CLIENT WORK / GAP REVIEW · MPA-CSA-001

Where public money leaks: a council spend audit

In one line

A full year of a county council's payments, £877.5m across 61,545 lines, tested for duplicates, split purchases, spend without a visible contract and suppliers that have since failed.

The problem

English councils have to publish every payment over £500. Very few ever turn that data back on themselves. Duplicate payments, purchases kept just under tender limits, money flowing to suppliers with no contract on record, and payments to companies that are already failing all leave marks in that file. Nobody is paid to look for them.

The question

In one year of a council's published payments, what does the data put in front of internal audit, and how much money sits behind each flag?

The data

• Payments: a large English county council, all 12 monthly "spend over £500" files for April 2025 to March 2026. 61,545 payment lines, £877,547,641 in total, 3,743 payees. 5,754 lines (£13.2m) have the payee withheld, mostly individuals and small childcare providers; those are left out of the supplier tests.
• The council's own rules: its Procurement Regulations (last changed March 2024). Up to £3,000 needs no formal process; £3,000 to £25,000 needs three written quotes; £25,000 and over must be advertised and tendered. Values exclude VAT.
• Its contract records: every quarterly contract register and new-contract list it published from January 2025 to September 2026, plus every awarded notice it placed on Contracts Finder since 2015 (852 supplier names).
• Company status: the Companies House register of 1 October 2026 (5.7 million companies).

Before any test was run, the rules were written down and dated (see the method appendix). Nothing was tuned after seeing the results.

What I found

1. £138.4m went to 197 suppliers with no contract on the council's published record

Of the 565 goods-and-services suppliers paid £25,000 or more in the year, 197 could not be found in any contract register, new-contract list or Contracts Finder notice the council has published. Between them they were paid £138.4m.

• The single biggest is the council's highways term contractor, £91.6m. That contract is long-running and was let before Contracts Finder existed, but it does not appear in the 2025 or 2026 quarterly registers either.
• The other 196 suppliers account for £46.8m. 87 of them (£13.3m) are taxi and minibus firms on home-to-school transport. Councils usually buy this through a dynamic purchasing system, where firms join after the notice is published, so a missing name is expected there. That leaves around £33.5m across 109 suppliers, in IT hardware, software, energy, consultancy and building work. A council should be able to point to a contract for each of them in minutes.
• 71 of the 197 were paid over £100,000 each.

What it means: either the published register is incomplete, which is a transparency problem in its own right, or some of this spend is happening without a contract the council can show. Both are cheap to check and expensive to ignore.

2. £6.3m went to 21 suppliers whose companies are now in insolvency or being struck off

Of the 791 larger suppliers that match a single company exactly by name, 21 are no longer simply "active" on the register: 9 in liquidation, 1 in administration, 4 in a voluntary arrangement with creditors, 7 with a proposal to strike off. The council paid them £6.3m during the year.

Six of those 21 already had overdue accounts at Companies House on the day they were paid, some by more than two years. £3.40m in 129 payments went out after the accounts deadline had passed. Across all 791 matched suppliers, nine were paid while their accounts were overdue.

What it means: the risk is not only paying a failing supplier. In several cases the payee name on the council's system matches a company that stopped filing years ago, which suggests the supplier record itself is out of date: the money may be going to a successor business under an old name. That is a bank-detail and fraud-control question, not just a credit-risk one. This flag is the starting point for project MPA-SFE-001, the supplier early-warning test.

3. No sign of purchases bunched under the tender limits

This is the test people expect to find something, and it did not.

• Just under the £25,000 tender limit: 148 goods-and-services payments in the 10% band just under the limit, 133 in the band just over, and 192 in the band below that. The count just under the limit is a little higher than just over it, but lower than the band below, so there is no clear bunching.
• Just under the £3,000 quote limit: 277 just under, 296 just over. No bunching at all.

A supplier-by-supplier search did find 55 runs of two or more payments just under £25,000 within 60 days (£3.1m). Looked at one by one, most are monthly invoices on contracts that already exist: bus routes, school transport, waste haulage. One construction supplier was paid four round sums of £24,000; it does hold a registered contract, so these are most likely stage payments, but it is exactly the kind of pattern a client's procurement team should be able to explain.

