Accounts Payable Audit Checklist: 46 Key Checks

Quick Answer

An accounts payable audit checklist is a list of control checks used to confirm that vendor records, invoices, approvals, payments, and AP balances are complete, accurate, authorized, and supported by evidence. It helps finance teams catch problems like duplicate payments, missing approvals, and unrecorded liabilities before an internal or external audit does.

The checklist below covers 10 areas. Use the checkboxes to track progress, then download it as a spreadsheet to assign owners and record findings.

Before you start, it helps to understand the full accounts payable process, because every check below tests one step of it. Here is how the audit areas line up with that process:

Figure 1. Each stage of AP has one control that matters most. The checklist tests each one.

The Accounts Payable Audit Checklist

Work through each area in order. For every check, confirm the item and collect the evidence listed. If a check doesn't apply to your business, such as three-way matching for a company that doesn't use purchase orders, mark it complete and note why.

Vendor Master and Supplier Controls

Vendor Master and Supplier Controls checks
Check	What to verify	Evidence
Vendor records are complete	Legal name, address, tax ID, contact, and payment terms are filled in and current	Vendor master report
No duplicate vendors	No duplicate or near-duplicate vendor records (similar names, shared tax IDs or addresses)	Duplicate vendor report
Tax forms on file	A current W-9 (or W-8 for foreign vendors) is on file where required	Tax form file
Vendor changes are authorized	New vendors and changes to existing records were approved by someone other than the requester	Vendor change log
Bank changes were verified	Every bank account change was confirmed by calling the vendor at a number already on file	Change log and callback record
Inactive vendors reviewed	Vendors with no recent activity are reviewed and blocked if no longer used	Inactive vendor list
Sanctions screening, where required	Vendors are screened against applicable sanctions lists if your compliance program requires it	Screening results

Invoice Validation

Invoice Validation checks
Check	What to verify	Evidence
Vendor is valid and active	The invoice is from an approved vendor in the master file	Invoice and vendor record
Invoice number is unique	The same invoice number has not been entered or paid before for this vendor	Duplicate invoice report
Amounts are correct	Quantities, prices, tax, and discounts match supporting documents	Invoice and supporting documents
GL coding is correct	The invoice is coded to the right GL account, department, cost center, or project	Invoice record
Receipt date is recorded	The date AP received the invoice is captured, so terms and cutoff can be tested	Invoice register

Purchase Orders and Matching

Purchase Orders and Matching checks
Check	What to verify	Evidence
PO exists where required	Invoices that policy says need a PO have a valid, approved PO	PO and invoice
Goods or services received	A receiving record or service confirmation exists before payment	Receiving report
Two-way or three-way match done	PO, receipt, and invoice agree on quantity and price, where applicable	Matching record
Variances were approved	Differences outside tolerance were reviewed and approved before payment	Exception log

Approval Controls

Approval Controls checks
Check	What to verify	Evidence
Approved by an authorized person	The approver had authority for the amount under the approval matrix	Approval history and matrix
Approved before payment	Approval date is before the payment date	Approval history and payment register
Approval history is complete	The record shows who approved, when, and the approval status	Approval history
No self-approval	No one approved an invoice they requested or that pays them	Approval history
Overrides are documented	Manual overrides are rare, justified in writing, and reviewed	Override log

Payment Controls

Payment Controls checks
Check	What to verify	Evidence
Payment matches approved invoice	The amount paid equals the approved amount, net of credits	Payment register and invoice
Paid to the right vendor and account	Payee and bank details match the verified vendor record	Payment file and vendor record
Payment run was authorized	A separate person reviewed and released the payment batch	Payment approval record
Terms and discounts followed	Invoices were paid on terms and available early-payment discounts were considered	Payment register
No duplicate payments	No invoice was paid twice by any payment method	Duplicate payment test
Voids and manual payments reviewed	Voided checks, stopped payments, and manual or wire payments are approved and documented	Void and manual payment log

AP Reconciliation

AP Reconciliation checks
Check	What to verify	Evidence
AP subledger agrees to GL	The AP subledger total matches the AP control account in the general ledger	AP reconciliation
Vendor statements reconciled	Statements from key vendors agree with your AP records, and differences are explained	Vendor statement reconciliations
Bank reconciliation is current	Payments clear the bank as recorded and reconciliations are reviewed	Bank reconciliation
Credits and debit balances reviewed	Open credit memos are applied and debit balances are investigated	AP aging and credit memo list

