This is actually kind of tricky to catch. You have to have authorization limits not just per transaction, but also total per period of time.
Still, I admire this person's commitment to grift. Eight years she devoted to this fraudulent side hustle!
Still, I admire this person's commitment to grift. Eight years she devoted to this fraudulent side hustle!
1.) Separation of duties. A single person shouldn't be ordering and paying for $40 million worth of equipment. And a person shouldn't be able to order $2.1 million worth of computers within two-and-a-half months without someone noticing.
2.) Trend analysis for invoices. If there are multiple $10k purchases within a short period of time, someone should start asking why purchases are broken up into separate chunks. This is regularly done within financial institutions, and there's probably a former banking compliance officer or two at Yale who can advise the institution on creating build this very obvious system.
3.) Mandatory vacations. It's much harder to perpetrate fraud when someone else does your job for a week or two each year.
4.) Asset inventories. How does millions of dollars of equipment go missing without anyone noticing?
A red flag or two should also pop up when a school administrator starts driving multiple luxury cars to work.
In some places there is a definite push to silence whistleblowers. In the US, it's easier to get away with this if the institution is private. I went to a state school in the US. If there's fraud going on, it's a mismanagement of state funds. If I came across large-scale fraud, I wouldn't go through institutional channels. I'd go straight the state attorney general's office. That takes the investigation out of the hands of people who can directly punish you.