An accounts payable audit is an independent review of an organization’s vendor payments and the controls surrounding them, designed to confirm that invoices were paid accurately, only once, at the correct price, and in accordance with contract terms. Done well, an accounts payable audit does two things at the same time: it returns money that has already left the business through error, and it shows finance and procurement leaders exactly where the payment process is letting dollars slip away.
For most large organizations, the money at stake is bigger than it feels. Accounts payable runs at high volume and high speed, and small error rates compound. Industry benchmarks typically estimate duplicate and erroneous payments to be a small fraction of total disbursements, which may seem trivial, but it becomes significant when applied to hundreds of millions or billions in annual spending. This guide explains what an accounts payable audit covers, what it typically uncovers, how the process works, and how to decide whether to run one in-house or bring in an independent specialist.
What is an accounts payable audit?
An accounts payable audit evaluates whether vendor payments are accurate, properly authorized, and consistent with an organization’s contracts and financial controls. It goes beyond confirming that invoices were processed. It asks a sharper set of questions: Did we pay this invoice twice? Did we pay the contract rate or a higher one? Did we capture the credits, rebates, and discounts we were owed? Did the tax get applied correctly? And are the controls that are supposed to prevent these errors actually working?
It is worth separating an accounts payable audit from a financial statement audit. A financial statement audit gives an opinion on whether the accounts, taken as a whole, are fairly stated. An accounts payable audit is operational and transactional: its job is to identify specific payment errors and control gaps, quantify them, and recover what is recoverable. The two answer different questions, and a clean financial statement audit does not mean an AP audit would come up empty.
Why accounts payable is where money quietly leaks
Payment leakage is rarely the result of a single failure. It builds up gradually as transaction volumes grow, supplier networks expand, systems multiply through acquisitions, and manual exceptions accumulate. Even well-run AP departments experience it. The most common sources include:
- Duplicate and near-duplicate payments: the same obligation paid more than once, often across different invoice numbers, payment methods, or business units. This is usually the single largest recovery category; see our deep dive on duplicate payment recovery.
- Pricing and rate errors: invoices paid above the contracted price, at superseded rates, or with incorrect markups and escalations.
- Unapplied credits and statement balances: credit memos, returns, and open balances that were issued but never captured against future payments.
- Missed rebates and volume discounts: earned incentives that were never claimed because no one reconciled them to actual spend.
- Sales and use tax misapplication: tax paid where it was not owed, or at the wrong rate or jurisdiction.
Individually, these look like rounding errors. In aggregate, across millions of transactions, they become material, which is why large-scale overpayment recovery becomes a board-level priority once leaders see the numbers.
Accounts payable audit, recovery audit, and internal controls review: how they differ
These three terms are often used interchangeably, but they solve different problems, and knowing which one you need saves time and money.
- An accounts payable audit is the broad review of payment accuracy and the controls around it.
- A recovery audit is a specialized, transaction-level subset focused specifically on finding and recovering historical overpayments. It is the "get the money back" engagement.
- An accounts payable internal controls review is prevention-focused. It tests whether the controls (segregation of duties, three-way match, vendor master hygiene) are designed and operating well enough to stop errors before they happen.
In practice, the strongest programs combine all three: recover what has already leaked, then fix the controls so it stops recurring. If you are running the review yourself, our step-by-step walkthrough of how to audit accounts payable is the practical companion to this guide.
How an accounts payable audit works, step by step
Every payment environment is different, so audits are scoped to the organization’s industry, ERP system, transaction volume, and objectives. Most engagements, however, follow a consistent sequence.
- Data collection and scoping: The team works with finance and IT to gather accounts payable data, supplier master records, contract terms, and payment history for the review period. The scope is set around where errors are most likely and where the dollars are largest.
- Analytics and testing: Payment data is analyzed across many variables to surface exceptions. Full-population analytics, rather than sampling, make it possible to evaluate every transaction, which is essential for catching errors that occur rarely or hide across business units.
- Verification: Experienced auditors review flagged transactions to confirm that a real error occurred, distinguish genuine exceptions from false positives, and determine the appropriate response. This human step is what keeps recovery claims credible with suppliers.
- Supplier confirmation and recovery: Validated claims are presented to suppliers, agreed, and either credited or refunded, returning cash to the budget where it belongs.
- Root-cause analysis and safeguards: Because most errors trace to a specific cause, the audit produces recommendations to adjust processes, contracts, and controls so the same leakage does not recur.
For the detailed field-level version of this sequence, see our accounts payable audit procedures and checklist.
Sampling vs. full-population review: why 100% analysis matters at scale
Traditional audits rely on sampling, testing a slice of transactions, and inferring the health of the whole. Sampling is efficient and appropriate for many purposes, but it has a blind spot that matters enormously in accounts payable: the most valuable errors are often the rarest. A duplicate payment that occurs in one transaction out of fifty thousand will almost never appear in a sample, yet at enterprise scale, that single error can be worth six or seven figures.