AP Aging and Period-End Cutoff

AP Aging and Period-End Cutoff checks
Check	What to verify	Evidence
Aging ties to subledger	The AP aging total matches the AP subledger	AP aging report
Old balances investigated	Items over 60 or 90 days have a documented reason and owner	AP aging with notes
Invoices are in the right period	Invoices and receipts near period-end are recorded in the correct period	Cutoff report
Search for unrecorded liabilities	Payments made after period-end are reviewed for liabilities that belonged in the prior period	Subsequent payments list
Accruals cover unbilled items	Goods and services received but not yet invoiced are accrued	Accrual schedule

Documentation and Audit Trail

Documentation and Audit Trail checks
Check	What to verify	Evidence
Supporting documents attached	Each paid invoice has the invoice, PO, receipt, and approval attached or linked	Invoice record
Records are retained	Documents are kept for the period required by your retention policy and tax rules	Retention policy
Documents are easy to find	A sample of records can be pulled quickly when requested	Retrieval test

Compliance and Tax

Compliance and Tax checks
Check	What to verify	Evidence
Year-end tax reporting	Form 1099 reporting is accurate and filed on time, where applicable	1099 filings
Sales and use tax	Tax on invoices is correct, and use tax is accrued where required	Tax review
AP policy is current	A written AP policy exists, is current, and matches actual practice	AP policy document

Access and Fraud Testing

Access and Fraud Testing checks
Check	What to verify	Evidence
System access matches roles	Users only have the AP access their job requires, and leavers are removed	User access review
Duplicate payment test run	A search for same vendor, amount, and date or invoice number was completed	Test results
Unusual patterns reviewed	Round amounts, amounts just under approval limits, and new vendors paid quickly were reviewed	Analytics or sample notes
Manual AP entries reviewed	Manual journal entries to AP accounts are approved and supported	Journal entry review

Note: This checklist is a practical starting point for reviewing AP controls. Audit procedures and documentation requirements vary by company, industry, reporting framework, transaction risk, and engagement scope. Consult your CPA, auditor, or a qualified accounting professional for requirements specific to your organization.

What Does an Accounts Payable Audit Check?

Every check above supports one or more audit objectives. Knowing the objective helps you understand why a check matters and what a failure means.

Core AP audit objectives
Objective	The question it answers	Example checks
Authorization	Were transactions approved by the right people?	Approval limits, approval before payment, vendor change approval
Completeness	Are all liabilities recorded?	Cutoff testing, search for unrecorded liabilities
Accuracy	Are amounts and coding correct?	Invoice matching, GL coding, tax review
Validity	Do payments relate to real vendors and real obligations?	Vendor verification, receiving records
Cutoff	Are transactions recorded in the right period?	Invoices and receipts near period-end
Fraud and control risk	Could someone make an unauthorized payment unnoticed?	Segregation of duties, duplicate tests, access review

Documents and Records Needed for an AP Audit

Gather these before you start testing. Most come from your accounting system or ERP and your AP software.

Ledgers and reports

AP subledger and general ledger
AP aging report
Invoice register and payment register
Bank statements and bank reconciliations
Vendor statements for key vendors
Exception and duplicate reports
Year-end tax reporting records, where applicable

Supporting documents and logs

Vendor master file and change log
W-9 or W-8 forms, where applicable
Supplier invoices and credit memos
Purchase orders, receiving reports, and contracts
Approval history and approval matrix
User access lists by role
Written AP policies and procedures

For approved invoices, good evidence shows the invoice number, vendor, date, amount, PO and receipt references, approver name, approval timestamp, and payment reference together.

How to Perform an Accounts Payable Audit

Define the scope and periodDecide the audit period, entities, vendors, and transaction types to include. Note whether this is an internal control review or preparation for an external audit, and where the highest risks are.
Gather AP recordsPull the documents listed above. Confirm the AP aging total matches the subledger before testing anything else.
Review vendor master dataLook for duplicate or similar vendors, missing tax information, inactive vendors with payments, unusual addresses, and bank account changes, and confirm each change was authorized.
Test a sample of invoicesFor each, check the vendor, invoice number, date, amount, PO, receiving record, GL coding, tax, and approval. Our guide to invoice processing covers what each step should look like.
Test paymentsConfirm each payment matches an approved invoice, went to the right vendor and bank account, was authorized, followed terms, and wasn't duplicated.
Reconcile APTie the AP subledger to the general ledger, vendor statements, and payment records. Our step-by-step guide shows how to reconcile accounts payable.
Test period-end cutoffCheck that goods and services received before period-end are recorded, invoices received after period-end are in the right period, and accruals cover unbilled liabilities. Review payments made shortly after period-end for liabilities that should have been recorded.
Review controls and accessConfirm segregation of duties, approval limits, and system access match your policies.
Document findingsRecord each issue using the findings framework below.
Track remediationAn audit isn't done when issues are found. Follow up until each corrective action is complete and tested.

