TL;DR
- AP audits check three things: authorization (was every payment approved?), completeness (were all liabilities recorded?), and accuracy (do amounts match what was ordered and received?).
- The 8 documents auditors most commonly request: purchase orders, approval records, vendor invoices, goods receipts, vendor master file, bank reconciliations, payment run registers, and cut-off documentation.
- The most common audit finding across mid-market companies: POs created after invoices arrive, not before purchases are made.
- Audit readiness is not a pre-audit sprint. It is the byproduct of running AP correctly every month. Automated 3-way matching and system-generated approval logs eliminate most audit prep work.
The auditor’s sample list arrives. Fifteen transactions. You need the PO, the approval, and the goods receipt for each one. You have two weeks.
Invoices were approved over email. POs were created after the fact. Receipts were never matched. By the time an auditor asks for a transaction from six months ago, the trail is spread across three inboxes, a shared drive, and someone’s memory.
This guide covers exactly what AP auditors test, the 8 documents they’ll request, the pre-audit checklist to work through 30 to 60 days out, and the process changes that make audit readiness a default, not a fire drill.
ProcureDesk is a procure-to-pay platform built for controllers at mid-market companies. Every purchase in the system creates a timestamped audit trail automatically: request, approval, PO, receipt, and matched invoice.
Table of Contents
What Do AP Auditors Actually Look For?
AP auditors, whether internal, external, or as part of a financial statement audit, are testing three control objectives. Understanding these three makes every item on their request list make sense.
- Authorization: Was every payment approved by the right person before money moved? Auditors want documented evidence, not someone’s recollection.
- Completeness: Were all liabilities recorded in the correct period? This catches cut-off errors and unrecorded accruals.
- Accuracy: Do the amounts paid match what was ordered and received? This is what 3-way matching tests directly.
Everything on an auditor’s initial document request list connects to one of those three. PO documentation tests authorization. Cut-off schedules test completeness. Invoice matching tests accuracy.
Controllers who sail through audits aren’t necessarily the ones with the cleanest books. They’re the ones who captured the right evidence at the right step, and can produce it in minutes, not days.
The 8 Documents AP Auditors Will Request
Almost every AP audit begins with a document request list. The specific sample size varies, but the document types are consistent. Getting these organized before fieldwork begins saves significant time.
1. Purchase Orders
Auditors sample a population of payments and ask for the corresponding PO. They want to confirm the PO was created before the purchase, not backdated to match an invoice that already arrived.
Key detail: The PO date must precede the invoice date. If your process generates POs after the fact, this is the first control to fix.
2. Approval Records
For every sampled PO or invoice, auditors want a documented approval, with the approver’s name, timestamp, and dollar amount. An email thread technically qualifies, but it’s slow to produce and hard to interpret. A system-generated approval log is the clean version.
ProcureDesk’s approval workflow logs every decision in a permanent, exportable record. You pull the approval history for any transaction in seconds.
3. Vendor Invoices
Auditors want the original invoice for each sampled payment, confirming it matches the PO, comes from a legitimate vendor, and isn’t a duplicate. Centralized invoice storage is the difference between retrieving an invoice in 10 seconds and spending 20 minutes searching email archives.
4. Receiving Documentation (Goods Receipt Notes)
For purchases of physical goods, auditors verify that the company actually received what it paid for. This is the third leg of 3-way matching. Without a goods receipt on file, you can’t prove delivery happened.
In manual AP environments, receiving documentation often lives in a disconnected warehouse system, or doesn’t exist at all. That gap is a consistent finding.
5. Vendor Master File
Auditors review your active vendor list for ghost vendors (fictitious entries used to divert payments), duplicate vendor entries, and missing taxpayer IDs. A vendor master that hasn’t been reviewed in over a year is a common finding in itself. Periodic cleanup, removing inactive vendors, validating banking details, confirming W-9s, is required hygiene.
6. Bank Reconciliations
Auditors confirm that payments in your AP subledger match actual cash outflows. Unexplained or persistent reconciling items are a focus. Subledger-to-GL tie-outs are checked here, too.
