A single forged reference secured a Property and Facilities Manager role at Oranga Tamariki in 2021. Over the next 15 months, the employee, Neha Sharma, approved 326 invoices totalling $2.1 million to a contractor she had established—her husband’s company, Divine Connection. The procurement bypassed declared conflict-of-interest protocols. Approximately $680,000 was siphoned to third parties, with $791,500 subsequently transferred to Indian bank accounts. The fraud continued post-resignation when Sharma used another forged reference to gain employment at Waka Kotahi NZ Transport Agency. Sentencing in May and June 2025 resulted in three years’ imprisonment and 12 months’ home detention, with assets restrained under the Criminal Proceeds (Recovery) Act 2009.
The Risk
This is not a simple fraud. It is a mathematical proof of systemic control failure. The $2.1m audit trail leads directly to a governance gap. Directors may be personally liable if they fail to ensure adequate financial management and internal control systems under the Companies Act 1993. The failure to conduct basic due diligence—verifying a single reference—created the initial breach. The subsequent failure to detect a blatant, undeclared conflict of interest and a pattern of 326 non-compliant invoices indicates a potential breach of the duty of care, diligence, and skill. The SFO’s statement underscores the inter-agency risk: a known fraudster moved seamlessly between Crown entities. The financial loss is quantifiable. The liability exposure is not.
The Control
Treat pre-employment screening as a financial control, not an HR formality. Implement a centralised, auditable register for all declarations of interest, with automated alerts for procurement activity linked to declared entities. Mandate data-sharing protocols between public sector agencies for vetting history, subject to the Privacy Act 2020. The control environment must be designed to detect the anomaly, not just process the transaction.
The Challenge
These are the critical questions you should be raising at the board table:
| What is the quantified false-negative rate of our pre-employment screening, and what is the projected financial exposure of a single undetected forged document? | |
| Show me the data lineage for the last 100 invoices approved by a manager with a declared external interest. How many triggered an automated review? | |
| Precisely what vetting information do we share—and receive—with other agencies in our sector, and what is the protocol when a red flag is identified? |