Payments made to phony vendors

Remember if left unaccounted for and/or if a lack of oversight exists, an employee can set up a phony vendor account(s). Payments made to this phony vendor are actually deposited into the employee’s bank account. In another embezzlement scheme I've seen involving medical supplies, a real vendor is overpaid and the vendor pays the employee a kickback. So the moral of the story here is simple: How good are your internal controls with regard to vendor payments and vendor relations?