An AP audit checklist is the list of documents, controls, and period-end checks a finance team works through so auditors can verify that every payment was authorized, every liability was recorded in the right period, and every amount matches what was ordered and received. This checklist is built for mid-market companies with 100 to 1,000 employees, the kind running AP with one to three people, and it covers external financial statement audits, internal audits, IRS and 1099 reviews, and grant or government compliance audits.

This is a practical guide, not tax, legal, or audit advice. For decisions specific to your company, confirm with your CPA or external auditor.

If your AP runs on email approvals, invoices in a shared drive, and POs created after the fact, those two weeks are going to hurt. If your evidence was captured at each step, the same request is a few exports and a checklist review. This page exists to get you to the second outcome.

In our onboarding work with mid-market finance teams, the split is consistent. The teams that move through audits without drama captured the evidence at each step. The teams that lose a week are rebuilding it from three inboxes and someone’s memory. The checklist below is how you get into the first group and stay there.

What do AP auditors actually test?

AP auditors test three control objectives. Knowing them makes every item on their request list make sense.

• Authorization. Was every payment approved by the right person before money moved? They want documented evidence with a name and a timestamp, not someone’s recollection.
• Completeness. Were all liabilities recorded in the correct period? This catches cut-off errors and unrecorded accruals.
• Accuracy. Do the amounts paid match what was ordered and received? This is what 3-way matching tests directly.

Purchase order documentation tests authorization. Cut-off schedules test completeness. Invoice matching tests accuracy. Segregation of duties sits across all three. Now to the checklist.

AP Audit-Readiness Self-Assessment (score this first)

See what audit-ready AP looks like for a company your size →

The AP audit checklist (with owner and evidence location)

This is the part most pages leave out. A control you cannot produce evidence for is not a control. For each item, know who owns it and where the proof lives before the auditor asks.

Documentation readiness

Control	Tests	Owner	Where the evidence lives	How to pull it
PO exists, dated before the invoice	Authorization	AP / Procurement	Procurement system or PO log	Export PO register with PO and invoice dates side by side
Documented approval per PO and invoice	Authorization	Controller	Approval workflow log	Pull approval history by transaction ID
Invoices centralized in one system	Completeness	AP	AP system / invoice repository	Search by vendor or date, not by inbox
Goods receipt on file for physical purchases	Accuracy	Receiving / Ops	Procurement system	Filter receipts by PO number
3-way match status confirmed	Accuracy	AP	Matching engine or manual match file	Run unmatched-invoice exception report
Vendor master reviewed and clean	Fraud risk	Controller / AP	Vendor master file	Export active vendors with W-9 and banking flags

Period-end controls

Control	Tests	Owner	Where the evidence lives	How to pull it
Cut-off test on the last five business days	Completeness	Controller	Invoice register + GL	Pull invoices dated near period-end, confirm posting period
Accruals for goods received not invoiced	Completeness	Controller	Open-PO / receipt report	Match open receipts against booked invoices
Bank reconciliation, no open items	Accuracy	AP / Controller	Reconciliation file	Tie AP subledger payments to cash outflows
AP subledger ties to GL	Accuracy	Controller	Subledger + GL	Run subledger-to-GL tie-out at close

Vendor, payment, and fraud controls

Control	Tests	Owner	Where the evidence lives	How to pull it
Duplicate-payment check	Accuracy / fraud	AP	Payment run register	Report same vendor, same amount, same period
New-vendor verification	Fraud risk	Controller	Vendor master change log	List vendors added in the period, confirm setup approval
Missing-PO invoices investigated	Authorization	AP	Exception report	Pull invoices paid with no PO, document each exception
Banking-change approvals	Fraud risk	Controller	Change-approval log	Export banking changes with the separate approval attached
Segregation of duties	Fraud risk	Controller	User-access report	Pull the access report, flag one name across setup, approval, and payment

What to gather by audit type

Not every audit tests the same controls. Pull the right evidence for the audit you are facing instead of preparing everything for everyone.

Audit type	What auditors test	Documents to gather
External financial statement	Authorization, completeness, accuracy, cut-off	POs, invoices, approvals, goods receipts, cut-off schedule, AP subledger tie-out
Internal audit	Policy compliance, segregation of duties, approval thresholds	Approval workflow config, policy exceptions, role assignments, written purchasing policy
IRS / tax	Expense classification, 1099 compliance, deductibility	Vendor W-9s, 1099 filings, GL classification for contractors, meals, entertainment
Grant / government compliance	Restricted-fund usage, competitive bidding	Fund-restriction records, grant-expenditure approvals, bid documentation

For the tax-audit row, confirm your contractor documentation against the current IRS rules for Form 1099-NEC and Form W-9. Thresholds and treatment change, so verify with your CPA for your filing year.

