Accounts Payable Audit: Procedures and Checklist

An accounts payable audit is a structured review of your payables records, transactions, and controls to confirm that every invoice is real, recorded once, approved by the right person, and posted to the correct period. Internal teams run it on a cycle to catch errors and fraud early; external CPAs run it during the annual financial statement audit to verify the AP balance is complete and accurate. The core work is the same either way: test the AP aging, search for unrecorded liabilities, confirm balances with vendors, and check that approvals and invoice matching actually happened.

Last updated June 2026.

What is an accounts payable audit?

An accounts payable audit is an examination of how your company records and pays what it owes suppliers. The auditor pulls a sample of invoices and payments, traces each one back to its supporting documents, reviews the controls around approval and payment, and confirms the accounts payable balance reported at period end is right. The goal is assurance: that payables are complete, accurate, properly authorized, and recorded in the correct period, with no duplicate or fraudulent payments buried in the ledger.

There are two versions of the same exercise. An internal AP audit is run by your own finance or internal audit team, usually quarterly or annually, to find process gaps and fraud risk before they grow. An external audit is part of the yearly financial statement audit, where independent CPAs verify the AP figure is not materially misstated under US GAAP. The procedures overlap heavily; the difference is who runs it, how much independence is required, and whether the output is an internal report or an opinion on your financials.

Why audit accounts payable?

Accounts payable is one of the highest-risk areas in the ledger because it is where cash leaves the company. A weak AP function quietly bleeds money through duplicate payments, missed early-payment discounts, billing fraud, and overpayments that nobody catches. A regular audit puts a check on all of it. Most teams audit AP for four reasons:

• Catch and prevent fraud. Fake vendors, inflated invoices, and altered bank details are common AP fraud schemes. An audit tests whether your accounts payable fraud prevention controls actually work.
• Find duplicate and erroneous payments. Auditors scan for the same invoice paid twice, the same amount to the same vendor in a short window, and credits that were never applied. Recovered overpayments often pay for the audit itself.
• Stay compliant. Public companies need Sarbanes-Oxley (SOX) documentation of AP controls, and every business needs accurate liabilities for GAAP financial statements and clean 1099 reporting to the IRS.
• Strengthen the process. The findings show exactly where approvals are skipped, where matching breaks down, and where the vendor master is dirty, which gives you a concrete list of fixes.

The accounts payable audit process: four phases

Whether it is internal or external, an AP audit moves through the same four phases.

1. Planning

The auditor defines the scope, the period under review, and the materiality threshold, then notifies the business and holds a kickoff meeting. They request a document list up front: the AP aging, the general ledger, the vendor master file, a sample of invoices with their purchase orders and receiving records, bank statements, and your written AP policies. Good planning is mostly about deciding what to sample and which risks to focus on.

2. Fieldwork

This is the heart of the audit and where most of the time goes. The auditor runs the substantive procedures below: reconciling the AP subledger to the general ledger, testing samples against supporting documents, confirming balances with vendors, and searching for liabilities that were not recorded. Fieldwork can take a few days for a small business or several weeks for a large one.

3. Reporting

The auditor summarizes the findings in a written report: the procedures performed, any misstatements or control weaknesses found, the dollar impact, and recommendations. For an external audit this feeds the overall opinion on your financial statements; for an internal audit it becomes a remediation plan with owners and due dates.

4. Follow-up

Strong audit programs circle back, usually after a year, to check whether the recommended fixes were implemented and whether they worked. Follow-up is what turns a one-time audit into year-over-year improvement instead of the same findings repeating.

Accounts payable audit procedures

The audit procedures for accounts payable are the specific tests an auditor runs during fieldwork to gather evidence. These are the ones you should expect, and the ones an internal team should run on itself before an external auditor arrives:

• Reconcile the AP subledger to the general ledger. The detailed payables listing must tie to the AP control account in the GL. Any difference is investigated before anything else.
• Search for unrecorded liabilities. The classic AP test. The auditor reviews payments and invoices received after the period end to see whether any belong to the period under audit but were left off the books. This targets completeness, the biggest risk in payables, because the temptation is always to understate what you owe.
• Test cutoff. Invoices and goods received right around the close date are checked to confirm they landed in the correct period.
• Run analytical procedures. The auditor compares this period's AP balance, days payable outstanding, and expense trends to prior periods and budget, then investigates anything that moved more than expected.
• Confirm balances with vendors. For significant suppliers, the auditor sends confirmation requests or reconciles your records to the vendor statement. Differences can reveal missing invoices, unapplied credits, or disputes. This mirrors a routine vendor statement reconciliation.
• Test three-way matching. For a sample of invoices, the auditor confirms the invoice, purchase order, and receiving report agree on quantity and price before payment was approved. This is where weak three-way matching shows up fast.
• Review the vendor master file. Auditors look for duplicate vendors, missing or invalid tax IDs, and recently changed bank details, all of which are fraud and error risks.
• Scan for unusual items. Debit balances in AP, very old unpaid invoices, round-dollar amounts, and out-of-sequence invoice numbers from a single vendor all get pulled for a closer look.

