Category Archives: Procurement Innovation

Worried about P2P Fraud? – Here’s How To Prevent Most Of It!

Accounts Payable News recently ran a good article on “the top six ways to carry out P2P fraud” that every Supply Management professional should read BEFORE implementing any P2P system. While the sheer presence of a P2P system will discourage fraud, as fraud will be much harder to hide and/or require collusion if the system is properly integrated, it also enables fraud to be conducted faster and at a much larger scale if there are holes in the implementation. But first, let’s look at the frauds identified:

    • Social Engineering
      A user who doesn’t need admin access gets it by convincing IT that it will be quicker if they can create accounts for authorized individuals, or that they need it for testing after hours. If such admin access can be used to create new, fictitious, suppliers with banking information that don’t require payment approvals …
    • Fictitious Invoices for non-PO spend below the bar
      If invoices below a certain threshold, like $1,000, automatically get paid (without a purchase order or, worse, goods receipt match) from preferred suppliers if the line items are on an approved list, then all it takes is collusion between a buyer and supplier to generate and approve a few (dozen) false invoices and both get a free vacation on the Riviera.
    • Reassignment and Undermining of Control
      If a fraudster can convince others to reassign approvals or part of the payment process to himself, then he can approve invoices from fictitious invoices from fake suppliers, which are actually companies, and bank accounts, he controls.
    • Receipt of goods not actually delivered
      If the buyer, who never steps foot in the warehouse or on the construction site, receipts goods never delivered, the buyer can arrange for a supplier to be paid twice if the supplier sends an invoice before the goods, gets paid right away, and then drops off a second invoice with the goods, which is then matched against a PO and receipted. And, of course, the buyer would get a kickback.
    • Approval of unapproved handling costs
      Which were never in the contract, but of which a portion will be kick-backed to the colluding buyer.
    • Supplier Payment Diversion
      A smart buyer will open a bank account in a name that sounds like it is the suppliers name, like MJ Consulting if the supplier is M&J Consulting, provide finance with new banking instructions from a spoofed e-mail account, and collect the payments until AP discovers they have incorrect account information.

If you analyze these types of fraud, you see a couple of commonalities:

      • Fake Data
      • Lack of Control
      • Collusion

It’s very easy with modern technology to prevent the first two and make the third harder, in that more people will have to be in on the fraud for it to succeed. Specifically, if you take the following steps:

      • Lock down access to finance and admin functionality to only those who need it
        and, using fine-grained roles-based security, restrict admin functionality to only those functions admin rights are truly required by the person
      • Require 2nd party verification of all regulatory and financial data associated with a supplier
        as no one should be able to enter and confirm the same data element
      • Only a person performing a function can enter data relating to that function
        as only a warehouse or site worker will know when the goods are/are not delivered
      • Also require 2nd party verification of any data element that can trigger a payment
        So, a goods receipt, as a whole, should be verified by a foreman
      • Absolutely no automatic payments unless ( a) the supplier is verified, ( b) the supplier’s accounts are verified, ( c) the goods were verified as received
      • Absolutely no payment for an invoice above the minimum threshold for non-automatic payment without a PO
        even if verified supplier, account, and receipt of goods
      • Absolutely no payment for an invoice above the threshold for which approval is specified
        without a manager approval, even if there is a PO, verified supplier, account, and receipt of goods
      • Absolutely no P2P/e-Procurement systems that don’t encrypt user access information, account information, and approvals. Otherwise, all an enterprising fraudster has to do is either (a) get onto the server and (a) query the database for an admin login, (b) overwrite the account record with his own bank record or, and this is way too easy in some systems, (c) set the approved for payment flag next to the invoice to true. The approval field should be a system encrypted value that only the system can decrypt to a valid “pay on” date using salts, hashes, and ciphers.

This will solve the fake data issue, as there can be no fake data unless there is collusion, and the lack of control issue, as there will be no way around the workflow unless there is collusion. You can’t solve the collusion issue, but you can certainly discourage it. Criminals tend not to trust each other, and when three or more parties are required to pull off a heist, the odds are much more in your favour.

Robbie and the Coupa Factory

Oompa Loompa Doom-pa-dee-do
We’re still building great products for you!
Oompa Loompa Doom-pa-dah-dee
If you are wise you’ll try it for free.

What do you get when you get lots of cash?
Filling coffers and enlarging the stash?
Teams of developers coding like mad!
Making the app work on your iPad.

You’ll like the look of that!

It’s been a long time since Davie ran the Coupa Factory, and while there may have been a number of notable changes in management, one thing hasn’t changed at Coupa — and that’s the original product direction (and the heart of the development team*). Coupa’s goal is still to make the best P2P platform out there that’s so easy to use that even your grandmother and three-year old can use it and get all your spend under management (SUM).

