Accounts Payable Audit: What It Is, Checklist & Best Practices

A vendor emails to say they changed banks. The message looks right, the logo is there, and someone on your team updates the account number before the next payment run. Three weeks later the real vendor calls asking why they haven’t been paid.

Most payables problems look like that. Nobody notices them when they happen. They show up later, once the money is gone. An accounts payable audit is how you find them while there’s still time to do something about it: a structured look at who you pay, what you pay for and how the money leaves your account.

What is an accounts payable audit?

Accounts payable is the money your business owes to vendors: suppliers, contractors, software subscriptions, rent, utilities. An accounts payable audit reviews those bills and the payments that settled them, and asks five simple questions about each one:

• Is the vendor real? And is it a vendor you actually chose to work with?
• Did you receive what you paid for? Goods arrived, service was delivered.
• Was the amount right? It should match the quote, the contract or the purchase order.
• Was it approved by the right person? Before the payment went out, not after.
• Was it paid once? Not twice, and not to the wrong account.

It’s worth separating this from a financial statement audit performed by a CPA firm. That kind of audit gives an opinion on your financial statements as a whole. An accounts payable audit is narrower and more practical. Its job is to protect cash and tighten the process, and you can run one internally or bring in an outside reviewer.

Why it matters more than most owners think

Payables are where money leaves the company, which makes them the natural target for both honest mistakes and fraud. The data on occupational fraud backs this up.

In its 2026 study of 2,402 fraud cases, the Association of Certified Fraud Examiners found that more than half involved either a lack of internal controls or someone overriding the controls that existed. Time matters, too: frauds caught in the first six months had a median loss of $40,000, while schemes that ran for more than five years passed $1.1 million.

None of this means your team is stealing from you. Most payables issues are plain errors: an invoice entered twice, a credit memo nobody applied, a subscription that should have been canceled a year ago. Still, it’s the same audit that catches the honest mistakes and the dishonest ones.

Accounts payable audit checklist

Work through these five areas in order. The first one is the most important, because a clean vendor list makes everything after it easier to verify.

Red flags to look for

One of these on its own doesn’t prove anything. They’re signs to stop and ask a question before moving on.

What you see	What it may mean
Vendor with only a P.O. box and no phone	Shell or fictitious vendor
Invoices just under the approval limit	Someone avoiding review
Sequential invoice numbers from one vendor	You may be its only “customer”
Recent bank detail change by email	Vendor impersonation attempt
Same amount paid twice in a week	Duplicate payment
Rising spend with no change in volume	Overbilling or kickbacks
One employee who won’t share their tasks	Control gap worth reviewing

That last one deserves a note. The ACFE found that 84% of fraud perpetrators showed at least one behavioral red flag before they were caught, such as being unusually close with a vendor or refusing to take vacations. Nobody should be accused because of a pattern. Still, a process where only one person knows how payables work is a risk, even when that person is completely honest.

How often should you audit payables?

For most small and mid-sized businesses, a rhythm like this works well:

• Monthly: a light review. Reconcile the bank, scan the payment register for duplicates and look at every vendor added or changed that month.
• Yearly: a full audit using the checklist above, ideally before year-end close and tax season.
• Unannounced: a few spot checks during the year. Pick a week at random and trace every payment back to its invoice and approval.

The unannounced part matters more than it seems. In the ACFE’s 2024 data, organizations that used surprise audits had median fraud losses 63% lower and caught schemes in half the time compared to those that didn’t. Proactive data monitoring showed a similar effect, with losses and duration both cut roughly in half.

Best practices to keep payables clean

An audit finds what already went wrong. These habits keep the next audit short:

• Lock down vendor changes. Any new vendor or bank detail change needs a second person and a callback to a known number.
• Pay only from approved invoices. No invoice, no approval, no payment. That includes “urgent” requests from the owner’s email.
• Use a single, consistent invoice number format when entering bills, so your accounting software can flag duplicates.
• Set clear approval limits and require two approvals above a certain amount.
• Separate duties, even in a small team. If you can’t split roles, add an owner review of the payment register every week.
• Review vendor statements at least quarterly to catch credits and missing invoices.
• Automate the boring checks. Rules that flag duplicate amounts, new bank accounts or payments outside the normal run catch issues the same day instead of months later.

Frequently asked questions

What is an accounts payable audit?

It’s a review of the bills your business received and paid, to confirm each payment went to a real vendor, for goods or services actually received, at the agreed amount, with the right approval, and only once.

How often should a small business audit accounts payable?

A light monthly review plus a deeper review once a year works for most small businesses. Unannounced spot checks during the year add a lot of protection for very little effort.

What is a three-way match?

It means comparing three documents before paying: the purchase order (what you ordered), the receiving record (what actually arrived) and the vendor invoice (what you’re being charged). If the three agree, the bill is ready for approval.

How do you find duplicate payments?

Export your payment history and look for the same vendor with the same amount, the same or very similar invoice numbers, or payments a few days apart. Small variations like a missing dash or an extra zero in the invoice number are a common way duplicates slip through.

Who should perform an accounts payable audit?

Ideally someone who doesn’t enter or pay bills day to day: an owner, a controller, an outside bookkeeper or a consulting firm. The point is a fresh set of eyes with no stake in the transactions being reviewed.