In 2014, Citigroup experienced invoice fraud and reduced its net income from $13.9 billion to $13.7 billion. Multiple companies were involved in the accounts payable process, and Citigroup did not perform the typical three-way match (invoice, purchase order, packing slip) in its accounts payable processes. The three-way match is a process for ensuring that orders are authorized; that billings are for valid orders, and that the items received and pricing matches the orders. That Citigroup experienced invoice fraud is surprising given the companys size and the usual internal controls employed by large companies.

Explain the procedures auditors perform related to risk assessment, tests of controls, and substantive tests of payables to detect the potential for invoice fraud, as well as actual invoice fraud?