How to prepare your accounts payable process for an audit

When an auditor asks for the approval behind a £40,000 invoice paid eight months ago, you show the quality of your accounts payable (AP) process by how quickly you can answer. In an accounts payable audit, auditors test whether your recorded liabilities are complete, accurate, in the right period, authorised, and free of duplicate or fraudulent payments. This guide is for UK and European small and medium-sized business (SME) controllers and AP managers. It is educational content rather than accounting advice or advice on legal and tax matters, and requirements vary by jurisdiction and audit scope.

Key takeaways

• Auditors test completeness, accuracy, cut-off, validity, and classification.

• Completeness is hardest to evidence because auditors look for what isn’t recorded.

• Controls count only when you can show them operating.

• The vendor master file is where many fraud and duplicate-payment risks start.

• A connected trail from request to export answers most sample requests.

What is an accounts payable audit?

An accounts payable audit is an examination of your purchase invoices, payments, supplier records, and the controls around them, carried out to confirm that the payables balance and purchase expenses in your accounts are fairly stated. It can sit inside a statutory audit or run as an internal review scoped by the board or audit committee.

The objectives are the same in both cases. The liabilities must exist and belong to the company, nothing owed can be missing, amounts and periods must be right, and payments must reach legitimate suppliers. Scope normally covers supplier records, invoice capture, approval, matching, payment runs, reconciliations, accruals, and agreeing the aged creditors listing to the general ledger.

The AP assertions auditors test

Each assertion translates into a question your records have to answer, and the direction of testing differs between them. For completeness, the auditor starts outside the ledger and traces inward from post-year-end payments. Supplier statements and goods received notes also provide starting points. For validity, the auditor starts from a ledger entry and traces back to the documents.

1. Completeness: Every liability incurred before the period end is recorded. You need post-year-end invoices and payments traced to the ledger or accruals, plus goods received but not invoiced, and management’s written confirmation carries little weight because independent evidence exists.

2. Accuracy: Amounts and VAT are right. Currency translation is also correct. Auditors reperform calculations and check control-account reconciliations, so have accrual workings and foreign-currency retranslations ready.

3. Cut-off: Transactions sit in the period the goods or services arrived. The goods received note, not the invoice date, decides the period, so auditors ask for the last receiving document numbers at year end and sample both sides of the date.

4. Validity: Recorded payables are genuine obligations, and payments went where they should. Evidence is the purchase order, the goods received note, the approved invoice, and the payment confirmation for each sampled item.

5. Classification: Postings land in the correct general ledger account and payables are presented as current liabilities. Auditors sample postings and check the general ledger code (GL code) against the nature of the purchase.

Documents the auditor will request before starting

Most auditors send a prepared-by-client list before fieldwork. Agreeing it before year end avoids a first-week scramble.

Auditors check that any listing you produce is complete and accurate before relying on it, so record counts, date filters and the report source will come up. A system-generated listing with its extraction parameters noted is accepted faster than a reworked spreadsheet; ICAEW’s data-extraction guidance says there is no “immaterial” level of poor completeness in an extract.

Internal controls auditors examine in accounts payable

Auditors inspect or reperform matching, approval, segregation-of-duties, and duplicate-payment controls rather than relying on what you tell them, so each needs an evidence trail. For automated controls, they also look at who has system access and how changes are managed.

Two-way and three-way matching

In a two-way match, your AP team compares the invoice with the purchase order; in a three-way match, they also check the goods received note. Through matching, they stop payments for goods never ordered or received and check for liabilities incurred but not recorded. Matching an invoice to the order alone leaves the receipt unproven, so the goods received note has to be part of the match. ICAEW’s February 2026 guidance on fake invoices says preventive checks “like three-way matching, duplicate invoice checks and limiting manual overrides should be standard practice”. Auditors may ask for the configured tolerance and the invoices that failed the match. They may also ask who cleared each exception.

Approval authority and evidence

Approval evidence has to show who approved, when, what they saw, and that they were allowed to. The baseline is an approval matrix setting delegated limits by role, and the auditor samples invoices to check each recorded approver appears on the authorised list. A payment run should be approved from the full payments list agreed to support, not from a run total. Role and permission settings exported from your approval workflows, together with retained approval logs, give the auditor something to inspect.

Segregation of duties

Separate supplier setup, invoice capture, invoice approval and payment release so no one person controls the whole chain. ICAEW’s guidance asks for “clear segregation of duties between who sets up vendors, who approves invoices, and who makes payments”.

In a small finance team that separation won’t always hold, so auditors look for documented compensating controls such as dual authorisation above a defined amount and senior review of exception reports. Owner-manager review can be a strong control in a smaller entity, though auditors weigh the risk that the same person overrides it.

Duplicate payment checks

Duplicate payments usually come from repeated entry or overlapping processing channels:

• the same invoice entered twice, as a copy or a re-keyed number, or one supplier set up under two records;

• invoices processed through both PO and non-PO channels.

Auditors look for a check that runs before each payment run, with evidence of what it flagged and how you resolved it. A recovery audit is a useful backstop, but auditors give more weight to a check that runs before payment.

