Section 6
Forensic — chart-of-accounts and AP integrity
6.1 Starting point — methodological note
Earlier internal drafts compared the Garden Maintenance expense line (account 470) against a single supplier's AP total. That comparison was wrong — the supplier in question does DA cleaning, and its bills code to account 472 Cleaning Services, not 470 Garden Maintenance. The "gap" framed in those drafts was a methodological artefact. Confirmed by sampling three invoices from that supplier (INV-0001, INV-0151, INV-0250) directly from Xero — all three reference account code 472.
The corrected FY25–26 YTD (1 Jul 2025 – 24 Apr 2026) expense-line split:
| Account | P&L YTD | Stream | Primary suppliers |
|---|
| 470 Garden Maintenance | $3,611,903 | HM gardening | Iron Landscaping, YK Home Maintenance, Lawnlux, Zu Gardening, Burak entities, Aquavit, I Mow 4 U, ~10 others |
| 471 Maintenance & Handyman | $1,478,390 | HM handyman | Handyman providers, same pooling problem |
| 472 Cleaning Services | $1,936,842 | DA cleaning | Major DA provider (~$916K), Happy Helpers, other DA providers |
| 474 Transport taxi | $531,843 | Transport | Uber / 13CABS / Ararat |
| 476 Unassisted shopping | $3,019 | DA | — |
| 477 Wages & Salaries | $1,473,522 | Internal payroll | — |
6.2 The two real issues
(i) Chart-of-accounts pooling — accounts 470, 471, 472 are each a single pooled expense line aggregating ~10+ associated providers per account. There is no per-supplier breakdown on the face of the P&L. Without tracking categories or sub-accounts, management can't see which supplier is concentration-risk, which is growing, or which has a related-party flag. This is a data-integrity issue, not a missing-money issue. Fix = chart-of-accounts restructure.
(ii) Direct transfers backfilled with retrospective AP bills — the records show:
- Two bank-feed stub contacts (
Transfer To kaltun mohamed CommBank + Transfer To kaltun mohamed NetBank) which Xero only auto-creates when unmatched debits hit the operational account. Their existence indicates direct-transfer bypass of the AP module is happening.
- Three specific invoices where the Xero description literally says the invoice was created after the payment, not before (see §6.4).
6.3 Supplier distribution across the four Client Expense accounts
Methodology note. The Xero aged-payables endpoint returns JSON blobs up to ~5MB per supplier, which exceeds typical tool size limits, so the individual per-supplier totals below are estimated from response file size and sampled bill amounts (±30% accuracy). The sum-of-parts estimate lines up with the P&L figure, so the direction is reliable even if individual lines are imprecise. Exact per-supplier totals need to be pulled either via Xero UI export or an Account Transactions report.
| Associated provider |
Owner / natural-person name |
Approx AP volume FY25–26 YTD |
Notes |
| Iron Landscaping | Riyan Mohamed | ~$1.0M – $1.4M | Dominant non-cleaning HM provider. Riyan also owns two EC operational dispatch sheets — relationship requires confirmation. |
| YK Home Maintenance & Cleaning | Yusuf Mohamed | ~$0.7M – $1.1M | Surname overlap with COO — needs ABN / directorship verification. |
| Black Iron Plumbing Pty Ltd | Joseph Bittar | ~$300K – $500K | Independent. |
| Aquavit | Kifah El Houli | ~$100K – $200K | Independent. |
| Zu Gardening | Zuheb Mohamed | ~$100K – $150K | Surname overlap. |
| Lawnlux Maintenance | Riyan Mohamed (same as Iron Landscaping) | ~$50K – $100K | Second AP contact registered to the same natural person — duplicate supplier record. |
| I MOW 4 U — Total Garden Care | Kieran | ~$80K – $150K | Ballarat region. |
| Building Care Solutions | Naim Hassen | ~$80K – $150K | Independent. |
| Naim Hassen (2nd contact, Home Maintenance) | Naim Hassen | ~$30K – $60K | Duplicate supplier contact for the same natural person. |
| Ilhan Canbolat — Gardening | Ilhan Canbolat | ~$20K – $40K | Independent. |
| BZ Property Maintenance | Burak Uslu | $5,104 confirmed | First of four Burak Uslu contact records. |
| Grand Property Maintenance | Burak Uslu | $0 in period | Second of four Burak Uslu contact records. |
| BURAK USLU F5166774991 | Burak Uslu | unknown | Third. |
| BURAK USLU F7827326617 | Burak Uslu | unknown | Fourth. Same natural person billed under four different Xero contacts. |
| Rough implied AP total across all HM providers | | ≈ $3.3M – $3.9M | Consistent with the $3.61M P&L line. |
6.4 Direct-transfer bypass of AP module — evidence
Unambiguous live evidence:
a. Xero has auto-created bank-feed stub contacts for direct transfers:
- Contact "Transfer To kaltun mohamed CommBank" — 0 invoices, exists purely to hold unmatched bank-feed debits.