In terms of progress since our last major review of the platform in 2009, which focussed on QuickStart, there has been a flurry of development — of a very interesting sorts. Having built one of the richest web-based P2P platforms on the market in three short years (with everything capable of being custom configured by an administrative user), Coupa made a very important realization — 90% of P2P is simple, straightforward, and limited in terms of required functionality. Find what you need, put in a requisition, get approval, cut the PO to the vendor, accept delivery, accept the invoice, queue it for verification and approval, issue the goods receipt, and make payment within the agreed upon timeframe when the invoice has been verified and the goods accepted. There’s not a lot of inventory management, logistics, payment structuring, etc. in an average corporate purchase made by an end-user outside of the Supply Management organization.

What there is, in fact, is a lot of bypassing of e-Procurement systems that make the process of getting your printer, paper, or widget for your production line more troublesome than going to the Best Buy website, the Office Depot website, or just calling up the supplier and asking for another shipment. So, if you want widespread adoption, which is the key to maximizing your SUM (Spend Under Management), you have to make it at least as easy to use as Amazon. Whether you’re using vendor catalog, punch-out, cXML, or an in-house catalog, searching, shopping, and requisitioning is seamlessly integrated. And it’s all accessible through their new Super Search Bar that seamlessly integrates Google search for what you need, Amazon browse by category, and free-form item/service search (which also allows product/service retrieval through internal or vendor product/service numbers) which can be global, by commodity, category, or vendor — depending on your configuration. Plus, their new dynamic shopping cart, which integrates accounting and budgeting data (so you know against what budget item a requisition will be charged, how much is left on the budget item, and how much will be left when the requisition is approved the minute you add an item to the cat), allows for split-billing and overrides in the cart in a process that is as easy as Amazon’s “one-click” checkout. And, policies can be linked to each item and service that allow for additional information within a search to be “popped-up” so the user can get full information (which can include budgetary and billing information) before an item is even added to the cart. Supplier taxes can be imported and validated against your own tax tables, fending off future nightmares for finance down the road. And when all is said and done, payments can be recorded and integrated with you ERP (and Coupa now supports out-of-the-box integrations with a couple of dozen major ERP and e-Procurement platforms).

Upon checkout, the system will automatically create the necessary requisitions (which will be sent to each individual who needs to approve an item in your master requisition), and, upon approval, the necessary POs for each vendor will be automatically generated and delivered — and all are easily accessible from your order history page with a single click.

The other big developments since our last major review are their Expense Management Solution, which was still in its infancy, and their new Spend Optimizer Solution, which could more accurately called a 360° Spend Visibility solution (which you can use as a starting point in spend analysis and spend optimization). Their Expense Management application is a great way to get your T&E under control (as iPhone integration allows expense reports to be automatically generated by users who simply have to take a picture of their receipt and import it into the application). They’ve taken usability to a new level with this one.

Spend Optimizer is their mega-dashboard reporting solution that is completely configurable and allows for the creation of just about any spend report you can dream up. Done right, you can have it display off-contract spend; late payments; budget overruns; high-spend categories, commodities, and vendors; and other spend hot-spots that could get you or your organization into hot-water down the road if not proactively managed by exception. It’s still a dashboard (which can be dangerous and dysfunctional), but you have the option to see green, see red, or see where the black holes are. It’s this last capability that makes the real difference between useless reporting tool and powerful spend miner, because, generally speaking, off-contract is where the trouble starts.

And brand-spanking new functionality is lined-up for fourth quarter. Their recent announcement that 9.635 Billion has passed through their platform is impressive, but when they pull off their next round of application development, that will be more so. Coupa is still a company to watch, so don’t take your eyes off them for too long.

Oompa Loompa Doom-pa-dee-do
They’re still building great products for you!
Oompa Loompa Doom-pa-dee-dar
They have the goal to take your spend far.

* Dave and Noah may be gone, but David Williams is still there as VP Technology, overseeing day to day development.

e-Procurement on an ERP – Harder than Fetching Groceries in a Battle Tank

Procurement Insight has been tearing up a storm recently. First, they make it clear that “e” does not change the fundamental nature of anything, then they rip the covers off of Supply Chain Leakage, and now, for the triple play, they tell us that you “don’t take your tank to the mall, Mrs. Worthington”.

In the article, the author, Ian Burdon, described a particularly dispiriting conference where he went to a session on “Re-engineering Government Procurement” where “experts” claimed that the thing to do was to sort out procurement processes then hand it all over to SAP and Oracle. Really? In this situation, I would not have thought about throwing myself out of a high window but, instead, of throwing the experts out of the high window, because anyone who would say such a thing can’t be much of a Procurement expert.