7. Payment Run Registers
For each period in scope, auditors want documentation of what was paid, when, to which vendor, and from which account. This is used to test for duplicate payments and to verify the completeness of the payment population.
8. Cut-Off Documentation
Auditors test whether liabilities were recorded in the right period. They’ll pull invoices received in the last 5 business days before and after period-end and confirm correct recording. Invoices dated in December but booked in January are a standard cut-off finding.
The audit trail
Every step, timestamped automatically
Every step creates a permanent, exportable audit record in ProcureDesk. No reconstruction required at audit time. Auditor-ready in seconds, not hours.
AP Audit Preparation Checklist (30 to 60 Days Before Fieldwork)
If your AP process runs correctly throughout the year, most of this checklist is already done. If it doesn’t, this is the gap list.
Documentation Readiness
- PO completeness: Confirm all POs exist in the system with dates that precede corresponding invoices. No backdated POs.
- Invoice centralization: All invoices stored in one system, not individual inboxes or shared drive folders.
- Approval logs: Every PO and invoice has a documented system approval with timestamps and approver names.
- Receiving records: Goods receipt documentation exists for all physical purchases.
- 3-way match status: Identify any invoices without a matching PO and/or receipt. Resolve before fieldwork begins.
- Vendor master review: Remove inactive vendors, validate banking details, and confirm W-9s on file for all active vendors.
Period-End Controls
- Cut-off testing: Pull invoices received in the last 5 business days of the period. Confirm each was recorded in the correct period.
- Accruals review: Identify goods received but not yet invoiced. Confirm accruals are recorded in the correct period.
- Bank reconciliation: Reconcile all AP-related accounts with no unexplained items outstanding.
- AP subledger tie-out: Confirm subledger balances match the general ledger exactly.
Vendor and Payment Controls
- Duplicate invoice check: Run a report for any invoices from the same vendor with the same amount in the same period.
- Vendor verification: Confirm that no payments were made to vendors added in the last 30 days without proper setup approval.
- Missing PO invoices: Pull a list of invoices paid without a corresponding PO. Investigate every exception.
Where AP Audits Most Commonly Find Problems
After working with hundreds of mid-market finance teams on AP implementation, the same six gaps appear in audit findings repeatedly. Each one is preventable with the right controls in place before the auditor arrives.
Audit findings
Six findings auditors flag most, and how to prevent each one
A PO created after the invoice arrives. Auditors read it as a control bypass.
FixEnforce a pre-purchase approval workflow. No PO, no order.
A missing goods receipt means delivery cannot be proven. Auditors flag every gap.
FixAutomate PO, receipt and invoice matching in one system.
Approval evidence buried in threads, deleted accounts, or chat history.
FixKeep a system-generated approval log with timestamp and approver name.
Fictitious vendors with no address, no W-9, or employee bank details.
FixRun an annual vendor master audit. Require separate approval for banking changes.
The same invoice paid twice under a different number, same vendor and amount.
FixAutomated duplicate detection before the invoice is processed.
Expenses miscoded, or capital items expensed. Both surface in audit review.
FixAutomated GL coding by vendor or purchase category.
Finding #1: No PO Before the Purchase
This is the single most common AP audit finding. An employee places an order, the invoice arrives, and a PO is created retroactively to match it. To an auditor, that looks like a control bypass, because it is one.
The fix is upstream enforcement. A purchase request must be submitted and approved before any order reaches a vendor. There is no workaround.
ProcureDesk’s approval workflow makes this the default: purchases can’t proceed without an approved PO in the system.
Finding #2: Incomplete 3-Way Match
3-way matching is the AP control that verifies a vendor invoice by comparing it against the purchase order and the goods receipt before payment is released. Even teams that have 3-way matching in place often have gaps: missing receipts, partial receipts not logged, or invoices matched only to POs without delivery confirmation.
Auditors test this by tracing a sample of payments back through all three documents. One missing link creates an exception that needs resolution.