The five assertions auditors test in accounts payable

Behind the procedures sit the audit assertions: the specific claims your financial statements make about payables. For accounts payable, completeness carries the most weight, because the risk is understating what you owe rather than overstating it.

Running underneath all five is segregation of duties: the people who set up vendors, approve invoices, and release payments should not be the same person. Weak segregation of duties is the control gap auditors flag most often, and it is covered in depth in our guide to accounts payable internal controls.

Accounts payable audit checklist

Use this accounts payable audit checklist to prepare for an external audit or to run a thorough internal one. Each item is something an auditor will test, so clearing it in advance removes findings before they happen.

What auditors look for: common red flags

Most AP audit findings cluster around the same handful of warning signs. Auditors, and any internal reviewer worth their salt, watch for:

• Duplicate payments: the same invoice number or dollar amount paid twice, which is the single most common recoverable error. Our breakdown of duplicate invoice payments covers how they slip through.
• Duplicate or fake vendors in the master file, especially ones with no tax ID or with an address that matches an employee.
• Invoices paid without a purchase order or without approval, which signals a broken control.
• Changes to a vendor's bank account details right before a large payment, a hallmark of payment redirection fraud.
• Round-dollar invoices, sequential invoice numbers from one vendor, and amounts that sit just under an approval threshold.
• Old unpaid invoices and debit balances that nobody has explained.
• Manual journal entries posted directly to accounts payable, which can hide adjustments.

How to prepare for an accounts payable audit

You cannot change the findings on audit day, but you can clear most of them in the weeks before. To prepare:

1. Reconcile first. Tie the AP subledger to the GL and resolve every difference, no matter how small.
2. Clean the vendor master. Merge duplicate vendors, collect missing W-9s, and validate tax IDs so 1099 reporting and the audit both go smoothly. If you track supplier insurance, keep certificates current with a tool like certificate of insurance tracking software so compliance documents are ready when the auditor asks.
3. Pull and review the aging. Explain or clear old balances and debit balances before they get flagged.
4. Gather supporting documents. For your likely sample, have the invoice, PO, and receiving record together. If your purchase orders live in spreadsheets or email, consolidating them in purchase order management software makes the matching evidence easy to produce.
5. Reconcile payments to the bank. Confirm recorded payments actually cleared. Teams that export the bank feed and match it line by line, often by converting statements with a bank statement to Excel converter, catch cutoff and unrecorded items before the auditor does.
6. Document your controls. Write down who approves what, the thresholds, and how duties are split, then run your own pre-audit sample to find weak spots.

How AP automation makes audits easier

Manual accounts payable is hard to audit because the evidence is scattered across email, paper, and spreadsheets, and the controls live in people's heads. AP automation fixes that by making the process self-documenting. Every invoice carries a complete, time-stamped audit trail from capture to payment, so pulling a sample takes minutes instead of days. Matching and approvals are enforced by the system, not left to memory, which closes the exact gaps auditors test. Purpose-built accounts payable audit software runs duplicate detection and continuous controls monitoring on every invoice so exceptions surface the day they happen.

Specifically, automation gives you a permanent audit trail, automated invoice matching software that documents every three-way match, enforced approval routing with built-in segregation of duties through invoice approval software, and duplicate detection that blocks repeat payments before they happen. A full accounts payable software platform ties it together, and a touchless invoice processing workflow means most invoices reach payment with the evidence already attached. The result is fewer findings, faster fieldwork, and a function that holds up to scrutiny year after year. For the controls that prevent findings in the first place, see our accounts payable best practices guide.

Frequently asked questions

How do you audit accounts payable?

You audit accounts payable by reconciling the AP subledger to the general ledger, then testing a sample of invoices against their purchase orders, receiving records, and approvals. You search for unrecorded liabilities by reviewing payments made after period end, confirm balances with key vendors, and scan for duplicates, debit balances, and unusual items. The work moves through planning, fieldwork, reporting, and follow-up.

What are the audit procedures for accounts payable?

The main procedures are reconciling AP to the GL, searching for unrecorded liabilities, testing cutoff, running analytical comparisons to prior periods, confirming balances with vendors, testing three-way matching on sampled invoices, reviewing the vendor master file, and scanning for unusual items like debit balances and round-dollar amounts. Together they test completeness, existence, accuracy, cutoff, and authorization.

What do auditors look for in accounts payable?

Auditors look for understated liabilities, duplicate payments, fake or duplicate vendors, invoices paid without approval or a purchase order, recent vendor bank-detail changes, and weak segregation of duties. They also flag old unpaid invoices, debit balances, round-dollar amounts, and out-of-sequence invoice numbers, because each one points to a possible error or fraud.

How often should accounts payable be audited?

Most companies have accounts payable reviewed once a year as part of the external financial statement audit. On top of that, internal AP audits or spot checks are best run quarterly, or monthly for high-volume teams, so duplicate payments and control gaps are caught while they are still small and recoverable rather than a year later.

What documents are needed for an accounts payable audit?

Plan to provide the AP aging report, the general ledger, the vendor master file, a sample of vendor invoices with their matching purchase orders and receiving documents, bank statements and payment records, vendor statements, signed W-9s, and your written AP policies and approval matrix. Automated AP systems can export most of this in a few clicks.