchecked authority over the district’s finances and millions were lost as a result.


Whitley Penn contributes to the TASBO Internal Control Tips at

Contact Us

To contact Whitley Penn with any questions or for more information, please fill out the form.

  • All Fields Required
  • This field is for validation purposes and should be left unchanged.