Forensic Procurement Analysis: Identifying Purchasing Patterns

Forensic procurement analysis is the disciplined study of purchasing data for patterns that warrant further inquiry. It is not the same as accusing a buyer or supplier of wrongdoing. A pattern is a signal, and a signal needs context, documents and due process before it becomes a finding.

This article sets out a practical method: define the scope, gather the data, establish a baseline, test the indicators, triangulate with other evidence, and document the result. It also explains the patterns that matter most in South African public procurement.

What Forensic Analysis Is For

• Supplier due diligence. Before appointing a supplier or JV partner, test whether the public record shows unusual patterns.
• Department scans. Review a buyer's award history for concentration, threshold clustering or repeat suppliers.
• Bid strategy. Understand how a buyer actually spends, not only what it says in the tender document.
• Integrity review. Support an internal audit, journalistic inquiry or procurement challenge with evidence.
• Market intelligence. Identify where competition is thin and where a credible bidder can enter.

"

The Method

The baseline is the most important step. A R4.9 million award is not suspicious because it is below R5 million; it is suspicious only if the buyer's normal pattern shows clustering at that level and the documents do not explain it. Without a baseline, every number looks like a red flag.

The Patterns That Matter

None of these patterns is proof. Each has an innocent explanation. The analyst's job is to test the explanation, not to assume the worst.

Threshold Clustering: A Worked Example

A municipal buyer has a policy threshold of R500,000 for a particular approval level. An analyst scans 24 awards in one financial year and finds that 9 awards fall between R470,000 and R499,999, all to three suppliers.

1. Observed: 9 of 24 awards (37.5%) sit within 6% below the threshold.
2. Expected: If award values were spread normally across the R100,000–R1,000,000 range, the share in that narrow band would be much smaller.
3. Question: Were these genuinely separate projects, or one project split into packages to stay below the approval threshold?
4. Verification: Check the scope descriptions, dates, site locations and requisitions. If the packages are contiguous and were approved together, the pattern warrants escalation.

The analysis does not conclude that bid splitting occurred. It shows a statistical pattern that is inconsistent with the baseline and identifies the documents needed to resolve it. That is the correct forensic standard.

Repeat Awards and Concentration

Concentration is not inherently improper. A specialised supplier may be the only credible provider in a district. The question is whether the concentration is explained by the market or by the process.

The forensic analysis workbench

supports supplier audits, department scans and pair analysis. The existing guide to detecting tender irregularities

explains the tool workflow, and the guide to ten red flags in government tender awards

explains the indicator families.

Director and Ownership Analysis

Some of the strongest signals come from the ownership layer. If three suppliers that win from the same buyer share a director, an address or a bank account, the apparent competition may be less real than it looks.

• Pull CIPC director and shareholder records for every winning supplier.
• Map common directors, common addresses and shared contact details.
• Check incorporation dates against award dates; a company registered weeks before a large award warrants a question.
• Check whether a director has a history of liquidated or dormant companies.
• Verify the roles, not only the names; a nominee director may have no real function.

The director lookup

tool maps director portfolios and related companies. The guide to director relationship lookup

explains how to use it in due diligence.

Triangulating With Documents

Data patterns become findings only when they are corroborated. The documents to request or review include:

• The advertisement and tender document.
• The bidder list and evaluation report.
• The award letter and contract.
• Requisitions, approvals and deviation memos.
• Variation orders and payment records.
• Supplier registration and director records.

If the documents explain the pattern, document the explanation. If they do not, escalate to the appropriate authority: the accounting officer, the internal audit function, the Auditor-General, the Public Procurement Tribunal or another competent body. Do not publish an accusation without due process.

A Department Scan in Practice

An analyst reviews a provincial department's awards for a single category over three years. The scan finds:

1. One supplier received 46% of the category's awarded value.
2. Eight awards sit within 5% below the quotation threshold.
3. Three of the winning suppliers share a director.
4. Two suppliers were incorporated within six months of their first award.
5. The advertisement for one large award was open for only five working days.

The scan does not prove collusion or bid splitting. It produces five questions for the department and five documents to request. That is a successful forensic output: specific, documented and actionable, without overclaiming.

Common Forensic Mistakes

• No baseline. A pattern is only meaningful relative to normal spending.
• Treating a signal as proof. Patterns have innocent explanations.
• Ignoring small values. A series of small awards can reveal a larger pattern.
• Ignoring timing. Year-end, emergency and election cycles change behaviour.
• Naming individuals prematurely. A director link is a lead, not a finding.
• No documentation. An undocumented analysis cannot be reviewed or defended.

Using Tenders-SA for the Analysis

1. Start with the forensic analysis workbench
   for supplier audits, department scans and pair analysis.
2. Use buyer intelligence
   to review a buyer's supplier concentration and award patterns.
3. Use company intelligence
   and director lookup
   to test ownership and control.
4. Use the leaderboard
   and awarded tenders
   data for the broader market view.
5. Read the tender fraud prevention guide
   for the control environment.

A Flag Versus a Finding

The distinction between a flag and a finding is the difference between a useful analysis and an allegation. A flag is a pattern that warrants inquiry. A finding is a conclusion supported by documents and, where necessary, an independent process.

The analyst should never skip from flag to finding. The memo should state what the data shows, what the documents show, what remains unresolved and what the recommended next step is. That discipline protects the analyst, the organisation and the subject.

Writing the Case Memo

A case memo is the durable output of a forensic review. It should be short enough for a decision-maker and detailed enough for a reviewer to reproduce.

1. Question: the specific issue being examined.
2. Scope: buyer, category, period and data sources.
3. Method: baseline, indicators and thresholds.
4. Findings: facts, with references to documents and data.
5. Interpretation: possible explanations, stated neutrally.
6. Limitations: missing data and unresolved questions.
7. Recommendation: proceed, request documents, refer or close.

Award data has limits that the analyst must state. It records the winning supplier and value, but not the losing bids, the evaluation scores or the reasons for the award. It may not capture variations, extensions, subcontractors or payments. A pattern built on award data is therefore a hypothesis, not a complete account of the procurement.

That limitation is not a reason to avoid the analysis. It is a reason to combine it with documents, interviews and official records. The strongest forensic work is triangulated: the data points to a question, the documents answer it and the process gives the answer weight.

Write the memo for a reader who will not run the analysis themselves. State the question, the data, the method, the finding and the limitation in that order. Attach the queries and the source extract so the work can be repeated. A finding that cannot be reproduced is an opinion.

The best forensic work answers a specific question and resists the temptation to overstate it.

Conclusion: Analyse, Corroborate, Escalate

Forensic procurement analysis is a disciplined sequence, not a dramatic accusation. Define the question, establish the baseline, test the patterns, triangulate with documents and escalate only when the evidence supports it. The value is in the rigour, not the headline.

Start with one buyer and one category. Build the baseline, run the indicators and write a one-page memo with the pattern, the explanation and the next document to request. That memo is worth more than a dashboard full of unverified flags.