To audit accounts payable, you work through a defined sequence: pull the general ledger and aging report, vouch a sample of transactions against purchase orders and receiving reports, reconcile balances with what vendors themselves report, hunt for liabilities that should have been recorded but weren’t, run analytical procedures to spot anomalies, test for fraud patterns, and then document everything in workpapers that will survive years of scrutiny. The goal is straightforward: confirm that the debts on the balance sheet are real, complete, and recorded in the right period. Overstated payables make the company look weaker than it is. Understated payables inflate profits and mislead investors.
Pull the Records You Need First
Begin with a full general ledger and an accounts payable aging report from the company’s accounting system. The aging report sorts outstanding balances into time buckets, showing who is owed what and for how long. You also need the original vendor invoices, purchase orders, and receiving reports for every transaction you plan to test.
Sort everything by vendor and date so each purchase order lines up with its matching receiving report and invoice. That alignment is what makes a three-way match possible later. Label digital files by fiscal year and vendor name; group physical records the same way.
Vouch Transactions With a Three-Way Match
Vouching is the core test. Pick a sample of entries from the payables ledger and trace each one back to its source documents. For every entry, three things need to agree: the purchase order shows the company authorized the purchase, the receiving report proves the goods or services arrived, and the vendor invoice bills for what was actually delivered. When quantities, prices, and terms line up across all three, the recorded liability holds up.
Recalculate the math on each invoice by hand. Multiply quantities by unit prices, add tax and shipping, and compare your total to the ledger. Transposed digits and rounding errors are common, and a pattern of small discrepancies from the same vendor can point to a systemic billing problem.
Check each invoice for an authorized signature or digital approval within the spending limits the company has set. An entry with no supporting purchase order is a red flag; it suggests someone bypassed procurement controls. Verify that payment terms in the ledger match what the invoice actually states. A vendor billing on 30-day terms while the ledger shows 60 creates both a timing problem and a possible cash flow surprise.
Set Materiality Before Judging Errors
Not every discrepancy demands the same response. Auditors use materiality thresholds to separate misstatements that could change a reader’s decision about the financial statements from those too small to matter. A common starting point treats any misstatement below roughly 5 percent of a benchmark like net income as presumptively immaterial, though the SEC has made clear that percentage is a preliminary screen, not a safe harbor.
Qualitative factors can make a small dollar amount material. A misstatement that turns a reported profit into a loss, masks a trend, or affects compliance with a debt covenant matters regardless of its size. An error that hides a related-party transaction or reclassifies a legal expense as an operating cost carries weight beyond the dollars involved. The quantitative threshold gets you started; the qualitative analysis is where judgment comes in.
Reconcile and Confirm With Vendors
Comparing internal records against statements from vendors is one of the strongest checks available, because the data comes from an independent source. For each vendor in your sample, request a statement of account as of the audit date and match it line by line against the subsidiary ledger balance. Compare invoice numbers, payment dates, and outstanding amounts.
Differences turn up constantly, and most are harmless: payments in transit, returned merchandise awaiting credit, invoices that crossed in the mail. The dangerous variances are those where the vendor reports a higher balance than the books show. That gap could mean an invoice was lost, never entered, or deliberately excluded. Unapplied credits and forgotten prepayments also surface here and need to be posted so the books align.
Vouching tests whether recorded debts are valid. Vendor reconciliation tests whether all valid debts have actually been recorded. Skipping either leaves a hole in coverage.
Formal confirmations go further than reconciling existing statements. The auditor sends a letter asking the vendor to independently verify the outstanding balance, and the vendor responds directly to the auditor rather than to the company. That routing removes any opportunity for the client to intercept or alter the response.
Confirmations are especially useful for large balances, vendors with complicated transaction histories, or situations where internal controls are weak. A confirmed balance matching the ledger is strong external evidence. A confirmed amount that differs gives the auditor an independent data point to investigate. Non-responses matter too: a vendor that refuses to confirm or ignores repeated requests may warrant alternative procedures like examining subsequent payments or shipping documents. Sending requests early, following up by phone, and keeping the form simple all improve the odds of getting usable responses back.
Search for Unrecorded Liabilities and Test Cutoff
This is the completeness test, and it produces many of the biggest adjustments in a payables audit. Pull the bank statements and check registers for the two to three weeks after fiscal year-end. Every payment made in January needs scrutiny: was the underlying expense incurred in December? A utility bill covering December usage but paid on January 10 belongs in the prior year as an accrued liability. If it wasn’t recorded, expenses are understated and net income is inflated.
