Accounts payable fraud prevention for dental groups

Accounts payable fraud in a dental group lives in the space between three records: what was ordered, what arrived, and what gets paid. 

Duplicate invoices under new numbers, billing for backordered items that never shipped, unit prices that rise while quantities drop to keep the total flat. None of it looks unusual on a single invoice. Across thirty locations and a few hundred invoices a month, nobody is comparing the three records closely enough to catch it.

Below, you will find the five fraud patterns that show up in multi-location dental AP, the control that stops each one, and a way to separate duties without adding headcount. 

In short, invoice fraud prevention in a DSO depends on matching every invoice line against the purchase order and the receiving record before payment, then routing exceptions to someone other than the person who placed the order.

3 reasons accounts payable fraud goes unnoticed in multi-location dental groups 

The exposure in DSOs come from structure, and nobody on your team has to be doing anything wrong for it to exist. The ACFE's latest Report to the Nations found that more than half of the fraud cases it studied involved missing internal controls or an override of existing ones.

Three conditions make dental AP harder to police than AP at a single-site business with the same revenue:

1. One person often orders, receives and approves, so no second set of eyes sees the transaction

At a single practice, the office manager frequently builds the order, checks in the delivery and signs off on the invoice. That removes every checkpoint at once:

• The person best positioned to cover a mistake is the same person asked to catch it
• Receiving happens in fragments, often by clinical staff with a patient in the chair
• Corporate AP sees the invoice weeks later with no context on what arrived

None of this assumes bad intent. An honest error and a deliberate one look identical on paper, and the process has no step designed to tell them apart.

2. Invoice volume across dozens of locations buries small anomalies

If each of forty locations receives twenty supplier invoices a week, AP sees roughly 3,200 invoices a month. A $300 overcharge disappears in that stream:

• Line-by-line review gives way to spot checks once the queue outgrows the team
• Small, repeated overcharges stay below any threshold that would trigger a second look
• Month-end pressure rewards clearing the queue over questioning it

Volume buys time, and time is what makes a small scheme expensive. The ACFE puts the median loss at $40,000 for fraud caught within six months and above $1.1 million for schemes that run past five years.

3. Routine dental billing noise gives cover to deliberate discrepancies

Backorders, substitutions and promotional pricing give dental invoices a legitimate reason to look slightly off:

• A backordered item billed as shipped reads as a timing issue
• A missing promotional discount looks like a one-time pricing slip
• A substituted SKU with a different unit price is hard to verify by eye

When legitimate discrepancies are this common, reviewers learn to wave them through. Anyone looking to exploit the process learns the same lesson.

Those conditions explain how accounts payable fraud can sit undetected for months. The next step is recognizing what it looks like.

The 5 accounts payable fraud patterns that show up in dental groups 

Each pattern below has an innocent twin, and the invoice looks the same either way. That is why the controls later in this piece focus on the transaction and leave intent to the investigation.

The ACFE ranks billing schemes among the most significant occupational fraud risks once frequency and damage are weighed together. Across all scheme types, the median case ran twelve months before detection. 

Here is how each pattern works in a dental setting and how it usually surfaces:

1. Duplicate invoices get paid twice because the second copy looks new

A duplicate invoice rarely arrives as an exact copy. It carries a small change that slips past a busy reviewer:

• The same invoice resent with a changed number, suffix or date
• A mailed paper copy and an emailed PDF both entered
• A supplier statement line paid on top of the original invoice

It usually surfaces as a supplier credit balance or at year-end reconciliation. Duplicate payments are estimated at 0.8% to 2% of total disbursements APQC duplicate payment rate, so a group spending $10 million a year on supplies could be overpaying by $80,000 or more.

2. Invoices for supplies that never arrived drain budget with nothing on the shelf

When nobody records what came off the truck, the invoice becomes the only evidence that the goods existed:

• Backordered items billed as though they shipped
• Short shipments invoiced at the full ordered quantity
• Deliveries billed to a location with weak receiving habits

It tends to surface through a stockout or a physical count that contradicts purchase history.

3. Inflated prices or quantities ride on a legitimate purchase order

The PO is real, the supplier is real and the delivery arrived. The problem sits in the numbers:

• A unit price above the contracted or quoted price
• A billed quantity above what was received
• A price increase offset by a quantity change, so the total still matches the PO

This is the mechanism behind gradual price creep, applied on purpose. It can run indefinitely unless someone audits line-level pricing against contracts.

