.svg)
Invoice fraud is no longer simply an accounts payable problem. It is a governance responsibility for every bursar, CFO and finance leader.
The National Crime Agency and Department for Education’s recent invoice fraud campaign carries a clear warning. Education is one of the three UK sectors most affected, with schools losing millions of pounds each year. Criminals exploit trusted supplier relationships and routine payment processes to redirect funds.
The NCA’s guidance is straightforward: check unexpected changes or urgency, verify requests independently with the genuine supplier and withhold payment until the details are confirmed.
Leadership must turn that advice into controls that operate before money leaves the school. Every check needs an owner, an escalation route and a record.
Finance processes invoices. Purchasing commitments and supplier relationships extend across departments. Accountability must follow the entire transaction, from the decision to spend through to payment.
Approval alone is not assurance
An invoice can be correctly coded, approved and recorded in the finance system and still result in payment to a fraudster.
An approval confirms authority to spend. It does not, by itself, establish that changed bank details belong to the genuine supplier. Accounting accuracy and payment integrity address different risks.
Purchasing and accounts payable modules do not establish equivalent protection simply because they exist in your finance system. Their value depends on the checks they apply, the decisions they govern and the evidence they retain.
Where verification, approvals and supporting records sit across emails and spreadsheets, part of the control environment remains outside the finance package. A paperless process can still depend on individual vigilance.
Alii adds a dedicated control layer alongside the core finance system. It connects purchasing, invoice integrity checks, approvals and transaction history, giving finance the information to challenge a payment before it proceeds and the evidence to explain the decision afterwards.
Put controls into the workflow
A policy sets the rule. An embedded control makes that rule part of the transaction.
Approval rules must reflect current roles and spending limits, and apply before expenditure is committed. Once goods arrive or a service is delivered, the school may already have an obligation. Approval at that point offers limited oversight of the original decision.
Connecting purchase requests, budgets and invoices gives approvers the context to make informed decisions. Staff changes and temporary cover must be reflected in the approval rules, with clear limits on delegated authority.
Alii’s automated checks surface potential duplicates and supplier discrepancies within the invoice workflow. Its approval workflows route decisions under defined rules, reducing dependence on staff remembering and coordinating separate manual steps.
Flags still require investigation. Changed bank details still require independent confirmation through a known supplier contact. Automation supports that review; professional judgement remains essential.
The control must hold when experienced staff are absent and when the school is under pressure. Reliability depends on repeatable checks and visible escalation.
Make exceptions accountable
Urgency and seniority do not remove the need for verification.
An exception requires a recorded reason, an authorised decision-maker and a clear account of the risk accepted. Bursars need visible leadership support to pause payments when the evidence is incomplete.
Repeated retrospective approvals and overrides warrant scrutiny. They can expose unclear responsibilities, a process that does not fit operational needs or a control being routinely bypassed.
Governors need reporting that identifies those patterns, unresolved discrepancies and attempted fraud, with named owners for corrective action. Payment timeliness and transaction volumes cannot substitute for evidence that checks are operating.
Alii’s audit trails record transaction and approval activity so finance and auditors can establish what was checked, changed and authorised. A significant payment should be understandable without rebuilding its history from scattered correspondence.
Demand evidence of control
The response to the NCA/DfE warning must reach beyond policy review. Leadership needs evidence that authority is current, verification is consistent and exceptions are visible.
Leadership must retain accountability for controls that sit outside the core finance system. If a verification step relies on a separate phone call, email or spreadsheet, its owner and outcome must still be recorded. A control cannot provide assurance when its operation is invisible.
Incident responsibilities must also be clear: who can halt payments, contact the bank, report fraud and preserve evidence. A short scenario exercise tests whether the response still works when key people are unavailable.
The absence of a known loss is not proof of effective governance. A fraud attempt may have been stopped by one experienced colleague noticing an anomaly. Assurance depends on whether the same protection would hold when that person is absent.
Having a policy or finance system is the starting point. Leadership must be able to demonstrate the controls behind each decision to pay.
Those controls must be embedded in everyday workflows, automated where appropriate and demonstrable when challenged.