Overview
Pick any paid invoice from March. Is it possible to show, within an hour, who approved the supplier, when the purchase order was raised, and who confirmed the delivery? A procurement team and the finance department need to know this information. That’s what an audit does to a sample of your company’s invoices.
A procurement audit checklist enables companies to score the 12 controls below from 0 to 2. It is necessary to understand the score. A total of 20 or more means you can produce the approval, receipt, and invoice for any sampled purchase order within a working day. A score between 14 and 19 means gaps you can close in a quarter. Below 14, expect findings, and start with controls 3, 5, and 7. This procurement audit checklist doubles for controllers and procurement specialists.
Each control names the evidence an auditor will ask for, so you can test your audit readiness in advance using a procurement compliance checklist.
Start by reviewing Controls 2, 3, and 7, which address vendor master changes, the integrity of approval records, and three-way matching. These controls protect different parts of the procurement audit trail, so prioritize the lowest-scoring control rather than assuming one issue always comes first.
Controls 2 and 9 are particularly relevant to payment integrity: Control 2 helps prevent fraudulent changes to supplier bank details, while Control 9 identifies paid invoices that lack a purchase order or may be duplicates. Control 7 also deserves close attention because weaknesses in three-way matching can allow incorrect invoices to pass through the payment process.
How to score each control
While scoring, give 0 when the control doesn’t exist, or you can’t prove it ran. Give 1 when it exists, but the evidence is manual, partial, or takes more than a working day. Give 2 when the control runs by default, and you can export the evidence within a working day.
The maximum score is 24. The bands above are a rule of thumb for this procurement compliance checklist, not an audit standard, and your external auditor may weigh procurement controls differently. Controls that touch payment, like 2 and 9, deserve extra attention.
12-point procurement audit scorecard
The following audit scorecard will help you test different controls effectively.
Control to Test | Evidence for the Auditor | Score |
Supplier onboarding standard | Completed onboarding file per supplier: tax ID, verified bank details, sanctions check, etc. | ☐ 0 ☐ 1 ☐ 2 |
Second approver on vendor master changes | Change log with old value, new value, requester, and approver | ☐ 0 ☐ 1 ☐ 2 |
Immutable vendor approval trail | Time-stamped, user-stamped log that can’t be edited or deleted | ☐ 0 ☐ 1 ☐ 2 |
Risk-tiered supplier audit schedule | Tier list with the date of the last supplier audit for each high-risk supplier | ☐ 0 ☐ 1 ☐ 2 |
Purchase order raised before the invoice | Report of POs created after the invoice date, with reasons | ☐ 0 ☐ 1 ☐ 2 |
Approval workflow matches authority limits | Authority matrix beside the system’s workflow settings | ☐ 0 ☐ 1 ☐ 2 |
Three-way matching with written tolerances | Match report covering PO, goods receipt and invoice | ☐ 0 ☐ 1 ☐ 2 |
Named approver on match overrides | Override log with reason, approver and date | ☐ 0 ☐ 1 ☐ 2 |
Duplicate and unmatched invoice checks | Duplicate-invoice report and a list of paid invoices with no PO | ☐ 0 ☐ 1 ☐ 2 |
Real-time or weekly spend reconciliation | Dated sign-offs tying the subledger to the general ledger and commitments to actuals | ☐ 0 ☐ 1 ☐ 2 |
Procurement documentation retrievable in one day | Contract, quotes, and bid evaluation pulled for a sampled PO | ☐ 0 ☐ 1 ☐ 2 |
Quarterly governance review | Minutes of the exceptions review, a named policy owner, a risk register | ☐ 0 ☐ 1 ☐ 2 |
Total (out of 24) | 20 to 24: audit-ready. 14 to 19: close gaps this quarter. Below 14: expect findings |
Controls 1 to 4: supplier onboarding and vendor approval trail
Supplier controls come first because later controls assume the supplier was real and approved.
1. New suppliers pass one documented onboarding standard
Supplier onboarding should collect the same four things for each supplier: a tax ID, verified bank details (a bank letter or a callback to a known number), a sanctions screening result, and a signed conflict-of-interest declaration. Score 2 when each supplier file holds all four and a named person signed off before the first purchase order. Score 1 when the standard exists, but files lack items such as a sanctions result or a verified bank letter.
2. Vendor master changes need a second approver
Changed bank details are a well-known route for payment redirection fraud. The person who requests a change can’t be the person who approves it. Log the old value, the new value, the requester, and the approver. Score 2 when the log is complete, and someone has tested a callback to the supplier on at least one recent change.
3. The vendor approval trail can’t be edited
A vendor approval trail earns a 2 only when entries carry a timestamp and a user ID, and nobody can edit or delete them. Corrections become new entries that point to the old one. A spreadsheet fails this test when anyone with edit rights can overwrite a cell.
Prioritize this control alongside Controls 2 and 7 if it receives the lowest score. An auditor can’t trust approvals that someone could have rewritten.
4. High-risk suppliers sit on a supplier audit schedule
Procurement risk management starts with knowing which suppliers carry the most risk. Sort suppliers into tiers by annual spend and by whether they handle your data or your customers’ goods. Record the date of the last supplier audit for each high-risk supplier. Score 2 when each one has been audited within the period your policy sets, for example, 12 months for the top tier.
Controls 5 to 8: purchase order compliance and three-way matching
A procure to pay audit samples purchase orders and invoices, so these four procurement controls get tested hardest.
5. The purchase order exists before the invoice does
Purchase order compliance starts with timing. Run a report of purchase orders created after the invoice date. Each one may be a purchase that skipped approval, and the auditor will ask why. A late PO can be legitimate, such as an emergency repair on a Sunday, so require a written reason for each. Score 2 when late POs stay under a limit your policy sets (for example, 2 percent of invoices) and each exception has a reason on file.
