Audit readiness
Accounts Payable Audit Checklist: 18 Controls for a Cleaner Close
An actionable AP audit checklist covering invoice completeness, duplicates, approvals, vendor controls, reconciliations, cutoff, and evidence retention.
Key takeaways
- Design the checklist around control objectives, not software screens.
- Tie every exception to evidence, ownership, and resolution.
- Reconcile population totals before sampling individual invoices.
- Repeat high-value data checks every close using the same definitions.
01
Start with the population, not the sample
An AP review is only as reliable as the population supplied. Before inspecting invoices, confirm that the exported register covers the intended entities, ledgers, currencies, and accounting period. Record the extraction time, report parameters, row count, and control total. Without that baseline, a clean sample can still come from an incomplete population.
Preserve the original export and work from a copy. If columns are renamed or values are normalized, document the transformation. Reviewers should be able to trace every exception back to an unchanged source row.
02
Invoice and data-quality controls
The first group of controls tests whether records are complete, internally consistent, and suitable for further review. These checks are inexpensive to repeat and often expose process failures before detailed testing begins.
- 1. Invoice number is present and usable.
- 2. Vendor identifier is present and maps to an active vendor.
- 3. Invoice date is valid and within an expected range.
- 4. Currency is present and permitted for the entity.
- 5. Gross, tax, and net amounts are numeric and internally consistent.
- 6. Credit notes and reversals are clearly identified.
03
Duplicate, approval, and matching controls
Next, test whether the obligation is unique, authorized, and supported. Do not treat an automated match as final approval. Matching narrows the review; it does not prove that goods were received or that an approver was independent.
- 7. Exact duplicate invoice candidates are investigated.
- 8. Conflicting vendor and invoice-reference combinations are investigated.
- 9. Near duplicates with the same vendor, amount, and date window are reviewed.
- 10. Approval level matches the value and business unit.
- 11. Purchase-order invoices agree to approved order terms.
- 12. Receipt or service evidence supports the quantity billed.
04
Vendor, payment, and access controls
Payment risk often enters through vendor maintenance rather than invoice entry. Review changes to bank details, tax identifiers, payment terms, and contact information separately from routine invoice processing. A person who can change a vendor and release a payment creates a concentration of access that deserves compensating review.
- 13. New vendors and bank-detail changes have independent verification.
- 14. Dormant or duplicate vendor records are reviewed and restricted.
- 15. Payment method and bank account changes are visible in an audit trail.
- 16. Maker-checker separation exists for vendor changes and payment release.
05
Close, cutoff, and evidence controls
Finish by proving that the ledger agrees to the supporting population and that liabilities appear in the correct period. Investigate differences instead of forcing a spreadsheet total to match. Reconciling items should have an owner, explanation, expected resolution date, and evidence.
- 17. The AP subledger reconciles to the general-ledger control account by entity and currency.
- 18. Cutoff, unmatched receipts, debit balances, aged items, and post-close adjustments are reviewed and retained.
This article provides general operational guidance, not accounting, audit, tax, or legal advice. Apply your organization's policies and professional judgment.