- Contact "Transfer To kaltun mohamed NetBank" — 0 invoices, same purpose.
Xero only creates these stub contacts when the bank feed pushes a debit to the operational account that the matching algorithm cannot pair to an AP bill. The existence of two such contacts — both pointing to the same natural person — indicates direct-transfer events are happening outside the AP module. This aligns with what was described in the Accounts interview:
"she'd just transfer $25,000 — okay, what's that $25,000 for? There are invoices but… we've paid twice for the same invoice."
Elle & Mohamed — accounts interview
b. Six separate Xero contacts for one related-party supplier. The single supplier is fragmented across:
- Essential Touch Cleaning (main AP contact)
- kaltun mohamed (older contact, some FY23–25 activity)
- Kaltuun Mohamed (alternate spelling)
- kaltuun mohamed (third spelling variant)
- Transfer To kaltun mohamed CommBank (bank-feed stub)
- Transfer To kaltun mohamed NetBank (bank-feed stub)
Having six contact records for the same payee is a classic duplication-enabler — reconciliation can be done under any one of them, and the others obscure the total. This needs clean-up regardless of intent.
c. AP history shows bulk voiding and duplicate bills:
- INV-0151 on 10 Nov 2025 for $65,929.60 — matches almost exactly a $65K round-number direct-transfer the Accounts team described in interview. Uncertain whether this bill was created retrospectively to match an existing unmatched bank debit, or whether both a direct transfer AND this AP bill exist.
- Duplicate INV-0250 on 21 Apr 2026 for $27,000 — one instance PAID, one VOIDED on the same day. Either a data-entry error caught in time, or evidence that a duplicate payment was being processed and reversed.
- Bulk void on 25 Nov 2025 of the entire INV-0104 through INV-0119 batch (originally dated 16 Nov 2025, ~$13K+ combined).
- Bulk void on 1 Dec 2025 of late-July 2025 bills (INV-0019 to INV-0022, ~$16K combined) — four-month delay between bill creation and void.
d. Deleted customer-side invoices. Xero shows deleted ACCREC (sales) invoices INV-242506, INV-242507, INV-242508 raised against the older "kaltun mohamed" contact — i.e. EC at some point treated the related-party as a customer, raised three invoices, then deleted them. Unusual. Possibly a journal-reversal workflow or possibly something that needs explanation.
6.5 Surname concentration — needs ABN verification before characterising
Stepping back, a secondary observation from the contact list is that several of the top HM suppliers share the same surname:
- Essential Touch Cleaning — Kaltun Mohammed (EC COO — confirmed related-party)
- Iron Landscaping — Xero contact under name "Riyan Mohamed" (relationship to EC unconfirmed)
- Lawnlux Maintenance — same Xero contact name "Riyan Mohamed" (same natural person OR second person with same name)
- YK Home Maintenance — Yusuf Mohamed
- Zu Gardening — Zuheb Mohamed
Important caveat: "Mohamed" is one of the most common surnames in the world. Surname overlap alone is not evidence of family connection. The concentration is worth investigating, but it is not grounds for framing as a "family supplier network" without:
- ASIC / ABR lookup confirming the directorship / ownership of each entity.
- Payroll cross-check confirming whether any EC employee shares identity with any of the named owners.
- Direct confirmation from leadership about actual relationships.
The accurate framing is: surname concentration is notable and warrants investigation. If investigation confirms actual relationships, the disclosure exposure expands. If it doesn't, the concentration is just coincidence in a narrow pool of DA/HM suppliers in EC's network.
6.6 Recommended next forensic steps
- Export the Account Transactions report for account 470 directly from the Xero UI, grouped by contact. That gives an exact per-supplier breakdown of the $3.61M in one report.
- Verify ABN + directorship for Iron Landscaping, Lawnlux, YK Home Maintenance, Zu Gardening, and the four Burak-Uslu entities via ASIC. Confirm (or rule out) actual relationships before any external characterisation.
- Reconcile the six related-party contacts into one, retiring the five duplicates. Without this, supplier-level oversight cannot work.
- Reconcile the four Burak contacts similarly.
- Full bank-transaction ledger export for Business Account #1867 for FY25–26 YTD, filtered to
AccountCode = 470, with counterparty narration — to quantify direct-transfer bypass exactly.
- Interrogate the three deleted ACCREC invoices (INV-242506 / -07 / -08) — why was the related-party invoiced as a customer, by whom, and why were they deleted?