Cutoff testing reinforces the search. Review receiving reports from the final days of the fiscal year and confirm that the related liability hit the books when the goods arrived, not when the invoice showed up weeks later. Missing a $50,000 inventory shipment received on December 30 is exactly the kind of error that turns an otherwise clean audit into a qualified opinion.
Some year-end liabilities require estimation rather than exact calculation. Under generally accepted accounting principles, a company must accrue an estimated liability when two conditions are met: the loss is probable and the amount can be reasonably estimated. A pending insurance claim where the company expects to owe roughly $200,000 qualifies for accrual even if the final number isn’t settled. Liabilities that are only possible, or where no reasonable estimate exists, get disclosed in the notes instead.
Run Analytical Procedures
Analytical procedures give you a high-altitude view before you dive into individual transactions. The simplest and most revealing metric is days payable outstanding, calculated by dividing average accounts payable by cost of goods sold and multiplying by 365. The result tells you how many days, on average, the company takes to pay its vendors.
A sudden jump in DPO from one year to the next may mean the company is stretching payments to conserve cash. A sudden drop may indicate that liabilities are being removed from the books before they should be. Compare DPO against industry benchmarks and the company’s own historical trend. A manufacturer running 15 days above its sector average needs an explanation.
Beyond DPO, compare the current-year payables balance to the prior year as a percentage of total purchases. If purchases grew 10 percent but payables grew 40 percent, something changed in payment behavior or recording practices. These ratio comparisons don’t prove anything on their own, but they focus substantive testing on the areas most likely to contain errors.
Look for Payables Fraud
Payables fraud tends to follow predictable patterns. The most common scheme involves fictitious vendors: an employee sets up a shell company, submits invoices for services never performed, and approves the payments. These schemes survive because one person controls both vendor setup and payment authorization.
The most effective detection technique is matching employee records against the vendor master file. Compare addresses, phone numbers, and bank account details. A vendor mailing address that matches an employee’s home address, or a vendor bank account sharing routing details with an employee’s payroll deposit, demands investigation.
Other patterns worth watching for during testing:
- Vendors with only a P.O. box, especially those billing for consulting or services.
- Handwritten or typed invoices from a vendor whose peers all use printed or system-generated ones.
- Round-dollar invoices for exactly $5,000 or $10,000 each month, where real transactions usually produce odd totals.
- New vendors that immediately start billing large amounts.
- Sole-source contracts that one person insists on and resists opening to competitive bidding.
Don’t Overlook Unclaimed Property
A payables audit that focuses only on current obligations misses a less obvious one: unclaimed property. When vendor credits, uncashed checks, or overpayments sit dormant long enough, state escheatment laws require the company to report and remit that property to the state. Ignoring the obligation can bring interest charges, penalties, and forced examinations of years of records.
Dormancy periods for vendor-related property range from about two to five years depending on the state, with three years being the most common threshold. Once a credit or check has been inactive that long and the company has made a good-faith effort to contact the owner, the property must be turned over. Flag any credits or outstanding checks in the aging report that are approaching or past the applicable dormancy period, and confirm whether the company runs an escheatment compliance program. Penalties for failing to report can include interest rates well into double digits on the unreported amounts.
Legal Exposure for Getting It Wrong
For public companies, payables errors are not just an accounting problem. The Securities Exchange Act requires every public company to maintain books and records that accurately and fairly reflect its transactions. The Sarbanes-Oxley Act adds another layer: Section 404 requires management to assess the effectiveness of internal controls over financial reporting each year, and the external auditor must attest to that assessment.
Criminal penalties under Sarbanes-Oxley are severe. An officer who knowingly certifies a financial report that doesn’t comply with the law faces up to $1 million in fines and 10 years in prison. If the certification is willful, the maximums rise to $5 million and 20 years.
Payables errors that flow through to the tax return can also trigger accuracy-related penalties. The IRS imposes a penalty equal to 20 percent of any underpayment caused by negligence or a substantial understatement of income tax.
Document and Retain the Workpapers
The concluding phase pulls everything into formal workpapers that document what procedures were performed, what evidence was obtained, and what conclusions were reached. They need to be detailed enough that another auditor could pick them up years later and understand exactly what was done and why.
For audits of public companies, the SEC requires accounting firms to retain all workpapers and related documents for seven years after the audit concludes. Destroying or altering audit records carries its own criminal penalties: under federal law, an accountant who knowingly and willfully destroys audit workpapers can face fines and up to 10 years in prison. Whether the archive lives in a physical vault or an encrypted digital repository, everything should be where a regulator, litigant, or successor auditor can find it three or five years on.