Accounts Payable Audit Procedures

Accounts payable audit procedures are the specific tests an auditor performs to decide whether the recorded payables balance is fairly stated: the search for unrecorded liabilities, cutoff testing, vouching invoices to purchase orders and receiving reports, vendor statement reconciliation, and evaluation of the controls around vendor setup and payment. Because payables are a liability, the primary assertion is completeness, meaning the real risk is understatement, so the procedures are built to find the invoice that was received but never booked rather than the one that was invented. Last updated July 2026.

This guide is written for the person doing the work: the internal auditor building a program, the external audit senior in fieldwork, or the controller who wants to know what is coming. It sits alongside our broader overview of the accounts payable audit and the practical accounts payable audit checklist. Here the focus is narrow: the procedures themselves, the assertion each one addresses, and the evidence it produces.

What are the audit procedures for accounts payable?

The audit procedures for accounts payable are the substantive and control tests that support the payables balance: reconcile the AP subledger to the general ledger, perform the search for unrecorded liabilities, test cutoff around period-end, vouch a sample of recorded invoices to their purchase orders and receiving reports, reconcile vendor statements to the ledger, send accounts payable confirmations where warranted, and evaluate segregation of duties. Substantive procedures test the balance directly; tests of controls tell the auditor how much reliance the balance can bear.

The standards frame this. For issuer audits, PCAOB AS 1105, Audit Evidence, governs the sufficiency and appropriateness of evidence and ties each procedure to the assertion it addresses. For private company engagements under AICPA standards, the parallel is AU-C 500, Audit Evidence. The two are consistent in substance; the audience decides which one you cite in the workpapers. A typical audit program for accounts payable weights the substantive work toward completeness, then fills in existence, accuracy, and cutoff with targeted vouching and recalculation.

What is the primary assertion tested in an accounts payable audit?

Completeness is the primary assertion tested in an accounts payable audit. Payables are a liability, so the direction of risk is understatement: leaving a real obligation off the books overstates income and equity. This is the mirror image of the asset side, where existence dominates because the risk is overstatement. Auditors design the payables program to detect the liability that was omitted, not the one that was fabricated, and that single fact shapes almost every procedure that follows.

The practical consequence shows up in sampling and confirmation strategy. When auditors confirm payables, they do not simply confirm the largest recorded balances the way they would with receivables. They confirm active vendors that show small or zero balances, because a vendor the ledger says you owe nothing is precisely where an unrecorded invoice hides. The other assertions still get tested, but completeness sets the priorities.

What is the search for unrecorded liabilities?

The search for unrecorded liabilities is the core completeness procedure: the auditor looks past the ledger to find obligations that existed at period-end but were never recorded. It is the single most important test in the accounts payable program because it directly attacks understatement, the way payables are most likely to be misstated. The procedure combines several sources of evidence, each catching a different form of the same problem.

• Subsequent cash disbursements. The auditor obtains the cash payments register for the weeks after period-end, sets a dollar threshold, and traces each payment above it to the underlying invoice and receiving report. If a January check paid for goods received in December, that liability belonged in the audit period and should have been accrued.
• Open receiving reports. Goods received near year-end with no matching invoice recorded are a classic missing liability. The auditor reviews unmatched receiving reports at the balance-sheet date.
• Unprocessed invoices and vendor statements. Invoices sitting unentered and supplier statements that arrive after period-end are examined for charges that relate to the audit period.
• Open purchase orders. Outstanding POs are inspected for goods or services received but not yet invoiced or accrued.

Reconciling vendor statements to the recorded payables ties these threads together, which is where clean subledger data pays off. Teams that keep the ledger tight with accounts payable reconciliation software hand the auditor a shorter list of reconciling items and a faster search.

What is cutoff testing in accounts payable?

Cutoff testing verifies that payables and the related purchases are recorded in the correct accounting period. The auditor selects transactions in the days on either side of period-end and checks the invoice date, the receiving date, and the posting date against each other to confirm the liability landed in the right period. It addresses completeness for items pushed into the next period and occurrence for items pulled into the current one.

