An accounts payable recovery audit is a forensic review of a company’s historical payment records that finds and recovers money lost to duplicate payments, missed credits, pricing errors, and tax overpayments. Industry benchmarks suggest duplicate and erroneous payments alone run about 0.8% to 2% of total disbursements, so a company spending $50 million a year with vendors could be leaking $400,000 to $1 million without noticing. The audit works backward through transactions already closed on the books, catching mistakes that slipped past internal controls the first time.
What the Audit Covers
A recovery audit is not a redo of your month-end close or an evaluation of how well your AP team is performing. It’s a detective exercise. The auditor takes a snapshot of your historical payment data and runs it through specialized analysis to surface money you already spent but shouldn’t have. The typical look-back window is two to three years, depending on your data retention practices and the statutes of limitation that govern contract claims.
Scope reaches well past invoices. Auditors pull and cross-reference the general ledger, the vendor master file, purchase orders, and receiving documentation. Matching those datasets against each other is what surfaces errors that live in the gaps between systems, like a credit memo a vendor issued that nobody applied against a later invoice because the AP clerk never saw it.
Day-to-day operations are largely unaffected. Because the auditor works from extracted historical files, your AP staff keeps processing current invoices while the review runs in the background.
The Errors a Recovery Audit Typically Finds
Duplicate Payments
The single most common finding is the same invoice paid more than once. It happens when separate departments process the same invoice, when a system fails to flag a previously paid invoice number, or when minor formatting differences cause the duplicate-check routine to miss a near-match. Auditors catch these by comparing vendor name, invoice number, amount, and date across the full disbursement file, flagging close matches within short time windows.
Pricing and Discount Errors
Negotiated contract rates and volume discounts don’t always flow cleanly into the AP system. A vendor bills at list price instead of the contract rate, or a tiered discount kicks in at a threshold nobody is tracking. The gap between what you agreed to pay and what you actually paid is an overpayment, and on high-volume repetitive purchases it compounds fast.
Missed Credits and Rebates
Returned goods, canceled services, and volume rebates all generate credit memos. If those credits are never applied to a later invoice, the company effectively pays twice. This category is easy to overlook because it requires someone to actively track open credits, and in a busy AP shop credits quietly age off the radar.
Sales and Use Tax Overpayments
Companies sometimes pay sales tax on items that are exempt, such as manufacturing equipment or certain professional services. The errors come from incorrect tax codes at the point of purchase or from blanket tax treatment that ignores exemptions in specific jurisdictions. Recovery auditors compare transactions against the applicable tax rules to quantify what was overpaid.
Freight, Utility, and Logistics Billing Errors
Complex service contracts with tiered rates, fuel surcharges, and accessorial charges create fertile ground for billing mistakes. Catching them means comparing every line item against the specific contract terms, tedious enough that it rarely happens during normal processing. The errors tend to be small per invoice but material in aggregate.
How the Process Runs
Data Extraction and Cleansing
The auditor pulls the historical financial records: general ledger detail, the AP disbursement file, and the vendor master. Before any analysis, the data gets normalized. Vendor names are a common problem. “Acme Corp,” “Acme Corporation,” and “ACME CORP.” may all be the same supplier, and the software has to recognize that so every payment lands in the same bucket.
Algorithmic Analysis
With clean data, the auditor runs proprietary software that executes hundreds of tests simultaneously against the transaction history. Fuzzy-logic matching flags potential duplicates a simple exact-match filter would miss. If an invoice number differs by one transposed digit but every other field is identical, the software catches it. A separate set of tests compares payment amounts against digitized contract terms and flags anything outside a tolerance range.
Validation and Claim Preparation
Software identifies anomalies. Humans confirm errors. Once an algorithm flags a potential recovery, a human auditor pulls the source documentation (invoice, purchase order, receiving report) to confirm the overpayment actually occurred. Not every anomaly is an error; some reflect legitimate adjustments or deliberate payments. Confirmed errors get packaged into formal claims organized by vendor, each with copies of the relevant invoices and remittance records. Nothing goes to a vendor without the client’s sign-off.
Vendor Recovery
After the client approves the claims, the auditor contacts the vendor’s accounts receivable team with the claim package and requests repayment. Recovery usually comes back as a credit memo applied against future invoices, a direct refund by check or wire, or a balance offset against what the client already owes that vendor. The claim is presented as a processing error, not an accusation, because most overpayments are honest mistakes on both sides and turning the exchange into a confrontation can cost more in future pricing than the recovery was worth.
What It Costs
Most external recovery auditors work on contingency, taking a negotiated percentage of what they actually recover. The percentage varies with engagement scope, transaction volume, and the complexity of your payment environment, but the model removes any upfront cost and ties the auditor’s fee to results. If nothing is found, nothing is owed.
The flip side: the fee comes out of money the company already lost, so the net benefit is always less than the gross recovery. When comparing proposals, weigh the fee percentage against the projected recovery range and ask for references from companies of similar size and complexity.
