How Do You Test Accounts Payable Controls to Find Discrepancies?

What Is an Accounts Payable Control Test?

An accounts payable control test is an audit procedure designed to determine whether a company’s processes for authorizing, recording, processing, and paying liabilities operate as intended. It is not merely a visual review of invoices: the auditor selects transactions, traces them through relevant documents and systems, and looks for evidence that one or more controls prevented or detected errors, fraud, duplicate payments, invalid vendor activity, or improper journal entries. In a mature accounting system, a well-designed control may include purchase-order approval, three-way matching, segregation of duties, vendor-master changes, payment authorization, and reconciliation of the general ledger to subsidiary records. Testing usually addresses both design and operating effectiveness; a control that exists on a flowchart but has not been performed consistently is not effective in practice. The objective is not to certify that every payable balance is correct, but to obtain sufficient evidence about the controls that reduce the risk of material misstatement.

Also worth reading: How Do Modern Bank Reconciliation Automation Controls Function to Prevent Financial Discrepancies in 2026? · How are ai financial audit tools 2026 changing the way we detect discrepancies in corporate accounts? · How Do Audits Find Financial Discrepancies in 2026?

A useful testing guide begins by translating each control into a testable condition. For example, “payments require approval” is too broad unless the auditor identifies the approval threshold, required approver, system evidence, and exception process. The company may configure its accounts payable system to block invoices above $25,000 without a director’s approval, while invoices of $25,000 or less follow a different route. The auditor can then select items above and below that threshold, inspect authorization timestamps, and determine whether approvers had appropriate responsibility. Thresholds and sample sizes are engagement-specific rather than universal audit rules, so figures such as $25,000 are examples of criteria established by management, not prescribed regulatory limits.

How Accounts Payable Control Testing Works

The process normally has four connected stages. First, the auditor obtains an understanding of the procurement-to-payment cycle, including who can create vendors, enter invoices, approve expenditures, release payments, amend master data, and post journal entries. Second, management documents important controls and the risk they address, such as preventing a fictitious supplier, duplicate invoice, conflict of interest, or payment to an incorrect bank account. Third, the auditor performs walkthroughs by following one transaction from requisition through settlement and then examines a sample across the year, near period-end, and after system changes. Finally, results are evaluated for design deficiencies, operating deficiencies, and possible fraud indicators before the auditor decides whether substantive testing must expand.

Auditors commonly use inspection, inquiry, observation, reperformance, data analysis, and recalculation. Inspection is appropriate when approval is visible in a workflow log; reperformance is stronger when the auditor independently recalculates the three-way match or payment total. Inquiry can explain a process, but it is weak evidence by itself because a person’s memory may differ from actual practice. Data analytics can identify duplicate invoice numbers, round-dollar payments, payments made on weekends, vendors added shortly before payment, and journal entries posted directly to accounts payable. Findings from analytics do not automatically prove fraud, however, and should be investigated alongside supporting documents and explanations.

## Step-by-Step Guide to Testing AP Controls

A practical AP control testing guide starts with understanding the company’s business and identifying the assertions exposed by each account. Existence concerns whether recorded liabilities and purchases are real, completeness concerns whether all obligations were recorded, accuracy concerns whether amounts were calculated correctly, cutoff concerns whether transactions were recorded in the proper period, and authorization concerns whether management approved the transaction. Vendor creation, invoice approval, payment release, and ledger reconciliation each address different risks. The auditor should not treat “AP controls” as one undifferentiated group; a strong invoice approval process says little about whether bank-account changes are protected.

The next step is to define a population and select a sample. The population should be complete and reconcilable to the source system, with fields such as document number, vendor, date, amount, approver, payment date, journal-entry flag, and bank account. Selection can use random sampling, targeted risk-based sampling, or a combination of both. For example, an auditor may select all payments above $50,000 during the final 15 days of the quarter, all manual journal entries to AP, and a random sample of routine payments. The sample is then tested for the specific control the auditor expects to exist. Results should be recorded in a repeatable workpaper, including population definition, selection method, item tested, evidence obtained, exception, and conclusion.

For each sample item, the auditor should confirm that required evidence exists, is authentic, relates to the same transaction, and was completed at the appropriate time. A copied PDF invoice can establish invoice existence but not that the original transaction was properly approved. Likewise, an email approval is useful only if it contains enough information to identify the transaction and was sent through a controlled process. Exceptions should be classified as control deviations, potentially compensating controls, or indicators requiring expanded fraud procedures. The audit team should not immediately describe every failed item as misconduct; a missing second approval may be an operating failure, while an altered bank record or fabricated invoice needs a different investigation.