Segregation of Duties in Accounts Payable

Separating "the person who approves" from "the person who pays" is a good start, but strong segregation of duties covers the whole chain. Ideally, no one person controls every step without compensating controls such as independent review.

Figure 2. In small teams one person may cover two duties. When that happens, add an independent review step, such as an owner reviewing the payment register.

What Do Auditors Look for in Accounts Payable?

Scope varies by engagement, but AP testing commonly focuses on these areas:

Common AP audit focus areas
Focus area	Why it matters
Unrecorded liabilities	Understates expenses and what the company owes
Incorrect cutoff	Puts expenses in the wrong period
Duplicate or unauthorized payments	Direct cash loss
Missing or late approvals	Breaks the authorization control
Unsupported invoices	No proof the obligation was real
Duplicate or invalid vendors	A common route for fraud and errors
Unreconciled balances	Subledger and GL don't agree
Weak segregation of duties	One person could create and pay a fake invoice
Unusual manual entries and adjustments	Can hide errors or override controls
Incomplete audit trails	Can't prove who did what and when

Common AP Audit Red Flags

These items don't prove fraud or error on their own, but they warrant a closer look:

Vendor red flags

Duplicate or very similar vendor names
Vendors sharing an address or bank account with each other or an employee
Recent bank account changes, especially by email request
Vendors created shortly before a large payment
Inactive vendors suddenly receiving payments
Vendors with free email domains or missing tax IDs

Transaction red flags

Invoices approved after payment
Amounts just under an approval limit
Many round-dollar or sequential invoices
Frequent manual overrides or adjustments
Missing supporting documents
Unexplained balances or debit balances in the AP aging report
Late or missing reconciliations

Bank account change requests deserve special attention. Business email compromise schemes often impersonate vendors to redirect payments, a risk the FBI's Internet Crime Complaint Center regularly warns about. Always confirm changes by calling a number already on file.

What to Do When You Find an AP Control Issue

Record every finding in the same format so issues can be tracked to resolution:

Finding Risk Root cause Financial impact Owner Corrective action Due date Follow-up

Example finding record
Finding	3 of 25 sampled invoices were paid before approval was recorded
Risk	Payments could be made for invalid or unauthorized invoices
Root cause	Urgent payments approved by email outside the system
Financial impact	$18,400 paid without documented approval; all three later confirmed valid
Owner	AP Manager
Corrective action	Block payment release for invoices without system approval; add an urgent-approval path
Due date	End of next quarter
Follow-up	Retest a new sample after the control change

Example for illustration only.

How Often Should You Review Accounts Payable?

The right frequency depends on transaction volume, risk, company policy, and audit requirements. This is a practical framework many teams use, not a rule:

AP review cadence
Frequency	Suggested checks
Every payment run	Approval present, duplicate check, vendor and bank details
Monthly	AP-to-GL reconciliation, AP aging report review, open exceptions
Quarterly	Vendor master cleanup, user access review, payment sample testing
Annually	Full control review, approval matrix, policy update
Before an external audit	Full checklist and evidence review
After a system or process change	Targeted review of affected controls

Internal AP Review vs External Audit

Internal review vs external financial audit
	Internal AP review	External financial audit
Main focus	Process and control effectiveness	Financial statements and audit evidence
Who performs it	AP manager, controller, or internal audit	Independent CPA firm
Timing	Whenever the company chooses	Set by the audit engagement
Scope	Tailored by the company	Set by the engagement and applicable standards
Goal	Find and fix weaknesses	Provide an independent opinion within its scope

Regular internal reviews make external audits faster, because evidence is organized and known issues are already fixed.

