Red flags in property operations: duplicate vendors, round-sum payments, manual overrides

A risk officer rarely finds trouble by reading the accounts. They find it by looking at patterns that do not quite fit.

Three of those patterns turn up in property operations again and again. None of them proves anything. Most have dull, innocent explanations.

That is what makes them useful. A firm with good controls can show the reason in minutes. A firm without them has to go and investigate.

Let us be clear about tone. This is about practices, not people. Honest staff benefit most from these checks, because they can clear their name instantly.

Pattern one: duplicate vendors

The same supplier appears twice, with a slight difference in the name. For example, “ABC Tech” and “A.B.C Technical Services”.

Usually, this is untidy data. Someone added a supplier without searching first. But duplicates also make it possible to pay one invoice twice. They are also how a false supplier can hide in a long list.

The strongest signal is shared details. Two vendor names with one bank account deserve a question.

Pattern two: round-sum payments

Real invoices are rarely neat. Materials, labour and VAT usually produce an awkward figure.

So a run of payments at exactly AED 10,000 or AED 5,000 stands out. It can mean an estimate paid without an invoice, or an advance never settled. Payments sitting just below an approval limit deserve the same attention.

For example, say approval is needed at AED 10,000. Look at how many payments fall between AED 9,500 and AED 9,999.

Pattern three: manual overrides

A system says no, and someone makes it say yes. A rent is adjusted. An invoice is reopened. A write-off posted late on a Friday.

Overrides are normal. Business needs them. The risk lies in overrides with no reason, no second person and no trail. That is why an audit trail is the foundation for this whole review.

The three patterns compared

Pattern	Common innocent cause	What could sit behind it	The check
Duplicate vendor	Added twice by mistake	Double payment, false supplier	Compare names, bank details, addresses
Round-sum payment	Agreed fixed fee	Payment with no invoice	Match to contract or invoice
Just under the limit	Standard job price	Splitting to avoid approval	Look for repeats by vendor and person
Manual override	Genuine correction	Unapproved change	Look for reason and second approver
Late posting	Month-end pressure	Numbers adjusted to fit	Review entries posted after close

Notice the second column. Starting from the innocent cause keeps the review fair, and it keeps staff on side.

How the checks fit together

These patterns are most useful when combined. One round payment means little. A round payment to a new vendor, approved by the person who created it, means more.

Why separation of duties matters

1. Create the vendorPerson A, with bank details verified.
2. Approve the invoicePerson B, against a job or contract.
3. Release the paymentPerson C, or a recorded second approver.

Small firms often cannot separate every duty. That is fine. An owner reviewing a short exception list each month covers much of the same risk. This is exactly the question a banker asks in what a banker checks first: who can get around a control?

A one-hour monthly review

You do not need a forensic team. You need a list and a habit.

Monthly exception list

• New vendors added, and who added them.
• Vendors sharing a bank account or address.
• Changes to any vendor or owner bank details.
• Round-sum payments above a set amount.
• Payments just below an approval limit.
• Manual overrides, write-offs and credit notes.
• Entries posted after month end.

Bank detail changes deserve special attention. Payment fraud often starts with one convincing email asking to update an account. Always confirm through a known phone number, never the one in the email.

If your data is scattered, this list takes days and rarely gets done. In a connected system, it is a saved report. The difference decides whether the review happens at all.

How to introduce this

Tell the team why you are doing it. Explain that it protects them. Share the list, and treat each item as a question, not an accusation.

Most exceptions will clear in a sentence. That is a good result. It means your controls are working, and you can prove it.

Check this on Monday

Export your vendor list and sort it by bank account number. Then look for any account that appears twice.

Next, count last month’s payments at exact round amounts. Pick three, and find the document behind each.

Which of those three patterns would take your team longest to explain?