4. Fictitious or altered vendor records send real payments to the wrong account

Vendor fraud targets the supplier file instead of the invoice. Whoever controls a vendor record controls where its payments land:

• A new vendor with a name nearly identical to an existing supplier
• A changed bank account on a legitimate vendor, usually requested by email
• A vendor record created by the same person who approves its invoices

It typically surfaces when the real supplier calls about a missed payment. Email is the usual entry point, and the Association for Financial Professionals found that 74% of organizations were affected by business email compromise in its latest survey.

5. Personal purchases get run through a practice account

Practice-level supplier logins and autopaying cards make it easy to slip a personal order in with a legitimate one:

• Consumer items ordered through a practice's online supply account
• Orders shipped to a home address
• Recurring charges on a card nobody reviews line by line

This pattern overlaps with ordinary rogue spending, which is exactly why it hides so well.

Every one of these patterns leaves a trace in the order, the receipt or the vendor file. The controls below read those traces before a payment goes out.

6 accounts payable internal controls that catch each pattern

A control that relies on a reviewer remembering to check works at three locations and falls apart at thirty. The accounts payable internal controls that hold up in a DSO stop payment until the documents agree, so the check happens whether anyone remembers it or not. 

• Duplicate invoices. Duplicate invoice detection checks the vendor, invoice number, amount, and date against bills already in the system. This can catch the same charge being submitted more than once, even when some invoice details have changed.
• Supplies never received. Receiving verification and three-way matching compare the quantity on the invoice with what staff actually accepted at the location. If an invoice includes a backordered or missing item, the mismatch should stop it from moving straight to payment.
• Inflated price or quantity. Line-item three-way matching compares the unit price, quantity, and extended price on each invoice line with the purchase order and receiving record. That makes it harder for a price increase or quantity change to disappear inside a total that still looks reasonable.
• Fictitious or altered vendors. Vendor master controls limit who can add suppliers or change sensitive information such as bank details. Changes should also be independently verified before payments are sent using the new information.
• Personal purchases. PO requirements and approval thresholds establish that a purchase was authorized before the invoice arrives. AP can verify that an approved PO exists before paying the supplier rather than relying on the invoice alone as evidence that the purchase was legitimate.

1. Line-item three-way matching

Three-way matching compares the invoice, the purchase order and the receiving record before payment. Matching on totals alone leaves a gap. A PO for ten boxes at $50 comes to $500. An invoice for eight boxes at $62.50 also comes to $500. A total match passes it. A line-level match flags a 25% price increase and two missing boxes by checking:

• Unit price against the PO or contracted price
• Quantity invoiced against quantity received
• Extended price on each line, then the invoice total

If your team already practices invoice matching on totals, the documents are already in hand. Moving the comparison down to the line is what makes it a fraud control.

2. Requiring a purchase order

An invoice with no matching PO carries no evidence that anyone at the practice asked for the goods. A disciplined purchase order process closes that door:

• No PO, no payment, with a documented exception path for emergencies
• POs created in a procurement system with pricing pulled from the contract at order time
• POs created after the invoice arrives flagged for finance review

3. Approval thresholds send exceptions to a reviewer

Approving every invoice by hand sounds safe until the queue hits 3,200 a month and approvals turn reflexive. Thresholds put attention where it counts:

• Auto-approve invoices that match the PO and receipt within tolerance
• Route variances above a dollar or percentage threshold to finance
• Block the person who placed an order from approving its invoice

Reviewers who see only exceptions actually read them.

4. Institute Vendor master controls 

The vendor file decides where money goes, so access to it deserves tight limits:

• Limit vendor creation and editing to a few named users
• Verify every bank detail change by calling a known supplier contact, never a number in the request
• Review all new and edited vendors monthly

A payment to the wrong account is extremely hard to recover once it clears, which makes this the cheapest place to stop vendor fraud.

5. Implement uplicate invoice detection

Duplicate invoice detection works best when it looks for near matches as well as exact ones:

• Match on vendor, invoice number, amount and date together
• Catch near duplicates such as a changed digit, added suffix or leading zero
• Compare supplier statements against paid invoices before paying any statement line

Blocking a duplicate payment takes one alert. Recovering it takes a credit request and a supplier conversation.

6. Keep verification at the location

Three-way matching is only as good as the receiving record, which has to be quick enough for staff to create between patients:

• Receive against the PO in the system the day the box arrives
• Record partial shipments and backorders at check-in
• Attach or scan the packing slip to the order

A receiving record created in the moment is what lets AP pay only for supplies that actually arrived.

Method runs line-item three-way matching and duplicate invoice alerts across every location, including orders that arrive in multiple shipments. See how it works on your own invoices.

