AI Playbook for Accounts Payable Disbursement Fraud

A nonprofit hospital system's CFO suspects that the AP department processed $840,000 in payments to vendors that do not appear in the approved vendor master. Fourteen payments were made over 19 months, all to ACH routing numbers that changed within 72 hours of payment.

When to use this playbook

• Use this playbook when the decision looks like the situation above: A nonprofit hospital system's CFO suspects that the AP department processed $840,000 in payments to vendors that do not appear in the approved vendor master.
• It is a fit when you have source files in hand and need a structured, reviewable analysis — not a generic chat answer about "Accounts Payable Disbursement Fraud".
• Do not use it as a substitute for licensed, legal, clinical, or authorized official judgment in the domain.

What you'll need

• AP payment register for 19 months
• Approved vendor master file
• ACH routing change log
• Vendor setup approval workflow records
• IRS Form W-9 copies for all vendors receiving >$5,000

Attachments: Spreadsheets (Spreadsheets)

You are a forensic accountant investigating AP disbursement fraud at a nonprofit hospital system. I am attaching:

Work only from the attached source files. If a conclusion is not supported, say so.

Produce:
1. Identify all payments made to vendors not in the approved master file at the time of payment—not just currently.
2. For each rogue vendor, map the approval chain: who set up the vendor, who approved the invoice, who released the payment.
3. Flag any vendor whose bank routing number changed within 5 business days of a payment, and identify who processed the routing change.
4. Cross-reference vendor contact information (address, phone, EIN) against employee records—a sign of insider fraud.
5. Tell me whether this meets the threshold for a SAR filing and what I need to preserve before I interview the AP staff.

Call out where independent models are likely to disagree, and list follow-up documents a reviewer should request.

What to expect

• Rogue vendor payment register with approval chain
• Routing change timeline linked to payments
• Insider match analysis
• SAR threshold analysis and filing checklist

Review before you act

• Validate this output against source files before relying on it: Identify all payments made to vendors not in the approved master file at the time of payment—not just currently.
• Validate this output against source files before relying on it: For each rogue vendor, map the approval chain: who set up the vendor, who approved the invoice, who released the payment.
• Validate this output against source files before relying on it: Flag any vendor whose bank routing number changed within 5 business days of a payment, and identify who processed the routing change.
• Validate this output against source files before relying on it: Cross-reference vendor contact information (address, phone, EIN) against employee records—a sign of insider fraud.
• Confirm every cited figure, date, counterparty, or requirement against the attached originals — models compress and can drop a qualifier.
• Treat disagreement between models as a review item, especially on classification, materiality, and recommended next action.
• Do not authorize an operational, clinical, legal, credit, or enforcement action solely because the models agree.