ProcureDesk automates the comparison. When an invoice arrives, the system matches it against the approved PO and goods receipt automatically. Exceptions are flagged, clean matches route to payment without manual review.
3-way match
How auditors verify every payment
Finding #3: Approvals Over Email or Slack
Email-based approvals are technically valid, but they’re difficult to produce in an audit. You need to locate the thread, export it, verify the approver’s authority, and hope the person who approved it is still at the company. For transactions from 12 to 18 months ago, this is genuinely hard.
A system-generated approval record, with approver name, timestamp, dollar amount, and purchase context, is what auditors want to see. It takes seconds to pull from a procurement system, not hours from an email archive.
Finding #4: Ghost Vendor Risk
Ghost vendors are fictitious or duplicate vendor entries created to divert payments. Auditors specifically look for vendors with no physical address, missing W-9s, or banking details that match an employee’s personal account.
Periodic vendor master audits, at minimum annually, catch most ghost vendor issues before they become findings. Any change to vendor banking details or address should require a separate, documented approval.
Finding #5: Duplicate Payments
Duplicate payments occur when the same invoice is submitted twice under different invoice numbers (same vendor and amount), or when a manual payment is made after an automated run. AP automation tools check vendor, amount, and invoice date before processing and flag potential duplicates before payment is released.
ProcureDesk’s invoice management module includes duplicate detection as a standard step.
Finding #6: GL Coding Errors
Miscoded transactions create audit findings when expenses are classified incorrectly or when capital expenditures are expensed. Automated GL coding, where the system applies the correct code based on vendor or purchase category, reduces this risk at the source rather than catching it at close.
For QuickBooks users, our AP automation for QuickBooks guide covers GL coding automation in detail.
How to Build AP Audit Readiness Into Your Monthly Close
The goal is not to prepare for audits. The goal is to run AP in a way that ensures audit preparation is complete when the auditor arrives.
Controllers at mid-market companies who consistently pass AP audits without scrambling share one habit: they treat audit readiness as an operational standard, not a pre-audit project. Here is what that looks like in practice.
Step 1: Require a PO Before Every Purchase, Without Exception
No exceptions means no exceptions: not for rush orders, not for small-dollar items, not for preferred vendors. Every purchase request goes through the system, gets routed for approval based on dollar amount and department, and generates a PO before anything is ordered.
The audit trail starts the moment the request is submitted. By the time an invoice arrives, there is already a documented authorization in the system with a timestamp and approver name attached.
Step 2: Record Goods Receipts at Delivery
Train the people who receive goods to confirm receipt in the procurement system the same day, not at the end of the week, not when the invoice arrives. This immediately closes the 3-way match loop and creates the receiving record that auditors need.
In ProcureDesk, receipt confirmation is a simple step in the same system that employees use to place orders. The notification goes to the right person, they confirm quantities and conditions, and the record is permanent.
Step 3: Automate the 3-Way Match
Manual 3-way matching, printing the PO, the invoice, and the packing slip, then comparing them line by line, takes time and introduces human error. According to Ardent Partners’ “AP Metrics That Matter 2025,” manual AP processing averages $12.88 per invoice, compared with $2.88 for best-in-class automated workflows. The difference is almost entirely labor.
Automation compares all three documents in the background and surfaces only the exceptions that genuinely need review. At mid-market companies processing 100 to 500 invoices per month, that typically means reviewing 10 to 15% of invoices rather than all of them.
myDNA reduced their month-end close from 7 to 8 days to 3 days after implementing ProcureDesk, because the matching was already done before the close started, not during it.
Step 4: Centralize All Invoice Storage
Every invoice needs to live in one place, not split across an AP email account, a shared drive, and a filing cabinet. Centralized storage means that when an auditor samples a transaction, you retrieve the invoice in seconds, already linked to its PO and goods receipt.
ProcureDesk captures invoices via vendor portal, email forwarding, or manual upload. Once in the system, they’re linked to the corresponding PO and receipt automatically. Coast Flight Training reduced invoice processing time by 30% after centralizing AP in ProcureDesk.