Booking the Recovered Money
How the recovery is recorded depends on timing. If it relates to the current fiscal year, the standard entry reduces the original expense account, correcting the prior charge. If it relates to a closed prior period, it may need to be recorded as a prior-period adjustment depending on materiality and your accounting policies.
Under GAAP, gain contingencies aren’t recognized until the gain is realized or realizable. In practice, that means you generally don’t book the recovery when the claim is submitted. You book it when the vendor confirms the credit or sends the refund. The auditor’s contingency fee is then calculated against the net amount actually returned.
How Far Back You Can Go
The practical ceiling on look-back is set by the statute of limitations for contract claims. Under the Uniform Commercial Code, an action for breach of a sales contract must be commenced within four years after the cause of action accrues, with accrual occurring when the breach happens whether or not the aggrieved party knew about it.1Legal Information Institute. UCC 2-725 Statute of Limitations in Contracts for Sale Parties can agree to shorten the period to as little as one year but can’t extend it past four.
Most audits settle on a two- to three-year look-back as a practical matter. Reach further and you risk purged documentation, departed vendor contacts, and resistance based on the passage of time. The sweet spot is recent enough that records are intact and vendors cooperate, but far back enough to capture meaningful recoveries. If your company has never run a recovery audit, the first engagement usually covers the maximum practical look-back. Subsequent audits, done annually or every two years, only cover the period since the last review.
Unclaimed Credits and Escheatment
Recovery audits intersect with a legal obligation most AP departments underestimate: unclaimed property laws. Every state requires businesses to report and remit certain unclaimed property, including aged AP credit balances, after a dormancy period. For most AP-related credits, the dormancy period is around three years, though it varies by state.
If a vendor issued a credit that was never applied and it sits on your books past the dormancy period, your company may have a legal obligation to escheat those funds to the state rather than write them off. Reporting priority generally follows the owner’s last known address; if none is on file, the obligation defaults to the company’s state of incorporation. A recovery audit can surface these dormant credits before the escheatment deadline, giving the company a window to apply them against active vendor accounts or request a refund. States audit for unclaimed property, and penalties for noncompliance can be substantial.
When to Schedule One
Industry practice favors annual audits for companies with significant vendor payment volume. Errors compound over time, and the longer you wait, the harder recovery becomes as documentation ages and vendors push back. Companies processing high invoice volumes across multiple locations or ERP systems are especially prone to the errors recovery audits catch.
Certain events should trigger an audit even outside the normal schedule:
- System migration. Moving to a new ERP or AP platform almost always produces data translation errors that create duplicate payments or missed credits.
- Mergers or acquisitions. Combining vendor master files from two companies multiplies the risk of duplicate vendor records and redundant payments.
- Staff turnover. Losing experienced AP staff means institutional knowledge about vendor contracts and pricing agreements walks out the door.
- Rapid growth. A sharp increase in transaction volume can overwhelm existing controls before anyone notices the error rate climbing.
If your company has never run a recovery audit and processes more than a few thousand vendor payments a year, the odds are strong that material recoveries sit in your historical data.
Data Security
Handing years of financial data to an outside firm raises legitimate security concerns. The disbursement file alone contains vendor bank details, payment amounts, and your internal account structure. Before engaging an auditor, confirm how they handle data in transit and at rest. The industry benchmark for third-party data handling is a current SOC 2 Type 2 report, which covers both the design and operating effectiveness of security controls over a sustained period. Also review the auditor’s data retention and destruction policies. If your company operates under HIPAA or handles payment card data, confirm the auditor’s environment meets those additional standards.
Public Company Wrinkles
For publicly traded companies, recovery audits carry an extra dimension. Section 404 of the Sarbanes-Oxley Act requires management to assess and report on the effectiveness of internal controls over financial reporting.2Securities and Exchange Commission. Study of the Sarbanes-Oxley Act of 2002 Section 404 Internal Control Over Financial Reporting An audit that surfaces a pattern of systemic overpayments, say, a pricing matrix that has been wrong for two years, could indicate a material weakness that triggers disclosure obligations. The recovery is good news for the balance sheet, but the findings can force uncomfortable conversations with external auditors and the audit committee. Treat the results not just as a cash-recovery exercise but as diagnostic information about the health of the control environment, and start remediation planning rather than waiting for the external auditor to flag the same issue during the annual financial statement audit.
Tax Treatment of Recovered Funds
A vendor refund or credit for an overpayment is not new income. It’s the return of money you already spent and in most cases already deducted. Recovered overpayments don’t generate a 1099-MISC or 1099-NEC reporting obligation, because those forms cover payments made in the course of business, not reversals of prior payments.3Internal Revenue Service. Instructions for Forms 1099-MISC and 1099-NEC
The tax treatment of the recovery depends on whether the original overpayment was deducted. If your company deducted the full amount as a business expense in a prior year and later recovers a portion, the recovery may need to be included in gross income for the year received under the tax benefit rule. If the original deduction provided no tax benefit, for example because the company had a net operating loss that year, the recovery isn’t taxable. A tax advisor can walk through the specifics, but the key point is that the accounting entry and the tax treatment aren’t always the same, and the year of recovery matters.