Grant and government compliance audits hit charter schools, nonprofits, and life-science companies on government funding most often. If that is you, the competitive-bidding evidence is usually the gap.

What is the most common AP audit finding?

The most common AP audit finding at mid-market companies is purchase orders created after the invoice arrives, not before the purchase. (This reflects ProcureDesk implementation observations across mid-market finance teams. It is directional, not a formal study, and is flagged for internal data sign-off.)

An employee places an order, the invoice shows up, and a PO gets created retroactively to match it. To an auditor that reads as a control bypass, because it is one. It does not matter that the purchase was legitimate. The authorization control was not in place when it needed to be.

The fix is upstream, and it is the highest-leverage item on this entire checklist. A purchase request has to be submitted and approved before any order reaches a vendor. No approved PO, no order. Once that control is real, items 1 through 5 of the self-assessment take care of themselves, and the most common finding stops appearing in your audits. For the mechanics, see our guide to the purchase order approval process.

Why does audit prep take some teams two weeks and others two hours?

The gap is method, not effort. Teams that scramble are reconstructing evidence that was never captured in a durable place. Emails get deleted. The person who approved the PO left in March. The spreadsheet got overwritten.

The benchmark gap is real and measurable. Ardent Partners’ AP Metrics That Matter 2025 puts manual AP processing at $12.88 per invoice versus $2.78 for best-in-class automated workflows, and 17.4 days to process an invoice versus 3.1 days. The difference is almost entirely labor, and that same labor is what audit prep taxes. Capture the evidence once, at the moment of each transaction, and prep stops being a project.

Fraud controls follow the same logic. Asset misappropriation, the category that covers ghost vendors and duplicate payments, accounts for 89% of occupational fraud cases (ACFE 2024 Report to the Nations). Segregation of duties and a reviewed vendor master are what close those gaps, and both are far easier to evidence when the system records who did what.

How procurement software makes audit prep a non-event

A connected accounts payable process changes the math. In ProcureDesk, every purchase creates a timestamped record as a byproduct of normal operations: request, approval, PO, goods receipt, and matched invoice, linked together and permanent. When the sample list arrives, you open the system and pull the transaction in seconds instead of rebuilding it.

For companies processing more than 100 invoices a month, that record covers physical-goods buying too. ProcureDesk includes 200+ punchout supplier catalogs, including Amazon Business, Grainger, and Thermo Fisher, so a purchase made from a vendor catalog still routes through approval and lands in the same audit trail as everything else. Tools like Bill.com process the invoice after it arrives. ProcureDesk captures the purchase order, the approval, and the goods receipt before it, which is exactly the upstream evidence chain an auditor samples.

ProcureDesk is built for the Controller at a mid-market company, not for everyone in the org. Coast Flight reduced invoice processing time by 30% after centralizing AP this way, and biotech and manufacturing teams like EvolveImmune Therapeutics, Cerebral Therapeutics, and Funai Lexington run the same controls to keep their books audit-ready every month, not just at close.

For the wider control set, our accounts payable best practices guide covers the rest, our invoice approval workflow guide covers routing and thresholds, and the QuickBooks AP automation guide covers GL coding at the source.

Who this checklist is for

This is built for mid-market finance teams with 100 to 1,000 employees, where one to three people handle AP and procurement, and the company has outgrown spreadsheets but is not ready for enterprise ERP. If you run an enterprise finance org on SAP or Coupa, the controls here are too lightweight for your scope. If you are a 20-person company with a handful of invoices a month, this is more process than you need yet. The sweet spot is the team that has grown past email approvals and is now feeling audit pressure, headcount growth, and invoices arriving without a PO.

Make your next audit a checklist review, not a scramble

AP audits test process, not just records. The teams that prepare well are not the ones with the cleanest books. They are the ones who captured the right evidence at each step and can produce it in minutes.

ProcureDesk is a procurement and AP automation platform built for mid-market finance teams with 100 to 1,000 employees. It controls spending before the invoice arrives, with approval workflows, goods receipt confirmation, and automated 3-way matching. It reduces month-end close from 10 days to 4 days on average. It integrates natively with QuickBooks, Sage Intacct, and NetSuite, and goes live in 2 to 4 weeks with the setup done for you. When an auditor asks for a transaction from eight months ago, you open the system and pull it in seconds.

Download the AP Audit Checklist and self-assessment template to score your readiness, then see what an AP process that builds its own audit trail looks like for a company your size.