To conduct a pricing audit, you examine how your company sets, approves, bills, and collects prices, then compare what actually happened to what your policies and the law require. The work breaks into six stages: define the scope, map the legal rules that apply, test the systems and transactions where prices are set and changed, sample and verify a defensible slice of invoices, quantify the gaps in dollars, and assign each fix to a named owner with a deadline. Done well, it closes margin leakage you didn’t know you had and documents the controls regulators expect you to maintain.
Set the Scope Before You Pull Any Data
Decide what the audit covers before anyone extracts an invoice. The scope names the time frame (usually a recent quarter or the last full fiscal year), the product or service lines in play, and the customer segments under review. A pricing audit that tries to cover every product, every channel, and every customer tier at once takes too long and produces findings too diluted to act on. Pick the areas where risk is highest, finish there, and expand in later cycles.
Separate your objectives into two tracks. Compliance objectives test whether pricing conforms to external regulations and internal contractual commitments. Profitability objectives hunt for margin leakage: unauthorized discounts, miscalculated rebates, incorrect cost allocations, transactions that fell below a price floor. The two tracks need different procedures and different samples. A compliance focus concentrates on documenting approval trails for every discount above a threshold. A profitability focus rebuilds the price waterfall on the highest-revenue product lines.
Know the Legal Rules Your Pricing Has to Satisfy
Before you can judge whether a transaction is clean, you need to know what “clean” means. Four bodies of law routinely matter.
The Robinson-Patman Act makes it unlawful to discriminate in price between purchasers of goods of like grade and quality where the discrimination may substantially lessen competition or create a monopoly.1Office of the Law Revision Counsel. 15 USC 13 – Discrimination in Price, Services, or Facilities Volume discounts are legal when they reflect genuine cost savings in manufacturing, selling, or delivering in larger quantities. The FTC treats a price differential as generally lawful when it reflects actual cost differences or a good-faith effort to meet a competitor’s price, but both defenses require documentation.2Federal Trade Commission. Price Discrimination: Robinson-Patman Violations If a customer is getting preferential pricing with no documented cost basis, your audit has found both a margin issue and a compliance exposure.
Horizontal price coordination with competitors carries much heavier penalties: criminal fines of up to $100 million for a corporation and $1 million for an individual, plus up to ten years in prison, and the corporate fine can double to twice the gain or loss if that exceeds $100 million.3Federal Trade Commission. The Antitrust Laws This matters increasingly for companies running algorithmic pricing. The FTC has noted that algorithms can facilitate tacit collusion by letting competitors detect and match each other’s price changes within milliseconds.4Federal Trade Commission. The Implications of Algorithmic Pricing for Coordinated Effects Analysis An algorithm by itself doesn’t violate antitrust law; an algorithm that produces coordinated outcomes with competitors can.
If your company moves goods or services between related entities across borders or state lines, Section 482 of the Internal Revenue Code lets the IRS reallocate income among related organizations when their pricing doesn’t clearly reflect income.5Office of the Law Revision Counsel. 26 USC 482 – Allocation of Income and Deductions Among Taxpayers Controlled transactions must be priced consistently with the arm’s length standard: the price unrelated parties would charge in comparable circumstances.6eCFR. 26 CFR 1.482-1 – Allocation of Income and Deductions Among Taxpayers A 20% accuracy-related penalty applies to any underpayment from a substantial valuation misstatement, triggered when the transfer price is 200% or more (or 50% or less) of the correct price, or when net Section 482 adjustments exceed the lesser of $5 million or 10% of gross receipts. The penalty doubles to 40% for gross valuation misstatements, where the price hits 400% or more (or 25% or less) of correct, or net adjustments exceed the lesser of $20 million or 20% of gross receipts. The minimum underpayment for these penalties is $5,000 for individuals and S corporations, $10,000 for other corporations.7Office of the Law Revision Counsel. 26 USC 6662 – Imposition of Accuracy-Related Penalty The defense is contemporaneous documentation: it must exist when the return is filed and be producible within 30 days of an IRS request.8Internal Revenue Service. Transfer Pricing Documentation Best Practices Frequently Asked Questions
For public companies, pricing control failures can trigger disclosure obligations. SEC rules require management to assess and report on the effectiveness of internal controls over financial reporting in the annual 10-K, including any material weakness.9eCFR. 17 CFR 229.308 – (Item 308) Internal Control Over Financial Reporting A material weakness is a deficiency, or combination of deficiencies, that creates a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected on a timely basis.10PCAOB. AS 2201 – An Audit of Internal Control Over Financial Reporting A systemic pricing control failure that causes material revenue misstatement can meet that threshold.