Those six controls assume someone owns each step, which is the next problem for a lean finance team.

How do you enforce segregation of duties in accounts payable with a small team? 

Textbook segregation of duties in accounts payable splits requisition, receiving, approval and payment across four people. A twelve-location DSO does not have four people for that and probably never will. The practical answer is to let the system act as the second person, enforcing separation through three mechanisms where headcount cannot:

1. Role-based permissions keep one login from completing the whole transaction

Permissions decide what each user can do, which builds separation into the software:

• Practice staff can request and receive, and cannot approve their own orders
• Approvers can release invoices, and cannot edit vendor records
• Permission changes get logged and reviewed

The same person may wear several hats. The system refuses to let those hats touch the same transaction.

2. Approval routing puts a second person on every exception without adding headcount

Routing rules send each exception to someone other than the requester, automatically. Variances go to a regional manager or central finance, orders above a set value require a second approval, and self-approval is blocked at the rule level. The second reviewer's time goes only to invoices that need it.

3. An audit trail records who did what, which deters as much as it detects

A timestamped record of every order, receipt, edit and approval lets you reconstruct any transaction, with notes explaining why each exception was approved. People behave differently when they know the record exists, which makes the audit trail one of the cheapest forms of segregation of duties a small team can adopt.

With permissions, routing and a record in place, the remaining task is confirming on a schedule that the controls still work.

A quarterly accounts payable audit checklist for DSO finance teams  

This checklist is for an internal accounts payable audit the finance lead runs each quarter, separate from any external audit program. The ACFE associates surprise audits and proactive data monitoring with better fraud outcomes, so vary the timing and the sample.

1. Pull every vendor added or edited this quarter and confirm someone other than the requester approved each change.
2. Run a duplicate payment report on vendor, amount and date across all locations, including near matches.
3. Sample paid invoices from each region and trace every line to the PO and receiving record.
4. List invoices paid without a purchase order and confirm each went through the exception path.
5. Compare unit prices on your highest-spend SKUs against contracted pricing.
6. Review user permissions for anyone who can both place orders and approve invoices.
7. Match open backorders against billed items to catch charges for supplies still in transit.
8. Review approval overrides and auto-approval tolerances to confirm thresholds have not drifted.

Anything that fails is a finding for this quarter and a design question for the next one.

Match the lines before you pay the total 

Accounts payable fraud in a dental group lives in the distance between the practice that orders, the staff member who receives and the central team that pays. Every pattern in this piece exploits that distance, and each one survives because an invoice total that looks right gets treated as proof. Checking the lines, the receipt and the vendor file before payment closes the distance without adding people.

Method Pay matches every invoice line against the PO and what your staff received, alerts on duplicate invoices and incorrect line items, routes exceptions through custom approval workflows, and keeps a full audit trail from order to payment. Schedule a demo to see it on your own supplier invoices.

Frequently asked questions

What is accounts payable fraud? 

Accounts payable fraud is any scheme that causes an organization to pay money it does not owe through its supplier payment process. Common forms include duplicate invoices, invoices for goods that never arrived, inflated prices, fictitious vendors and personal purchases on a business account. In a DSO, the risk rises because ordering, receiving and payment happen in different places.

How common is accounts payable fraud? 

The AFP's latest Payments Fraud and Control Survey found that 76% of US organizations experienced attempted or actual payments fraud, and 74% were hit by business email compromise. The ACFE's latest Report to the Nations puts the median occupational fraud loss at $104,000, with the typical scheme running twelve months before detection. Schemes caught within six months had a median loss of $40,000, so early detection matters.

What is the difference between a duplicate invoice and a duplicate payment? 

A duplicate invoice is a second bill for the same goods, sent by accident or on purpose. A duplicate payment happens when that second invoice gets paid. Detection that matches vendor, invoice number, amount and date before payment keeps the first from becoming the second.

What does invoice fraud prevention look like for a small DSO finance team? 

Invoice fraud prevention at a small DSO relies on the system doing the checking. Line-item three-way matching, a PO requirement and duplicate detection block most bad invoices automatically. Role-based permissions and approval routing then give you segregation of duties without separate staff for each step.

Which accounts payable internal controls should a DSO put in place first? 

Start with a purchase order requirement and line-item three-way matching, which together address unauthorized purchases, unreceived goods and inflated pricing. Add duplicate invoice detection next, then tighten vendor master access and bank change verification. Method Pay combines matching, duplicate alerts and approval workflows in the platform your practices already use to order.

‍