Step 5: Run a Monthly Pre-Close AP Review
Before each period closes, run a five-point review:
- Unmatched invoices: Any invoice without a corresponding PO or receipt.
- Missing approvals: Any transaction that moved forward without a documented approval.
- Duplicate flags: Any invoices flagged by the system as potential duplicates during the period.
- Vendor master changes: New vendors or banking changes added this month. Confirm all were properly authorized.
- GL coding exceptions: Transactions coded to catch-all accounts that need reclassification before close.
Running this review every month means your books are audit-ready at close, not assembled from memory six months later.
How ProcureDesk Makes AP Audit Preparation a Non-Event
The core problem in AP audit preparation is that evidence is created in the moment and lost over time. Emails get deleted. Spreadsheets get overwritten. The person who approved the PO left the company.
ProcureDesk solves this by making the audit trail a byproduct of normal AP operations, not something you reconstruct after the fact.
Permanent, Timestamped Audit Trail on Every Transaction
Every transaction has a complete history: who submitted the request, who approved it, when the PO was issued, when goods were received, when the invoice was matched, and when payment was processed. This record is permanent and cannot be edited after the fact.
The approval workflow module logs every decision, escalation, and routing change in real time. You can produce an auditor-ready transaction history in seconds, not hours.
Automated 3-Way Matching With Exception Routing
ProcureDesk’s invoice matching engine compares the PO, goods receipt, and vendor invoice automatically. Clean matches route to payment. Exceptions are flagged and assigned for review. Duplicate invoices are detected before they’re processed.
Real-Time Committed Spend Visibility
Auditors sometimes ask about accruals: liabilities incurred but not yet invoiced. With ProcureDesk, every open PO is visible in real time. Your team knows what’s committed before the invoice arrives, so period-end accruals are based on actual data, not estimates.
Native Integration With Your Accounting System
Once an invoice is matched and approved, ProcureDesk pushes it directly to QuickBooks, NetSuite, Sage Intacct, Microsoft Business Central, or Xero, with correct GL codes. No manual re-entry. The subledger and general ledger stay in sync throughout the period, not just at close.
Implementation Timeline ProcureDesk goes live in 2 to 3 weeks. Our team handles 100% of the setup. No IT resources required.
What to Prepare for Each Type of AP Audit
AP audits come in four forms, each testing a different set of controls. Here is what’s specific to each.
Audit types
Four AP audits, and what each one tests
| Audit type | What auditors test | Documents to prepare |
|---|---|---|
| External financial statement audit | Authorization, completeness, accuracy, cut-off | POs, invoices, approvals, receiving docs, cut-off schedule |
| Internal audit | Purchasing policy compliance, segregation of duties, approval thresholds | Approval workflow config, policy exceptions, role assignments |
| IRS or tax audit | Expense classifications, 1099 compliance, deductibility | Vendor W-9s, 1099 filings, GL expense classification docs |
| Grant or government compliance | Restricted fund usage, competitive bidding compliance | Fund restriction records, bid documentation, grant approvals |
External Financial Statement Audit
Your external auditors will sample 25 to 50 AP transactions and request the PO, invoice, and receiving documentation for each. They’ll also test cut-off and completeness.
What to prepare: Clean AP subledger, all POs and invoices in one system, documented approvals, and a completed cut-off review for the audit period.
Internal Audit
Internal audits go deeper on controls: testing whether the purchasing policy is being followed, whether approvals happen at the right thresholds, and whether duties are properly segregated.
What to prepare: Approval workflow configuration, a list of any policy exceptions during the period, and documentation showing how AP responsibilities are divided. A written, enforced purchasing policy is the document internal auditors test against first.
IRS or Tax Audit
A tax audit focused on AP checks expense classifications, 1099 filing compliance, and deductibility of vendor payments. Are contractor payments properly documented? Is W-9 documentation on file?
What to prepare: Vendor W-9s, 1099 filings for the period, and GL expense classification documentation for high-scrutiny categories: contractor payments, meals, and entertainment.