Vendor master file integrity

Your vendor master file is where many fraud and duplicate-payment risks start, so auditors test it even when the payables balance looks clean. Typical checks include:

• duplicate records sharing a name or VAT number, or sharing bank details;

• supplier bank accounts or addresses matching an employee’s;

• incomplete profiles;

• dormant suppliers still active.

The core evidence is a change log showing who requested and who approved each amendment, with the approver different from the creator. A documented call-back to a known supplier contact before the change takes effect, using details already on file rather than those in the request, is a control against payment diversion. Where your system blocks purchase ledger clerks from editing master data, the auditor may test that restriction directly.

Payment history and the digital audit trail

A connected audit trail links the purchase request, approval, purchase order, goods received note, invoice, payment, and accounting export for every transaction, so a sample request becomes a search rather than a reconstruction. In many teams those records live in separate systems:

• approvals in email and orders in a spreadsheet;

• invoices in a shared drive and payments in the bank portal. Producing one sample then means gathering five documents and proving they belong together. The auditor spends the time checking that the pieces match, and you spend the time finding them.

Business controls can create a reliable audit trail between an invoice and the supply it relates to, an approach described in HMRC’s guidance on electronic invoicing. A connected workflow can help meet that standard. Spendesk is an all-in-one spend management platform consolidating company cards, expense management, accounts payable, procurement, and budgeting. Its accounts payable automation can support connected invoice workflows in which the captured invoice, its match result, each approval and approver, the payment status, and the accounting export sit against one record. Finance still makes every approval and accounting decision, and the evidence stays attached and searchable.

Reconciling the AP subledger to the general ledger

The auditor agrees the aged creditors listing to the general ledger control account to establish the population they sample from. The listing has to tie to the trial balance. When you prepare the reconciliation before fieldwork and someone other than the preparer reviews it, the auditor can base later tests on that checked population.

The records need to support two checks:

• Compare the aged payables listing by supplier and invoice with the control account balance, then agree both to the trial balance. Run all records for the same date.

• Show the ledger balance and subledger total in the reconciliation. Give each reconciling item a date and description.

Typical items include journals posted directly to the control account and allocation-date differences. Credit notes received but not yet posted may also need explaining. A ledger that nets to zero does not prove completeness; the auditor will still want the two-way reconciliation with the differences explained.

Pre-audit accounts payable checklist

Run through these steps in the weeks before fieldwork, starting with the reconciliation that anchors everything else:

1. Reconcile aged creditors to the control account and explain every difference. Get reviewer sign-off.

2. Agree the prepared-by-client list before year end, with an owner and date per item.

3. Export system-generated invoice and payment listings, together with approval listings. Record date ranges and filters.

4. Reconcile statements for your largest and most active suppliers, including nil balances.

5. Trace post-year-end invoices and payments relating to the current year to the ledger or accruals.

6. Record the last year-end goods received note number and keep documents from both sides.

7. Confirm each sampled invoice has a purchase order and receipt evidence. Check that its approver was authorised.

8. Update the approval matrix and remove approvers who’ve left or changed roles.

9. Run a duplicate check on invoice numbers and amounts, then check supplier records. Document corrections.

10. Merge duplicate suppliers and deactivate dormant ones. Review the bank-detail change log.

11. Check a sample of GL code postings and correct misclassified purchases.

12. Gather match exceptions and signed payment-run lists as evidence that controls operated. Include access reviews.

Items 7, 9, 10, and 11 mirror findings reported in UK public-sector and academy-trust audits, including missing approvals, duplicate payments, documentation gaps, misclassified entries and stale supplier data. If purchasing and payment records are disconnected, Spendesk’s procure-to-pay module can bring guided requests, approvals, purchase orders, supplier invoices, and payments into one workflow.

Frequently asked questions

The questions below cover internal versus external audits, common findings, the golden rules of AP, and preparation timing.

How does an internal AP audit differ from an external one?

An internal AP audit gives the board or audit committee assurance over your controls, with a scope the organisation sets. An external audit forms an opinion on whether the annual accounts give a true and fair view, scoped by materiality and the assertions.

What are the most common AP audit findings?

Commonly reported findings include missing or retrospective purchase orders, approvals outside delegated limits, duplicate payments, unaccrued liabilities, and incomplete documentation. Auditors raise these as deficiencies because each one means a control existed on paper but can’t be shown operating.

What are the golden rules of accounts payable?

No payment without a matched, approved invoice; no one person able to control supplier setup and invoice approval as well as payment release; no bank-detail change without independent verification; and no record that can’t be traced from request to payment.

How far ahead should you start preparing for an AP audit?

Start before the year end. ICAEW’s April 2026 guidance for SMEs recommends engaging auditors and agreeing the information list before year end, because poor-quality information and slow responses extend the timeline and raise the cost. Regular reconciliations through the year turn the pre-audit period into a review rather than a rebuild.

With a connected trail, the approval behind that £40,000 invoice is a search away. If you want to see how a connected AP workflow could hold invoices, approvals, payments, and supporting documents together ahead of your next audit, book a Spendesk demo.