As a financial auditor I've no idea how we would pick this up. It wouldn't hit the books of the company at all. We would research board members and check their other directorships but that only covers executives and their formal relations. It would be more likely to be picked up by the auditors of the company offering the bribe (what's this payment for?).

How do you notice this? If the man is the ultimate arbiter of what does or does not get purchased, you don’t know why right?

Back when I worked for BT an anonymous letter from "a friend" to the internal security team was one option.

By following the basics of ISO27K1, for example:

Good infosec teams keep inventory of all the software used in the org. If they see that the org already pays a vendor for software doing X, a question should be raised, why we need another one for doing the same thing.

Also, each new vendor or software provider needs go get a "security clearance", after the infosec teams checks their state of security.

These kinds of practices would probably discover the shady intents.