What it means: at this council the quote and tender limits look respected. The leak, where there is one, is in the contract record and the supplier master file, not in split orders.

Also checked

• Identical payments on the same day: goods-and-services lines with the same supplier, amount, date and service code add up to £3.1m. Most are batches of identical items, such as seven vehicles bought at one price or 25 identical psychology fees paid in one run. The priority list is nine pairs over £10,000 (£1.07m), led by a single public-health contract payment of £426,000 that appears twice on the same day.
• Supplier concentration: in 14 of the 61 spending categories over £1m, one supplier takes more than half. Most are what you would expect: business rates, electricity, a managed agency-staff contract. None stood out as a concentration risk on its own.

What it means for a business

The same tests work on any organisation's accounts-payable file. Three questions every finance director should be able to answer from it:

1. Can we show a contract for every supplier we pay more than our tender limit in a year?
2. Is any supplier we pay now in insolvency, or still filed under the name of a company that has stopped trading?
3. Do we pay the same supplier the same amount twice on the same day, and do we know why?

At this council, question one points at £138m and question two at £6.3m. The third is the smallest.

How I would run this for a client

• What you provide: 12 months of accounts-payable lines (supplier, amount, date, cost centre, invoice number if you have it), your contract register and your procurement limits.
• What you get: the flags above with the money behind each one, a ranked list for your audit or procurement team to work through, and a short written note on what to fix in your controls.
• How long: about two weeks from receiving the data. Fixed fee, agreed when we scope it.
• With your ledger: having invoice numbers and supplier bank details sharpens the duplicate and supplier-identity tests considerably.

Limits

• Published data has no invoice numbers or bank details. Every flag is a prompt for review, not a finding of error.
• "No contract found" means not found in what the council has published. It does not prove no contract exists.
• Company matches are by exact cleaned name only. 64% of the larger suppliers matched a single company; the rest could not be checked this way. Insolvency dates are not in the bulk register, so a supplier may have failed after it was paid.
• The council's procurement rules pre-date the Procurement Act 2023, which took effect in February 2025. The local £3,000 and £25,000 limits were tested as published.
• Payment amounts are as published. If any include VAT, the threshold test would shift slightly.

Hostile self-audit

Questions I asked of my own findings before writing them up:

• "Isn't the £91.6m just one old contract?" Yes, and the note says so and reports the other £46.8m separately. It is still the council's largest supplier and still missing from its published register.
• "Taxi firms on a purchasing system will never be named." Agreed. They are split out (£13.3m) and not counted in the £33.5m core figure.
• "Name matching could tie a supplier to the wrong company." Only unique exact matches were used, so a wrong match is possible but unlikely for distinctive names. The finding is worded as "matches a company now in liquidation", and the recommended action is to check the supplier record.
• "Did you go looking until you found bunching?" No. The rules were fixed before the run, and the result was "no bunching". That is reported as a finding.
• "Would the totals tie back to the council's files?" The 12 files load to 61,545 lines and £877,547,641. Monthly totals are kept in the analysis folder for checking.

Sources

• County council spend over £500, April 2025 to March 2026 (12 monthly files, downloaded 9 October 2026), Local Government Transparency Code
• The council's Procurement Regulations, Section 14 of its constitution (last change 22 March 2024)
• The council's quarterly contract registers and new-contract lists, January 2025 to September 2026 (downloaded 9 October 2026)
• Contracts Finder awarded notices, 2015 to October 2026, via the Contracts Finder API: https://www.contractsfinder.service.gov.uk/
• Companies House Free Company Data Product, 1 October 2026: https://download.companieshouse.gov.uk/en_output.html

The council and all suppliers are anonymised on the public site. The working files name them, because the data is public.

Method appendix: the rules, as fixed before running

D1 exact duplicates · D2 repeat payments within 30 days · T1 bunching under thresholds · T2 possible split purchases · C1 concentration · C2 spend with no visible contract · S1 supplier status. Full wording is in 02 Analysis\RULES.md, with one script per step (01_load.py to 05_charts.py).