Tracewell Advisory

Vendor bank-detail changes: a one-page check for firms that pay client bills

When a client's vendor says "we've changed banks," the riskiest payment is the next one your team releases. Six questions: would your process catch a redirected payment, and could you show that it did?

Download as PDF

Part A: the rule (stops the outside request: a fake vendor email)

1. Call-back. Is every bank-detail change confirmed by calling the vendor at a number you already had on file, not one from the email or the new invoice?
2. Second person. Does someone other than the person who entered the change approve it before the next payment?And who approves when the request comes from the client's owner?
3. Who can ask. Is it written down who at the client may request a vendor change, and does your team know to set aside requests from anyone else?

Part B: the evidence (shows the rule held, including for changes made inside)

1. The list. Could you produce last quarter's bank-detail changes, with who entered and who approved each one?In QuickBooks Online, the Audit Log records that a vendor was edited, but not which field changed. The list usually has to come from your bill-pay tool, the bank portal, or your own change log.
2. Change, then payment. For each change, how soon was the first payment to the new account made?A change followed by a payment within days is the first pattern to look at.
3. Every time. Has anyone checked that the second approval actually happened on every change, rather than only that the rule exists?

How to read your answers. "No" or "not sure" on questions 1 to 3 is a gap in the rule. "No" or "not sure" on questions 4 to 6 means the rule may work, but nobody could show it.