What to Test
System Integrity and Data Flow
Start where prices live. Trace the master price list from its point of creation through its integration into the ERP, confirming that the price in the order entry module matches the authorized price in the master data file. This sounds basic. It’s also where a surprising share of errors originate. Prices get updated in one system and not another, or a manual upload introduces rounding differences that nobody catches because each variance is trivially small.
Verify the controls around manual price overrides and exception handling in both the ERP and the CRM. A common finding is insufficient separation of duties: one person can approve a discount and finalize the invoice. Confirm that pricing logic (volume tiers, promotional discounts) is programmed correctly and fires automatically at the point of sale. Complex tiered structures are frequently misapplied, producing overcharges or undercharges.
If you use algorithmic or dynamic pricing, add two steps. Document the algorithm’s decision rules, and verify that price floors and ceilings are enforced programmatically. Identical products can display multiple prices simultaneously because of AI-driven experimentation, and the output needs to be logged in enough detail to reconstruct why any customer saw any price. If you can’t explain the price after the fact, you can’t defend it in a dispute.
Discount Authorization
Verify that every concession granted to a customer conforms to the documented corporate pricing matrix. That matrix should specify the maximum allowable discount percentage by product line and customer type, and define the approval authority at each tier. A 5% discount might need only a regional sales manager; a 15% discount might require a vice president.
Sample transactions where discounts were applied and check each one for proper authorization. Any transaction lacking a signed authorization or electronic approval trail is an unauthorized price concession. This is usually where the largest leakage hides. Sales teams under quota pressure sometimes grant discounts informally, and the absence of documentation means nobody realizes how much revenue is walking out until the audit totals it up.
Rebates
Rebates work in reverse of discounts: they’re paid retroactively based on performance metrics, typically volume over a defined period. Confirm three things on each tested rebate: that the customer actually met the contractual criteria, that the rebate was calculated correctly, and that the payment matches the contractual terms. The retroactive nature makes rebates a high-risk area for financial misstatement because the liability accrues over time and often involves estimates.
Cost-Plus and Transfer Pricing
For cost-plus pricing, validate the underlying cost calculations. Examine overhead allocation methods and the calculation of cost of goods sold. The most common problem is staleness: raw material or labor costs change, but the cost base feeding the pricing model doesn’t get updated, and the result is a price that looks profitable based on last quarter’s costs but isn’t.
For transfer pricing between related entities, test the documentation itself against the arm’s length requirement. Having documentation is not enough; the IRS assesses whether it’s adequate and reasonable, and will disregard documentation that relies on inaccurate inputs or fails to follow the best method rule.8Internal Revenue Service. Transfer Pricing Documentation Best Practices Frequently Asked Questions The analysis supporting your chosen method must be genuine economic analysis, not a policy statement.
The Price Waterfall
A price waterfall analysis tracks the journey from published list price down to the actual cash collected after every discount, rebate, cost, and allowance is subtracted. Each step is a leakage point: on-invoice discounts, off-invoice concessions like advertising allowances and volume rebates, freight, payment-term discounts for early payment, and any other reduction that cuts what you actually collect.
The number that matters is the pocket price. The gap between list and pocket is often much larger than leadership realizes, because many of the reductions happen off-invoice and never appear in a single report. Running the full waterfall by product line and customer segment shows which accounts are genuinely profitable and which look good on the invoice but erode margin through the back door.
