Skip to main content
Promotional banner for the pentest readiness checklist
Kickback-Proof: A Field Guide to Government Contracting ControlsAnti-Corruption & AML
6 min readFor Compliance Training Managers

Kickback-Proof: A Field Guide to Government Contracting Controls

The Problem: Why This Matters

When a contractor inflates invoices to hide $465,000 in kickbacks, the scheme doesn't start with a single fraudulent payment. It begins months earlier, when internal controls fail to catch the first inflated estimate. It continues when no one questions why the same subcontractor keeps winning bids. It ends with a guilty plea and a five-year maximum prison sentence.

The case of Ilya Zagaryuk, who admitted to paying kickbacks to a prime contractor employee for directing U.S. Postal Service repair work his way, illustrates a pattern your compliance team can interrupt. From May 2022 to February 2024, Zagaryuk and his co-conspirator inflated contracting documents to build in funds for payments unrelated to legitimate repair costs. The scheme worked across dozens of facilities in five states because the basic controls that should have flagged it weren't there or weren't working.

If your organization holds government contracts, you're under heightened scrutiny. The Procurement Collusion Strike Force was created specifically to identify and prosecute schemes like this one. You need controls that can detect kickback patterns before they become criminal referrals.

What You Need Before Starting

Before you build fraud detection into your procurement process, gather the baseline information that will let you design targeted controls:

Contract data. Pull a list of all active government contracts, including prime contracts where you're the lead and subcontracts where you're working under another firm. Note the agency, contract type (firm-fixed-price, cost-plus, time-and-materials), and dollar threshold.

Approval workflows. Map who currently approves estimates, change orders, and invoices on government work. Identify single points of failure where one person controls multiple steps.

Vendor relationships. List your frequent subcontractors and suppliers on government projects. Note any patterns where the same vendor consistently wins bids or where bid competition is limited.

Training records. Check when employees involved in government contracting last completed training on anti-kickback requirements and procurement ethics. The Federal Sentencing Guidelines for Organizations require that compliance training be tailored to specific risks, and government contracting carries distinct legal obligations.

Reporting channels. Confirm that employees know how to report suspected bid rigging, kickbacks, or invoice inflation. If your Speak-Up Program doesn't explicitly list procurement fraud as a reportable concern, employees may assume it's not covered.

Step-by-Step Implementation

Step 1: Segregate Estimate and Approval Duties

The Zagaryuk scheme worked because one person at the prime contractor could both direct work and approve inflated estimates. Break that chain.

Assign estimate preparation and estimate approval to different individuals. On government contracts, require that the person approving a subcontractor's estimate has no role in selecting that subcontractor. Document this segregation in your procurement policy and enforce it in your contract management system.

If you're using project management software, configure role-based permissions so estimators can't approve their own quotes and approvers can't direct work to vendors they have a relationship with.

Step 2: Flag Repeat Sole-Source Awards

Kickback schemes thrive when the same subcontractor keeps getting work without competitive bidding. Build an alert for this pattern.

In your contract tracking system, tag each subcontract award as competitive or sole-source. Set a quarterly report that lists any subcontractor who has received more than three sole-source awards in a rolling 12-month period. Route that report to your compliance team and your procurement lead.

When the report flags a vendor, require written justification for the sole-source decision. Acceptable reasons include specialized expertise or emergency repairs. "We've always used them" is not acceptable.

Step 3: Compare Estimates to Actual Costs

Inflated estimates are the funding mechanism for kickbacks. Catch them by tracking variance.

For each government contract, calculate the ratio of final invoice to original estimate. Set a threshold based on your contract type. For firm-fixed-price work, a variance over 15% should trigger review. For time-and-materials contracts, track whether labor hours consistently exceed estimates by the same margin.

When variance exceeds your threshold, require the project manager to submit a written explanation before you process payment. Look for patterns where the same subcontractor or the same project manager shows consistent overruns.