In practice, cutoff and the search for unrecorded liabilities overlap: both examine the period boundary, and evidence gathered for one often supports the other. The distinction is direction. Cutoff asks whether a recorded transaction sits in the right period; the search asks whether an unrecorded one is missing entirely. A December receiving report matched to a January-dated invoice is the kind of item that surfaces in both tests, and it is exactly the sort of misstatement that shifts expense between years.

How does three-way matching work as an audit control?

Three-way matching compares the purchase order, the receiving report, and the vendor invoice before a bill is approved, requiring that quantities and prices agree across all three. As a control, it confirms the company ordered the goods, actually received them, and was billed the amount agreed. As an audit procedure, vouching a sampled invoice back to its PO and receiving report is how the auditor supports the existence, occurrence, and accuracy of a recorded payable.

When the auditor plans to rely on the match rather than test every transaction substantively, they test the control itself: does the system block payment when quantities disagree, and who can override a mismatch? A detailed walkthrough of the mechanics lives in our explainer on what is three-way matching. The control only works when full line-item detail is captured, not just the invoice total, which is one reason accounts payable automation software that preserves a complete audit trail makes both the control and the test of it more reliable.

What segregation of duties should accounts payable have?

Accounts payable should separate five functions so that no single person controls a payment from start to finish: (1) vendor master maintenance and approval of new vendors, (2) invoice entry and voucher processing, (3) payment authorization and approval, (4) payment execution such as check signing or ACH release, and (5) bank reconciliation. When one person can create a vendor and pay it, they can create a fictitious supplier and route money to themselves; splitting these roles removes that opportunity.

The auditor tests segregation by mapping who holds each role and looking for combinations that let a single individual both set up and pay a vendor, or both cut a payment and reconcile the bank account that would reveal it. Vendor master governance deserves particular attention, since a changed bank account or a new supplier is the entry point for most billing fraud. Good governance means validating each new vendor independently, checking the tax ID and address, confirming no vendor bank account matches an employee's, and, where a contract requires it, checking that you can confirm each active vendor still carries valid insurance before releasing payment.

How do auditors use accounts payable confirmations?

Accounts payable confirmations are direct requests to vendors asking them to report the amount your company owes them. Unlike receivables confirmations, which target large recorded balances, payables confirmations are aimed at completeness, so auditors select active suppliers regardless of the recorded amount, including those the ledger shows at or near zero. A vendor that reports a balance the books do not carry is a found liability. Confirmations are most useful when the population includes major suppliers with high activity, disputed accounts, or unusual terms, and they supplement rather than replace the subsequent-disbursements search.

What tax documentation do these procedures touch?

Vendor testing and the search for unrecorded liabilities both brush against information reporting, so it belongs in the audit program. A signed Form W-9 should be on file for every reportable vendor before their first payment, and the auditor may sample vendor files to confirm it. For tax years beginning after 2025, the One Big Beautiful Bill Act raised the Form 1099-NEC and 1099-MISC reporting threshold from $600 to $2,000, effective for payments made after December 31, 2025 (forms filed in early 2027), with inflation indexing from 2027 forward. Backup withholding of 24 percent applies when a vendor fails to furnish a valid taxpayer identification number. Our guide to the 1099 vendor process covers how this ties back to clean vendor records.

Building the audit program

An effective audit program for accounts payable moves in a logical order: reconcile the balance first, then attack completeness with the search for unrecorded liabilities and cutoff testing, then confirm existence and accuracy through vouching and confirmations, and finally evaluate the controls that produced the numbers. Whether you cite PCAOB AS 1105 for an issuer or AU-C 500 for a private company, the substantive procedures are the same, and completeness stays at the center throughout. The engagements that go smoothly are the ones where the payables data is clean going in, the reconciling items are explained, and the three-way match evidence is already assembled, so fieldwork becomes verification rather than a hunt.