6. Approval workflow matches the authority matrix
Put the authority matrix next to the system’s approval workflow settings and compare them line by line. If the matrix says a department head approves up to $10,000 and the system lets them approve $25,000, the control fails. Then run a split-purchase report: several POs to the same supplier on the same day, each just under an approval limit.
Scoring:
Score 2: The system’s approval workflow matches the authority matrix, and split-purchase reports run regularly with investigated exceptions documented.
Score 1: The authority matrix exists, but workflow mismatches or split-purchase exceptions are not consistently identified, investigated, or documented.
Score 0: No current authority matrix exists, approval limits are not enforced, or split purchases can bypass approval controls without detection.
7. Three-way matching runs with tolerances you’ve written down
Three-way matching compares the purchase order, the goods receipt, and the supplier invoice before anyone pays. Set tolerances by invoice value and record who approved them. As an illustration, you might allow 2 percent or $50 on small invoices and a tighter band on large ones. Score a 2 when the match runs automatically on goods invoices, and someone reviews the exceptions report weekly.
Matching integrity depends on who created each document. The buyer raises the PO, the warehouse posts the receipt, and the supplier issues the invoice. If one person can do all three steps, the match proves nothing.
Three-way matching doesn’t fit services or utilities, which usually have no goods receipt. For those, use two-way matching plus a named approver who confirms the work was done, and say so in your policy.
8. Match overrides need a named approver and a reason
Expect overrides: a supplier chasing payment is reason enough for someone to release a held invoice. That’s fine if the override log shows who did it, why, and when, and if the approver isn’t the person who raised the purchase order.
Scoring:
Score 2: Every override records who approved it, the reason, and the date and time. The approver is independent of the person who raised the purchase order.
Score 1: Overrides are logged, but reasons, timestamps, or independent approval are missing in some cases.
Score 0: Overrides are not logged, or invoices can be released without an identifiable approver and documented justification.
Controls 9 to 12: invoice reconciliation, spend reconciliation and governance
These four controls show whether the first eight keep working after the invoice is paid.
9. Paid invoices tie to a purchase order, and duplicates get caught
Invoice reconciliation means every paid invoice traces back to an approved PO and a receipt. Run two reports: paid invoices with no PO, and possible duplicates. For duplicates, look for the same supplier and amount, or the same invoice number with a character added at the end. Score 2 when both reports run monthly, and every item has an owner.
10. Spend reconciliation runs in real time, or weekly at minimum
Spend reconciliation compares what you committed (purchase orders), what you received, and what you paid against the general ledger. A monthly cycle finds a problem up to 30 days after it happens. A real-time or weekly cycle finds it while the buyer still remembers the delivery. Score 2 when reconciliation runs continuously or weekly, sign-offs are dated, and open commitments are included so month-end accruals don’t surprise you.
Real-time reconciliation needs a live connection between your procurement management system and the ledger. If yours is manual, weekly is realistic and still earns 2.
11. Procurement documentation can be pulled in one working day
Take a sampled PO and pull the contract, the quotes, the bid evaluation, and the approval. If the search takes longer than a day, score 1. Name one storage location per document type, and keep contracts and bid files for the retention period your policy and local law require. Those periods differ by country and industry, so check yours.
Scoring:
Score 2: All sampled procurement documents can be retrieved within one working day, with defined storage locations and retention rules.
Score 1: Documents can be retrieved, but the process takes longer than one working day, or storage and retention practices are inconsistently followed.
Score 0: Key documents are missing, cannot be retrieved reliably, or have no defined storage and retention process.
12. A governance review looks at exceptions every quarter
Name a policy owner. Each quarter, review the exceptions from controls 5, 8 and 9, update the risk register that feeds your procurement risk management, and record the meeting. An auditor reads these minutes to judge whether your procurement governance is used or only documented. Score 2 when you have four consecutive quarters on file.
A worked example: scoring a 150-person distributor
A controller at a distributor with 150 employees, three warehouses, and about 1,800 active suppliers scores the checklist in a two-hour session with the accounts payable lead and a senior buyer. This is a composite example, not a client case.
Controls 1, 2, 4, 6, 9, 11, and 12 get a 2. Control 5 gets a 1: about 1 in 10 invoices at one warehouse, mostly maintenance purchases, carry a PO dated after the invoice. Control 7 gets a 0. The system matches PO to invoice, but receipts are keyed in at the end of the week, so you can't trust the third leg of the match. Controls 3, 8, and 10 get a 1 each, because admins can edit the approval log, overrides carry no reasons, and reconciliation happens monthly.
The total is 18 of 24, inside the middle band. The team fixes control 7 first, then 3 and 5, and schedules 8 and 10 for the following quarter.
Conclusion: Trace 25 purchase orders this week
Block two hours. Pull 25 paid invoices from the last quarter (a sample you can finish in a day; your auditor may choose a different size) and trace each one back through the receipt, the purchase order, and the supplier’s approval. Score what you find against the 12 controls on this procurement audit checklist, then fix the lowest-scoring control that touches payment first: control 2, 7, or 9, if any of them score below 2.
Start remediation with the lowest-scoring controls, giving particular attention to Controls 2, 3, and 7 if they expose weaknesses in supplier payment security, approval-record integrity, or invoice matching. Purchase Requisition Software can help strengthen procurement documentation and approval workflows.
Review Controls 2 and 9 together to strengthen payment integrity, and include Control 7 in that review because it tests whether purchase orders, goods receipts, and invoices agree before payment. Record the corrective action, assign an owner, and set a deadline for each gap. Reassess the controls after remediation to confirm that the fixes work in practice.