Full-population analysis removes that blind spot by testing every transaction, not a subset. It is the difference between estimating your leakage and finding it. This is why serious recovery programs run on analytics platforms rather than spreadsheets, and why the choice between sampling and full-population review is one of the most consequential decisions in scoping an audit.
What data and documents an accounts payable audit reviews
An accounts payable audit is only as good as the data behind it, so scoping starts with assembling a complete picture of payment activity for the review period. A typical review draws on the accounts payable transaction file, the supplier master, purchase orders and receiving records, contracts and pricing schedules, credit and debit memos, supplier statements, and the payment and banking history. Where relevant, it also pulls tax determinations and rebate or incentive agreements.
Breadth matters because the most valuable errors only reveal themselves when these sources are cross-checked against one another. A duplicate is confirmed by matching invoice, vendor, and payment records; an overcharge is proven by comparing the invoice to the contract; an unclaimed credit surfaces only when statements are reconciled to payments. Gathering the data well up front is the single biggest determinant of how much an audit ultimately finds.
What an accounts payable audit finds, and what recovery looks like
Outcomes fall into two categories: financial and operational. Financial recoveries are the visible result: duplicate payments, overcharges, unapplied credits, missed rebates, and misapplied tax, returned as credits or refunds. Operational improvements are the durable benefit: tighter contracts, cleaner vendor master data, closed control gaps, and standardized processes across systems.
Recovery figures vary widely by industry, transaction volume, contract complexity, and how recently an organization was last reviewed, so they should be read as outcomes of specific engagements rather than promises. A few examples from Revenew engagements illustrate the range:
- $38.6 million in cumulative recoveries for a global energy company, through a program that evolved from retrospective audits into continuous review.
- $185 million in prevented duplicate and overpayments for a global medical-device manufacturer using continuous monitoring.
- $3.8 million in prevented duplicate invoices for a major research university, strengthening controls before payments went out the door.
How gainIQ powers the analysis
Revenew runs its reviews on gainIQ, a proprietary analytics platform that combines full-population testing with experienced review professionals. gainIQ applies more than 260 distinct tests to payment data and supports over 70 root-cause analyses, so it not only flags where dollars leaked but also explains why, the insight that makes prevention possible.
For organizations that want to move from periodic clean-up to ongoing protection, gainIQ Prevent extends the same analytics into continuous monitoring, catching duplicates and overpayments before they leave the building. The medical-device and university results above both came from that continuous model.
Which industries benefit most
Any organization with high AP volume and complex contracts is a candidate, but the leakage tends to be largest where spend is capital-intensive, and supplier arrangements are intricate: energy and utilities, industrial manufacturing, healthcare and medical devices, higher education and research, construction and capital projects, and large public-sector payers. These environments combine big-ticket transactions, negotiated pricing, rebates and escalations, and multiple ERPs, which are exactly the conditions in which errors hide and compound.
How long does an accounts payable audit take?
Timelines depend on the review period, transaction volume, the number of systems, and the cleanliness of the data. A retrospective recovery audit typically takes several months from data intake to final supplier settlement, with the heaviest lifting in data collection and verification. Continuous monitoring programs operate differently: once the initial setup is complete, they run on an ongoing cycle, catching errors close to the point of payment rather than months later.
The trade-off is straightforward. A one-time retrospective review is the fastest way to quantify and recover historical leakage. Continuous monitoring costs more to set up but shrinks the window during which errors can occur. This is a leading reason why organizations that have been surprised by a large retrospective finding often move to a continuous model afterward.
Should you audit AP in-house or bring in a specialist?
Internal audit and finance teams do essential work, and routine internal review is part of good governance. An independent review adds value in specific situations rather than replacing internal teams:
- Transaction volumes have outgrown what internal teams can reasonably evaluate.
- The organization has completed a merger, acquisition, ERP implementation, or shared-services transition.
- Multiple business units, geographies, or payment systems have evolved independently.
- Historical payments have not been independently reviewed in several years.
- Leadership wants a documented, objective view of payment accuracy.
An independent specialist brings dedicated analytical capacity, full-population tooling, and an outside perspective, while internal teams stay focused on day-to-day operations. It is a complement, not a replacement. For a sense of the role and skills involved, see what an accounts payable auditor does.
How to choose an accounts payable audit firm
Not all recovery providers are equal. When evaluating firms, weigh:
- Independence and objectivity: a specialist with no stake in your software or processes.
- Full-population analytics: the ability to test every transaction, not just sample.
- Domain and industry experience: people who know your contracts and where your dollars hide.
- A credible, low-friction recovery approach: claims that hold up with suppliers and protect the relationship.
- Root-cause and prevention: not just recovery, but the safeguards to stop recurrence.
Our checklist on how to choose an AP recovery audit firm walks through each criterion in detail.
Getting started
The lowest-risk way to find out what your accounts payable environment is hiding is to look. Revenew’s Supplier Payment (AP) Reviews combine independent expertise with gainIQ analytics to identify recoverable dollars and strengthen long-term controls.
Request a No-Risk Review to identify opportunities in your payment data.