High-Value AP Controls and What to Test

The three-way match is one of the most useful routine controls. The auditor should determine whether the system compares the purchase order, goods receipt, and vendor invoice for the same vendor and transaction, then independently reperforms the comparison for selected items. Quantity and price tolerances should be understood rather than assumed. A company might allow a $100 price variance or a two-day date difference, but those tolerances need an approved business purpose. Tests should look for invoices paid despite material differences, split purchases designed to stay below approval limits, and receipts entered after payment without an exception.

Vendor-master controls deserve separate attention because a fraudulent vendor can enter the process before a normal invoice is created. Useful evidence includes an onboarding checklist, tax documentation, independent vendor validation, authorized bank-account changes, and dual approval for sensitive changes. The auditor can compare new vendors to payment activity, look for vendors created shortly before the first payment, and inspect changes made through emergency or administrative accounts. Segregation of duties should be tested by comparing access rights to job responsibilities. One person who can create a vendor, enter an invoice, approve it, and change the bank account creates a concentration of risk even if a system report is labeled “segregated.”

Payment controls should address who releases payments, how the bank identifies authorized files, and how master data is changed. The auditor may inspect bank-release reports, rejected payment files, positive pay or payment controls, and evidence of bank callback procedures. Journal-entry controls are equally important, particularly manual entries, round-dollar entries, entries posted after close, and entries that move expenses among accounts. Companies using a cloud accounting platform should obtain access reports and configuration changes, not rely only on a management representation. Compensating controls may include daily bank reconciliations, controller review, retrospective analytics, or independent vendor confirmation, but they should be evaluated for precision and actual performance.

Examples of Tests and Discrepancy Indicators

Suppose a company states that invoices over $10,000 require procurement-manager and controller approval. The auditor selects 40 invoices, confirms that 36 have both approvals, identifies three lacking a documented approval, and notes one invoice split into two items of $9,800 each. The control deviation rate is 10% if all four items are treated as exceptions, but severity may differ because the split invoices could indicate deliberate threshold avoidance. The auditor should inspect whether both invoices concerned the same purchase, whether the same vendor or date was involved, and whether management’s explanation is supported by evidence. A deviation does not automatically establish material misstatement, but repeated or systematic exceptions can make reliance on the control unsuitable.

Other useful tests include tracing paid invoices to the approved purchase order, inspecting subsequent cash disbursements for duplicate document numbers, and comparing vendor statements to recorded balances. Duplicate analytics can group records by vendor, amount, date, invoice number, and bank account, then remove obvious legitimate repeats before investigating. The auditor may also identify payments posted to unusual vendors, payments to dormant vendors, sequential invoices with unusual decimal patterns, and credits recorded after payment. For manual entries, analytics can flag users, posting dates, amounts, and descriptions, while access reports show whether those users could create entries without independent review. These methods find anomalies efficiently, but an unusual item still requires substantive evidence before it becomes a reported discrepancy.

External evidence can be especially valuable when internal documentation is weak. A vendor statement, bank confirmation, purchase contract, shipping document, or subsequent payment may support existence, completeness, valuation, or cutoff. Confirmed amounts should be reconciled to the client’s records and followed through to invoices and payment evidence. The auditor should distinguish a clerical difference from an unauthorized transaction: a $75 timing difference caused by invoices mailed on the statement date is usually a reconciliation issue, while a payment to a vendor’s incorrect legal entity requires investigation. A financial-audit approach should therefore connect data anomalies, control operation, and underlying transactions rather than treating the audit as only a software test.

Common Mistakes in AP Control Testing

One common mistake is testing the control description instead of the control itself. Asking whether a policy exists does not establish whether employees followed it, and observing one approval session does not prove operation throughout the year. Another error is relying heavily on inquiry or screenshots because they are easy to obtain. Screenshots can be incomplete, altered, or detached from the system’s audit trail, so direct access, reports, and transaction samples are generally more persuasive. Auditors also sometimes ignore exceptions because the sampled amount is small, but systematic exceptions can indicate control weakness even when each error is immaterial by itself.

A further problem is failing to reconcile the tested population. If the invoice report used for sampling is not tied to the general ledger or includes duplicates and voids, the result may not represent the account. Sample size should reflect assessed risk, control precision, deviation tolerance, and the evidence available; no single percentage is correct for every AP test. Management should avoid marking every anomaly as a pass simply because an investigation is open, while auditors should avoid alleging fraud without sufficient evidence. Both sides benefit from a documented chain from the detected condition to its accounting effect and proposed correction.