AP Audit Best Practices

Keep the vendor master clean. Review it quarterly and require approval for every new vendor and change.
Verify bank changes independently. Call the vendor at a known number, never one from the change request.
Reconcile monthly. Tie the AP subledger to the general ledger every month-end.
Keep approvals in the system. Approvals given by email or phone are hard to prove later.
Review the approval matrix yearly. Update limits as roles and spending change.
Document your accounts payable workflow. Auditors test against your written policy, so it needs to match what actually happens.
Train the team. Cover policies, red flags, and how to report concerns.

When AP Automation Can Help

Many audit findings come from information being spread across email, spreadsheets, and paper. AP automation can help by keeping invoice records, approval history, matching results, vendor records, exceptions, and payment status in one system, so evidence is easier to pull and controls are applied the same way every time. It doesn't replace control reviews. You still need to confirm controls are working and investigate exceptions.

Quick Payable is Salesforce accounts payable software that supports several checks on this list:

Audit trail: every invoice action is logged with the user and timestamp on the invoice record
Duplicate checks: likely duplicate invoices are flagged and rejected during processing
Approval limits: invoices above an approver's monetary limit escalate to their manager
Segregation of duties: role-based access separates AP clerks, who capture and correct invoices but can't approve payments, from approvers and admins
Vendor data protection: field-level security limits who can view sensitive banking details
Auditor access: a read-only role can view dashboards and the full audit trail

You can see how roles and access are set up in the Quick Payable administration guide.

Make AP Controls Easier to Monitor

See how Quick Payable keeps invoices, approvals, vendor records, and audit history in one place inside Salesforce. Try it free for 15 days, no credit card required.

Book a Free Demo

Frequently Asked Questions

What is an accounts payable audit checklist?

An accounts payable audit checklist is a structured list of checks used to review vendor records, invoices, approvals, payments, reconciliations, and documentation. It helps confirm that AP transactions are complete, accurate, authorized, and supported by evidence.

What does an AP audit check?

An AP audit typically reviews whether liabilities and payments are complete, accurate, authorized, properly recorded, and supported. Common tests include vendor master review, invoice matching, approval testing, duplicate payment checks, AP-to-GL reconciliation, cutoff testing, and segregation of duties review. The exact scope depends on the company and audit engagement.

How do you audit accounts payable?

Define the scope and period, gather AP records, review vendor master data, test a sample of invoices and payments, reconcile the AP subledger to the general ledger, test period-end cutoff, review controls and access, document findings, and track corrective actions until they are complete.

What documents are needed for an AP audit?

Common documents include the vendor master file and change log, tax forms where applicable, supplier invoices, purchase orders, receiving reports, approval records, the invoice and payment registers, AP aging, the AP subledger, the general ledger, bank reconciliations, vendor statements, credit memos, and user access lists.

How often should accounts payable be audited?

It depends on transaction volume, risk, company policy, and audit requirements. Many teams check controls on every payment run, reconcile monthly, review vendors and access quarterly, do a full control review annually, and run the complete checklist before an external audit.

What are common AP audit findings?

Common findings include missing or late approvals, duplicate payments, duplicate or outdated vendor records, unrecorded liabilities at period-end, unreconciled AP balances, weak segregation of duties, unverified bank account changes, and missing supporting documents.

Why is segregation of duties important in AP?

Segregation of duties makes it harder for one person to create a vendor, approve a fake invoice, and release payment without anyone noticing. Ideally, vendor setup, invoice approval, payment preparation, payment release, and reconciliation are handled by different people, with independent review where that isn't possible.

Does AP automation eliminate the need for AP audits?

No. AP automation does not replace control reviews. It can make evidence easier to collect and apply controls more consistently, but a checklist is still needed to verify that controls are working, exceptions are investigated, and required evidence is available.

Who should perform an AP audit?

Internal reviews are usually led by the AP manager or controller, ideally with someone outside day-to-day AP, such as internal audit or finance leadership, reviewing the results. External financial audits are performed by an independent CPA firm.

Is this checklist suitable for small businesses?

Yes. Small businesses can start with the core areas: vendor master, invoice validation, approvals, payments, and monthly reconciliation. Mark checks that don't apply, such as three-way matching without purchase orders, and add more areas as the business grows.

Shyam Agarwal

Sr. Project Manager

Shyam Agarwal is a technology professional with 12+ years of experience in Salesforce consulting, development, and administration. He writes about accounts payable, AP automation, and Salesforce, drawing on his experience delivering scalable technology solutions that support business needs and improve operational efficiency.