Step 4: Conduct Periodic Invoice Audits

Random audits catch schemes that slip through automated controls. Schedule them in advance so they're routine, not reactive.

Each quarter, select 5% of government contract invoices for detailed review. Pull the original estimate, any change orders, and the final invoice. Verify that:

  • Line items on the invoice match the scope of work in the contract
  • Labor rates match the rates in your subcontractor agreement
  • Materials costs align with market rates (compare to recent purchases of the same items)
  • Any change orders were approved in writing before the work was performed

If you find discrepancies, expand the audit to include all invoices from that subcontractor for the past 12 months.

Step 5: Train on Kickback Red Flags

Your procurement team needs to recognize the warning signs before a scheme scales to hundreds of thousands of dollars.

Deliver annual training that covers:

  • What constitutes a kickback (anything of value given in exchange for directing business, including cash, gifts, or favorable contract terms)
  • Red flags such as vendors who don't compete on price, estimates that include vague line items like "contingency" or "miscellaneous," and employees who resist oversight of vendor relationships
  • Reporting obligations under your Speak-Up Program and the Antitrust Whistleblower Rewards Program, which offers rewards for tips that lead to recoveries of at least $1 million

Make the training specific to government contracts. Use real case examples, including the fact that conspiracy to pay kickbacks carries a maximum penalty of five years in prison and fines up to $250,000.

Step 6: Require Conflict of Interest Disclosure for Vendor Relationships

Employees who have financial relationships with subcontractors must disclose them. Make this disclosure mandatory and annual.

Add a question to your annual Conflict of Interest Disclosure form: "Do you or any member of your immediate family have a financial interest in, or receive any compensation from, any vendor or subcontractor that does business with this organization?"

For employees involved in government contracting, ask a second question: "Have you received anything of value from a subcontractor or vendor in the past 12 months, including meals, gifts, event tickets, or travel?"

Route positive responses to your compliance team for review. Even legitimate relationships create conflicts that need to be managed through recusal or reassignment.

Validation: How to Verify It Works

You've built the controls. Now confirm they can catch the schemes they're designed to stop.

Run a test case. Create a fictional subcontractor in your system and simulate a kickback pattern: three sole-source awards in six months, estimates that exceed final costs by 20%, and invoices with vague line items. Verify that your quarterly sole-source report flags the vendor and that your variance tracking triggers a review.

Check audit findings. After your first quarter of invoice audits, review the discrepancies your team identified. If you're finding no issues, your sample size may be too small or your auditors may need more training on what to look for.

Track Speak-Up Program reports. Monitor whether you're receiving reports related to procurement concerns. If you've had zero reports in 12 months despite running government contracts, your employees either don't know they can report procurement fraud or don't trust that reports will be handled appropriately.

Measure training completion. Verify that 100% of employees involved in government contracting have completed anti-kickback training within the past 12 months. Incomplete training creates gaps that prosecutors will note when evaluating your compliance program under the Federal Sentencing Guidelines for Organizations.

Maintenance: Ongoing Tasks

Fraud controls decay without regular maintenance. Schedule these recurring tasks:

Quarterly: Run your sole-source vendor report. Review variance tracking for patterns. Conduct invoice audits on your selected sample.

Annually: Update anti-kickback training with new case examples. Review and refresh your segregation of duties to account for staff changes. Re-assess your variance thresholds based on actual contract performance data.

When you hire: Add procurement fraud awareness to onboarding for any employee who will touch government contracts. Require Conflict of Interest Disclosure within 30 days of hire.

When you audit: If an internal or external audit identifies a control weakness in procurement, treat it as urgent. The gap that lets a small kickback through will let a large one through. Fix it before the next contract cycle.

The Zagaryuk case ended with a guilty plea and a restitution order of $465,347.75. It could have ended much earlier if the right controls had been in place. Your job is to make sure the next scheme stops at the first inflated estimate, not at the federal courthouse.

Promotional banner graphic asking if you are ready for PCI DSS 4.0 with a call-to-action to get the guide

You Might Also Like