Population completeness also requires attention to migrated invoices, manual invoices, credit memos, and payments made outside the main system. Separate contractor reimbursements, procurement-card activity, payroll-related liabilities, and interfranchise balances may affect AP even if they are not labeled as vendor invoices. A control can be bypassed by an emergency process, bulk upload, or administrator account that is omitted from the procedure narrative. The auditor should inspect system logs and process maps for alternate paths. Finally, testing before year-end without examining the close period can miss cutoff failures, and reviewing the bank after year-end without matching it to the liability can miss unrecorded obligations.

When to Expand Testing and Take Action

Audit procedures should expand when controls are absent, poorly designed, overridden, or not consistently performed. A missing segregation of duties, unrestricted vendor creation, or ineffective review of manual journal entries can lead to broader substantive work because the risk of management override or fraud is higher. The auditor may increase the number of items tested, search all payments above a defined threshold, test journal entries for the full close period, confirm selected balances, and perform revenue or expense-side corroboration where permitted. Expansion is not automatic merely because one invoice lacks an approval; the response depends on the nature, cause, frequency, and potential magnitude of the exception.

Management should investigate immediately when a discrepancy could affect cash, legal liability, tax reporting, or financial statements. Examples include duplicate cash payments, payments to an invalid bank account, fictitious vendors, unrecorded vendor statements, material post-close entries, and transactions deliberately split around approval thresholds. The action should preserve evidence, identify affected accounts and periods, quantify possible exposure, and determine whether correction, disclosure, or control redesign is required. Legal, compliance, or forensic specialists may be appropriate where suspected misconduct, cyber compromise, or regulatory reporting is involved. Auditors should maintain professional skepticism while avoiding conclusions that are not supported by facts.

Timing matters because a finding in one quarter can be corrected before the financial statements are issued, but a later discovery may require restatement, amended filings, revised controls, or expanded internal investigation. A useful escalation rule is to record the transaction value, affected period, suspected control failure, and status within the audit file. Management can set internal thresholds, such as reviewing any manual AP entry above $5,000 or any bank-detail change above $10,000, but those numbers are policy choices rather than accounting requirements. As of 25 September 2026, companies should also consider whether current payment systems, automated workflows, and vendor onboarding tools have created new access or override risks.

Cost, Staffing, and Alternatives to Formal Audit

The cost of AP control testing depends on the number of systems, manual processes, transactions, locations, and identified control weaknesses. A small company with clean, automated, low-volume processes may be able to perform a limited review with an accountant and an independent bookkeeper or fractional audit professional, while a multi-entity organization with ERP migrations and high manual payment volume may require a larger team and data extraction. Professional fees are not reducible to a universal hourly amount because scope, evidence quality, and remediation work vary. A low-cost initial diagnostic can still be useful if it includes population reconciliation, access review, invoice sampling, bank-detail change testing, and a documented remediation plan.

Companies can use internal audit, compliance review, outsourced accounting, audit software, and data analytics as alternatives or supplements to a statutory financial-statement audit. Internal audit is useful for ongoing monitoring but is not automatically a substitute for an independent external audit. A bookkeeper can prepare a control matrix and exception report, but the person who processes payments should not independently approve or test their own work. Automated tools can test completeness, duplicate patterns, approval thresholds, and access conflicts, yet configuration and data-quality review remain necessary. The most economical approach is often staged: establish the population, test the highest-risk controls, remediate obvious gaps, and then determine whether deeper testing is justified.

A comparison helps organizations match the method to the decision they need to make.

## A Reliable AP Testing Framework

The definitive AP control testing guide is risk-based, documented, and tied to actual transaction evidence. Start with accounts payable assertions, identify the people and systems that can change liabilities, and write each control so that its expected operation can be observed. Select a complete population, test both routine and unusually risky items, and preserve evidence supporting every conclusion. Reconcile the test result back to the ledger so that the reader can see what was covered. Report not only failures but also compensating controls, the likely effect on financial statements, and the period in which a correction belongs.

The strongest conclusion is measured rather than absolute. A control can be well designed yet fail in one transaction, or a control can appear effective because an auditor inspected only convenient records. Conversely, a small company with limited segregation may reduce risk through independent monthly bank reconciliation, documented owner approval, and a direct review of vendor changes. The key question is whether the control operated early enough to prevent or detect a material discrepancy, and whether management has corrected the underlying process. For organizations seeking to audit any financial area and find discrepancies, the AP control testing approach is most useful when it connects authorization, vendor integrity, transaction accuracy, cutoff, payment, and ledger completeness in one defensible review.