Guest Commentary: Duplicate Payments – in your company!

Leading experts from a variety of fields bring their insights to the equation by providing guest commentaries on our Security Blog. This guest commentary comes from Zapliance, a German partner that focuses on SAP Audit.

It is not always easy for the auditor to point out and communicate the value contribution of the audit department to the company. The audit department is often regarded as a regulatory necessity. Of course, it is much easier if the insights of an audit save money. That is why I dedicate this article to the very appropriate and worthwhile topic “duplicate payments” and how to get them on track. Already the Latins knew: Pecunia non olet (“Money has no smell”).

Duplicate Payments – in your company!

There are no duplicate payments in every well-organized company you may think: SAP will take care of duplicate payments. Not even close! The reasons for occurring duplicate payments are manifold. I was once in a company in which various ERP systems were consolidated. Frequently, you forget the master data consolidation during data migration on project day, leading to master data doublets at the vendors. The clerks lose the overview, while the suppliers are already putting you under pressure because of late payments. Master data doublets are used at the same time and the balances of the vendors are no longer to be determined without a doubt. In such a scenario, the first duplicate payment is not that far!

Duplicate payments are always an important issue for auditing, as you can report direct asset losses and reimbursements are a liquidity aspect for the company. The auditors can generate a direct value contribution. In addition to the lost money, you can discover systematic weaknesses within the internal control system if someone duplicates an invoice. The objectives of a duplicate payment analysis are:

• Discover Duplicate invoices
• Recovery of Duplicate payments
• Identification of weaknesses in the internal control system

How do duplicate payments arise?

There are various reasons for duplicate payments. Here are some from my experience, which led to duplicate payments:

• Accounts payable are recorded twice because they are circulating several times in the company.
• An invoice is recorded twice, once through the automatic process of invoice receipt by scanning the invoice and once as a paper invoice.
• There are master data duplicates for the vendors, and an invoice is often posted to different vendors, but they are duplicates.
• A partial payment has been posted and the invoice will be paid in full later.
• There is no proper approval process for the release of an invoice for payment.

Anyone who can analyze his data in a clever way will find cash: Then it’s time for a Cashback! But the question may arise: How to uncover duplicate payments in SAP? In addition, you will encounter many “False Positives” while searching for duplicate payments. Identifying and excluding as many “False Positives” as possible to get to the real duplicate payments is a high art. Finding duplicate payments is more like looking for a needle in a haystack. But first things first.

How to identify duplicate payments?

Twice paid invoices can probably never be identified with clear reliability. But you can look for indications that portend duplicate payments. If a document cumulates the following indications, a twice paid invoice is likely to exist. Such indications can be the same:

• amount on different documents and
• posting date and
• document date and
• document type and
• accounting account and
• vendor and
• external invoice number.

Of course, even if there are many matches, there is no guarantee that you will find a duplicate payment in SAP. However, experience shows that investigating relevant documents and focusing on high invoice amounts stands a good chance to quickly finding a few thousand dollars!

How to perform duplicate payment analytics in SAP?

If you want to analyze duplicate payments in your SAP, you need the corresponding data structure and data from your SAP system. By using zapliance, the data will be downloaded automatically from your SAP system. If you have managed to get the corresponding data, your analytics can be done in following three steps:

Step 1: Finding documents with the same amount

First, you should have a look at all document lines of incoming invoices that show the same amount. The basis will be made of document pairs (SAP table BKPF, field BELNR), where individual posting lines (table BSEG, field BUZEI) show the same amount (field DMBTR). The posting lines are filtered by account type: vendor (field KOART=”K”) that indicate a payment (field XZAHL=”X”) on debit (field SHKZG=”S”). Thus, you get the posting lines that balanced a liability with a payment.

The result may look as follows:

Every row contains two different documents (BELNR1 and BELNR2) with the corresponding posting lines (BUZEI1 and BUZEI2) having the same amount (DMBTR). The results are showing the same amounts twice. The reason behind this is that the same document is being listed once on the left and once on the right of the document pair.

You can easily detect such duplicate amounts with a SQL statement. In my whitepaper, you will learn how to identify the ten biggest same amounts and its relating documents by simply using SQL. You can download it here.

These analytics provide a variety of false positives. We, at zapliance, have the goal to design your SAP audit more efficiently. Therefore, we have improved these analytics to reduce false positives and integrated them in the software.

Step 2: Adding indications for duplicate payments

In our next step, we will add indications to the identified document pairs from step 1.

In the following we will be using the same:

• posting date
• document date
• document type
• accounting account
• vendor
• external invoice number

After you have looked everything up in your SAP system, using e.g. the transaction “SE16n” on table “BSEG”, the result may look as follows:

Step 3:  Consulting the frequency of duplicate payments

Another step you may consider to further analyze duplicate payments is to include the frequency of listed duplicate payments. Specific amounts could frequently appear because of typical business processes. Such amounts would be declared as: “nothing special”. In your SAP system, you can find out how frequently item amounts appear in different documents by using the following SQL statement:

SELECT DMBTR,COUNT(DISTINCT BELNR) FROM BSEG WHERE DMBTR>0 GROUP BY DMBTR HAVING COUNT (DISTINCT BELNR)>1 ORDER BY COUNT(DISTINCT BELNR) DESC

The result may look as follows:

It is quite clear that the amount of 0.01 is by far the most frequent. This is, for example, a difference, which is uninteresting because of its low value. Looking at the following entries in the table you should ask yourself, whether the amount could be classified as a “standard amount” in the context of “standard processes”, or not. Otherwise, you should consider these as duplicate payments. I recommend investigating rarely appearing high amounts. If you would like to have a look on how to reduce false positives with a utility analysis visit our blog post here.