As Ian said, the reason things were often going so badly in government (procurement) despite their having invested in ERPs was precisely because they were using ERPs. ERP stands for Enterprise Resource Planning, not Enterprise Resource Procurement. Failing to even ask what the “P” stood for was the government agency’s first mistake. The next mistake was failing to understand that a “planning” system that told you there would be a need for 5,000 toner cartridges, 10,000 reams of paper, and 500 litres of industrial solvent does not have to tell you how you would go about procuring these items in order to accomplish resource planning. Nor does it have to give you RFX, Auction, or analytics capabilities of any kind as it is not sourcing, nor purchase order management, invoice management, and payment management functionality, as it is not procurement. Trying to use ERP for e-Procurement is like trying to fit a dodecagonal peg in a hexagonal hole. (Good luck with that.)

Just because someone claims to be the Procurement oracle, doesn’t mean that they are. They just might be trying to make a sap out of you. Get an unaffiliated third party to figure out what you need, and get it. Not what a big corporation, or a misguided expert, tells you.

Happy Procurement Independence Day

It’s the 6th anniversary of Procurement Independence Day, first celebrated at the Coupa Cabana Cafe back in 2006.  I hope it was a good one for you!

Coupa is still going strong, as you might have guessed from the flurry of press releases coming out of their doors lately.  Before the summer is over, we will be checking in on Coupa to not only see where the past year has taken them, but, more importantly, where the next year is taking them.  Their pace of development has not relented, and they have even more cool stuff coming down the pipe later this year. 
We will review some of the forthcoming capabilities in detail and see whether they are ready to make the leap to the big-time with the Series E injection they just raised in May.  They’ve come a long way from the new kid on the block they were six years ago, going from a few sales in the low end of the mid-market to a lot of sales in the high end of the mid-market to making progress in the Fortune 500, where they recently landed a few significant customers.  Will they be able to turn that into a few dozen Fortune 500 customers and become one of the next big pure-plays in the space who fill the void left by the recent acquisitions of Emptoris and Ariba?  And will they be able to successfully penetrate the European market?  Only time will tell, but I can say that the fact that they have almost 300 customers with a 95%+ renewal rate is certainly nothing to scoff at and pretty telling.  
Stay tuned.  SI was one of the first blogs to bring you in-depth coverage of their capabilities when they were just starting, and it will be one of the first to bring you in-depth coverage of their new platform capabilities that might just make them a true Fortune 500 / Global 3000 player in the coming years.
While you wait, you can revisit some of the classic posts or sing a few songs from the “A” side:

“e” does not change the fundamental nature of anything

Purchasing Insight just ran an awesome article by Ian Burdon who talked about the “e-wheels on my wagon”. Attempting to carefully explain why the e-Procurement debate is at least ten years behind the curve (and that if you’re not doing proper e-Procurement by now, you probably just crawled out of a cave somewhere … or at least that’s the doctor‘s interpretation), he makes a great point that has been often missed in the internet age that must be repeated:

If you take a text which is riddled with “e” this and “e” that, the first thing to do is to strip out all of the “e”s. If it then looks like nonsense, it will not be improved by putting the “e”s back. More than a decade after the dot.com boom one hopes people would be less credulous but, alas, marketing budgets are long and memories are short.

To make a long story short, good e-Procurement is good Procurement, whether you’re using paper and pen, telephone, fax, the Internet, or HyperNet (in the year 3000). As the author astutely notes, e-Procurement is more than e-Sourcing, P2P, and e-Invoicing, and the end goal goes well beyond savings. Proper e-Procurement is about more than merely buying things over the World Wide Web. Proper e-Procurement supports a proper Procurement strategy, which encompasses everything from corporate planning and market analysis to understanding and working with the whole supply chain in an effort to deliver the corporate strategy. That goes well beyond putting a pencil in your shopping cart by way of a punch out. And it certainly goes well beyond endless debates about structured documents which entirely miss the scale and nature of the transformational opportunities available.

So don’t get sucked in by the e-Hype. Look for solutions that deliver real Procurement value, and you will not be among those acting like they just crawled out of the e-stuary. And if you need a good guide on how to start, after checking out SI’s recent post on a good lesson in e-Procurement System Selection (courtesy of Discount Tires) and the X-emplification (Day 5) and X-asperation (Day 6) posts, as well as the SI e-Procurement 3.0 Illumination (here), don’t forget about the Enterprise Software Buying Guide as well as SI’s recent 2-parter on How Much That Enterprise Supply Management Solution Really Costs (Part I and Part II) and you’ll be well on your way.