Government or Grant Compliance Audit
Common in charter schools, nonprofits, and life science companies receiving government funding. These audits check that restricted funds were used as authorized and that procurement followed required procedures, including competitive bidding above specified thresholds.
What to prepare: Restricted fund usage documentation, approval records for grant-funded expenditures, and competitive bidding evidence for applicable purchases.
Charter schools in particular face these audits regularly.
See how others manage procurement compliance: procurement software for charter schools.
Frequently asked
AP Audit Preparation: Questions Controllers Ask
01What is AP audit preparation?
AP audit preparation is the process of organizing accounts payable documentation (purchase orders, invoices, approval records, goods receipts, and vendor files) so that auditors can verify payment authorization, completeness, and accuracy. Effective preparation means capturing evidence correctly throughout the year, not assembling it right before fieldwork begins.
02What documents does an AP auditor typically request?
AP auditors most commonly request purchase orders (with dates preceding invoices), approval records with timestamps and approver names, vendor invoices, goods receipt notes, the vendor master file, bank reconciliations, payment run registers, and cut-off schedules. Having these stored in one system, rather than spread across email inboxes and shared drives, is the difference between a smooth audit and a stressful one.
03What is a 3-way match in accounts payable?
A 3-way match is an AP control that verifies a vendor invoice by comparing three documents before releasing payment: the purchase order (pre-purchase authorization), the goods receipt note (delivery confirmation), and the vendor invoice (payment request). All three must agree on quantity, price, and item description. If any one disagrees, the invoice is flagged for review. This control catches overbilling, duplicate invoices, and unauthorized purchases before money moves.
04How long does AP audit preparation typically take?
For finance teams that run AP manually (approvals over email, invoices in shared drives, no 3-way matching), AP audit preparation can take 2 to 4 weeks of staff time. For teams using automated AP systems with permanent audit trails, preparation time is typically a few hours: running a checklist, confirming documentation is complete, and generating export reports for the auditor. The difference is entirely in how evidence was captured during the year.
05What is the most common AP audit finding?
The most common AP audit finding across mid-market companies is purchase orders created after invoices arrive, not before purchases are made. This indicates the pre-purchase authorization control was bypassed. Auditors treat retroactively created POs as a control failure, regardless of whether the underlying purchase was legitimate. The fix is enforcing upstream approval workflows that require an approved PO before any order reaches a vendor.
06How does procurement software help with AP audit readiness?
Procurement software like ProcureDesk creates a permanent, timestamped audit trail as a byproduct of normal AP operations. Every purchase request, approval, PO, goods receipt, and invoice match is logged automatically. This means auditors can request documentation on any transaction and get a complete record in seconds, rather than controllers spending days reconstructing evidence from email archives and spreadsheets.
07What is a ghost vendor in accounts payable?
A ghost vendor is a fictitious or duplicate vendor entry created in a company’s vendor master file, typically to divert payments to an unauthorized account. Ghost vendors often have no physical address, lack W-9 documentation, or use banking details that match an employee’s personal account. AP auditors specifically test for ghost vendor indicators as part of fraud risk assessment. Annual vendor master reviews and the requirement of separate approvals for banking detail changes are the primary controls.
Resources
- ProcureDesk Approval Workflows
- How to Implement a 3-Way Match Process
- Invoice Approval Workflow: How to Automate
- How to Choose Invoice Matching Software
- ProcureDesk Reporting and Analytics
- Best Accounts Payable Software: 2026 Guide
- AP Automation for QuickBooks
Conclusion
AP audits test process, not just records. Controllers who prepare well aren’t scrambling to reconstruct documentation. They’re pulling records captured correctly at every step throughout the year.
The difference between a two-week audit prep scramble and a two-hour checklist review comes down to one question: does your AP process capture evidence at the moment of each transaction, or does it ask you to rebuild it later?
ProcureDesk builds the audit trail automatically. Every request, approval, PO, receipt, and matched invoice is logged permanently and linked together. When an auditor asks for a transaction from eight months ago, you open the system and pull it in seconds.