How to Test It
Sampling
Extract all invoices, sales orders, credit memos, and master price files for the period under review. A full census is almost never practical. Stratified random sampling is the standard: divide the transaction population into strata (product line, customer tier, discount level, dollar amount) and pull a random sample from each. High-risk strata (transactions with discounts above the standard threshold, manual overrides) get larger samples. The sample must be large enough to estimate the error rate across the population with reasonable confidence. Supplement with judgmental sampling where you already have reason to suspect problems in a specific region or with a specific customer.
Tracing and Vouching
Testing uses two complementary directions. Tracing starts with the authorized master price list and follows the price forward through the system to the final invoice, confirming the billed amount matches the authorized price. Vouching works in reverse: start with the invoice and follow it backward to the original authorization, confirming that someone with proper authority approved the price and any exceptions.
Benford’s Law
For large datasets, Benford’s Law is a useful forensic screen. The principle predicts that in naturally occurring numerical datasets, the digit 1 appears as the leading digit about 30% of the time, while 9 appears less than 5%. Invoice amounts, payment totals, and discount figures qualify. When the actual first-digit frequency shows 8s and 9s far above expectation, it flags potential manual manipulation. The technique doesn’t prove fraud, but it tells you where to focus detailed testing.
Interviews and Policy Review
Transactional testing isn’t enough. Structured interviews with the sales team reveal how pricing policy actually gets applied in the field, including informal workarounds that have developed. Finance personnel explain the mechanics of rebate calculation and payment. These conversations often surface control gaps that don’t appear in the data, like approval processes that exist on paper but get bypassed under time pressure. Pair the interviews with a review of the corporate pricing policy manual, the delegation of authority matrix, and any customer-specific contract terms that override standard pricing. Those documents establish the standard your transactions are measured against.
Records You Need on Hand
You can only audit records that still exist. The IRS requires businesses to keep records supporting income tax returns for at least three years, extending to six years if unreported income exceeds 25% of the gross income shown on the return, and indefinitely if no return was filed.11Internal Revenue Service. How Long Should I Keep Records? Employment tax records must be kept for at least four years after the tax becomes due or is paid.
Transfer pricing documentation has its own retention logic. Because it must exist when the return is filed and be producible within 30 days of an IRS request, the practical retention period extends for the full statute of limitations on the return plus the examination period.8Internal Revenue Service. Transfer Pricing Documentation Best Practices Frequently Asked Questions For companies with complex intercompany pricing, seven years is a common retention floor. Pricing policy documents, delegation of authority matrices, customer contracts, and master price list archives should be retained at least as long as any transaction they govern could be audited or litigated.
Turning Findings Into Fixes
The audit report is where findings become actionable. Open with scope, objectives, and methodology, then move to what leadership actually cares about: the quantified financial impact of every identified issue. Estimated revenue leakage, potential overstatement of accounts receivable, and unearned rebate liabilities all need dollar figures attached. Findings without dollar signs get deprioritized, so invest the time to estimate impact even when precision isn’t possible. Rank findings by risk, with system vulnerabilities and unauthorized discount patterns above minor documentation gaps.
Hold an exit meeting with process owners and relevant stakeholders before finalizing the report. It isn’t a formality. The meeting lets management correct genuine errors in observed data and add context the audit team may have missed. Defensive pushback gets noted and addressed in the final version.
Then build a Corrective Action Plan with a specific owner and deadline for every finding. Vague items like “improve discount controls” accomplish nothing. Effective actions look like: “Implement a system-enforced approval workflow for discounts exceeding 10%, owned by the VP of Sales Operations, effective by Q2.” Address root causes, not symptoms. If the audit found widespread unauthorized discounts, the fix isn’t retroactive discipline; it’s a system control that blocks the discount from being applied without the required approval.
Schedule follow-up three to six months later. A limited-scope review tests whether the new controls are operating effectively. That follow-up is what separates audits that change behavior from audits that produce impressive reports and change nothing.