Accounts Payable Audit Checklist and Evidence

The AP audit checklist

Ten areas cover nearly every AP audit request. For each, have the evidence in the right-hand column ready for the whole period, not just a sample.

Area	What auditors test	Evidence to keep
Cut-off	Invoices and receipts around period end are recorded in the right period.	Receiving records and invoices dated a few days either side of period end, with the period each was posted to.
Completeness (unrecorded liabilities)	All liabilities that exist at period end are recorded.	Payments made after period end and invoices received after period end, each traced to the AP ledger or the accrual list; the accrual schedule with support.
Existence and accuracy	Recorded payables are real and correctly valued.	Invoice, PO and receiving record for sampled items; vendor statement reconciliations; vendor confirmations if requested.
Three-way match	Invoices were paid only for goods ordered and received, at the agreed price.	Match result per invoice, the tolerances in force, and who approved any variance and why.
Approvals	Each invoice was approved by someone with the authority to approve it.	The approval matrix in force during the period, and the approver, date and time for each sampled invoice.
Segregation of duties	No one person can set up a vendor, approve an invoice and release payment.	User access lists by role for the AP and accounting systems, and any conflicts with their compensating controls.
Vendor master changes	Changes to vendor records, especially bank details, were authorised and verified.	A change log with who changed what and when, independent approval, and callback verification for bank changes.
Duplicate payments	The same invoice was not paid twice.	The duplicate check run before payment, any duplicates found and how they were recovered.
AP-to-GL reconciliation	The AP subledger agrees with the general ledger control account.	Signed, dated month-end reconciliations with reconciling items explained, plus the aged payables report.
1099 and W-9 (US)	Reportable vendors have tax IDs on file and were reported correctly.	W-9s for active vendors, the 1099 vendor list, filed forms and backup withholding records where it applied.

Auditors choose their own samples and procedures; this list covers the areas most AP audits test. Print this page for a one-page checklist.

Cut-off testing

Cut-off testing checks that goods and services received before period end are recorded in that period, and those received after are not.

Auditors pick receiving records and invoices from the last days of the period and the first days of the next, then check which period each was posted to. Keep receiving dates in the system, not only on paper, and book accruals for goods received but not yet invoiced. The AP month-end close guide walks through cut-off and accruals.

Completeness and the search for unrecorded liabilities

The search for unrecorded liabilities looks at payments and invoices after period end to find amounts that belonged in the earlier period but were not recorded.

It is usually the biggest AP test, because understatement of liabilities is the main AP risk. Help it go quickly by keeping an accrual schedule with support, logging invoices on the day they arrive, and being able to show the received date of every invoice in the weeks after period end.

Three-way match evidence

For PO-backed invoices, auditors want to see the purchase order, the receiving record and the invoice for each sample, and evidence that variances were approved.

The weak spot is usually variances: an invoice paid above the PO price with no record of who accepted the difference. Keep the tolerance settings that were in force and the reason for each override. See the three-way matching guide for how tolerances work.

Approvals and segregation of duties

Auditors check that each invoice was approved within the approver's limit, and that no one person can create a vendor, approve its invoice and release the payment.

Keep the approval matrix for the period and export user roles from each system. In a small team where duties cannot be fully split, document a compensating control such as an owner review of every payment run. More on this in invoice approval routing and segregation of duties.

Vendor master changes

Auditors review who added or changed vendor records during the period, especially bank details, and whether each change was approved and verified.

A bank-detail change made from an email is the classic route to payment fraud. Require a callback to a number already on file, approval by a second person, and a log of every change. Review new and dormant vendors regularly; our vendor fraud red flags guide lists what to look for.

Duplicate payments

Auditors often run their own duplicate analysis on the payment file: same vendor, same amount, similar invoice numbers or dates.

APQC's benchmarking puts duplicate or erroneous payments at 0.8% of annual disbursements for top performers and 2% for bottom performers. Run the same analysis before the auditors do and document what you recovered. See how to prevent duplicate invoice payments.

How Aequo AP supports an AP audit

Aequo AP records the evidence auditors ask for as invoices move through the process, rather than at year-end.

Every invoice keeps an audit trail of who did what and when, from capture through coding, approval and sync. Owner, admin, member and custom approval roles decide who can code, approve and sync, which supports segregation of duties. Each invoice is checked against the vendor's past invoices for duplicates, exceptions carry an owner and an SLA, and the controls monitor lists open segregation-of-duties conflicts, suspected duplicates, tolerance breaches and SLA breaches in one view.

Frequently asked questions

What are unrecorded liabilities?

Unrecorded liabilities are amounts the company owed at period end that are missing from the books, usually because the invoice arrived late or the goods were received but not invoiced. Auditors look for them by examining payments and invoices after period end and checking whether each relates to the earlier period.

What are the 7 steps in the audit process?

Firms describe it differently, but a common seven-step version is: plan the audit, assess risk, understand internal controls, test controls, perform substantive testing, evaluate the results, and report. In AP, substantive testing is where the search for unrecorded liabilities and cut-off testing happen.

What are the 5 C's of auditing?

The 5 C's describe how an audit finding is written up: criteria (what should happen), condition (what actually happened), cause (why), consequence or effect (the impact), and corrective action (what will fix it). Using them makes AP findings clear and actionable.

What are the key internal controls for accounts payable?

Segregation of duties between vendor setup, invoice approval and payment; approval limits by amount; three-way matching for PO invoices; a duplicate check before payment; verified, approved vendor master changes; and a monthly AP-to-GL reconciliation.

What should effective internal controls over financial reporting include?

The COSO framework, which most auditors use, has five components: the control environment, risk assessment, control activities, information and communication, and monitoring. In AP, control activities include matching, approvals and segregation of duties, and monitoring includes reviewing exceptions and control breaches.

Is double invoicing illegal?

Sending the same invoice twice by mistake is an error, and the supplier should credit or refund the duplicate payment. Deliberately billing twice to get paid twice can be fraud. Either way, AP should stop duplicates before payment and keep a record of any recovered.

Keep audit evidence as you go

Aequo AP is AP automation for SMB and mid-market teams on every major accounting system or ERP. Every invoice keeps a history of who coded, approved and synced it; roles decide who can do each step; and a controls monitor shows segregation-of-duties conflicts, suspected duplicates and SLA breaches in one view.

Take the AP audit readiness assessment Book a demo

Sources

Checked on October 24, 2026. Vendor capabilities and prices change; confirm current details with each vendor.

APQC Open Standards Benchmarking, via CFO.com Metric of the Month: Detect and Prevent Duplicate or Erroneous Payments — Duplicate or erroneous payments: 0.8% of annual disbursements (top performers) vs 2% (bottom)
APQC, via CFO.com Metric of the Month: Percentage of Error-Free Disbursements — Error-free disbursements the first time: 98% / 95% / 88%