How to Run an AP Audit Without an Internal Audit Team

Most AP audit guides read like they were written for companies with a dedicated internal audit department, a compliance officer, and a finance team large enough to split duties across multiple roles. That describes roughly zero of the small businesses that actually need to audit their payables.

The procedure itself is well documented. Four stages, four core checks. The part that derails small teams is not the process. It is the document chaos that turns a two-day exercise into a two-week scavenger hunt through email attachments, filing cabinets, and half-labelled folders on a shared drive.

This guide walks through the full AP audit process for teams of one to five, with specific attention to the document and control gaps that trip up businesses without a standing audit function.

What is an AP audit?

An AP audit is a systematic examination of an organization's AP processes, transactions, and internal controls. The review ensures that all payments are legitimate, well-documented, and recorded accurately in your financial statements.

This is not the same as an IRS audit. An AP audit can be conducted internally as a preventive measure, or externally as part of a broader financial audit. You choose when and how often it happens. The IRS does not.

Why bother? For most businesses, AP is the second-biggest expense after payroll, and most AP balances are due within 30 to 90 days, making them short-term liabilities on your balance sheet. That volume of money moving through a single ledger, on tight timelines, creates the conditions where errors compound and fraud hides.

Why accounts payable is hard to audit

The AP department handles an enormous volume of transactions. That volume is the problem. The ledger becomes prone to errors or gets used to bury fraudulent journal entries, and a small team without segregated duties has fewer chances to catch either one.

The numbers make the risk concrete. The ACFE reported 1,921 cases of occupational fraud in 2023, causing total losses of over $3.1 billion. The average loss per case was $1.7 million. Asset misappropriation, which includes AP fraud schemes like false billing, check tampering, and skimming, occurred in 89% of those cases.

More than half of all fraud cases (51%) occur due to a lack of internal controls or fraudsters overriding existing controls. After reporting, most companies detect fraud through internal audits (14%) and related activities like management review (13%), document examination (6%), and account reconciliation (5%). The catch: you need to actually run them.

Fraudsters conceal their activities by creating, altering, or destroying physical documents such as invoices or checks, or by manipulating electronic documents and accounting system transactions. If your records are disorganized, the concealment is already done for them.

What GAAP requires from your AP records

Before running an AP audit, it helps to know what auditors are measuring against. GAAP sets the baseline.

Accounts payable must be recorded using accrual methodology. They represent short-term debts for goods or services your company has received but not yet paid for. AP balances are current liabilities on the balance sheet because the related vendor invoices are payable within 12 months.

Auditors also check compliance with GAAP and applicable regulations such as Sarbanes-Oxley (SOX), examining transactions from start to finish. They review the audit trail to verify the business used the right accounting procedures, complied with regulations, and received the correct discounts. For small businesses not subject to SOX, GAAP compliance is still the standard an external auditor will hold you to.

The four AP audit procedures

Every AP audit, regardless of company size, generally includes four procedures:

1. Verify completeness of records

Confirm that every transaction that should be in the AP ledger is there. This means checking for unrecorded liabilities: goods or services received but not yet processed for payment. These cause the balance sheet to understate your actual obligations.

2. Validate compliance

Check that transactions follow GAAP rules and your own internal procedures. Auditors examine transactions from start to finish, reviewing the audit trail to confirm correct accounting procedures and regulatory compliance.

3. Confirm transaction validity

This is where vouching happens. Auditors track a transaction from inception to completion through original source documents: purchase orders, vendor invoices, journal entries, and bank records. This is also where vendor confirmations come in. Forms sent to vendors ask them to confirm the balance owed. If the amount confirmed does not match the AP ledger, unresolved discrepancies may require additional testing and could result in a qualified or adverse audit opinion.

4. Verify data accuracy

Compare recorded amounts against source documents. Confirm that the numbers in your accounting system match what appears on the original invoices, bank statements, and purchase orders.

Documents you need before you start

Fieldwork stalls when documents are missing. Gather these before the audit begins, not during it.

The documents required for an AP audit include:

The SOP documentation is the one that catches small businesses off guard. If your AP department has no formal SOPs, auditors stop fieldwork until SOPs are created. They will not resume testing until the AP department has issued formal SOPs or updated existing ones. For a small team, writing these after the audit has started means the audit is now two projects instead of one.

How to run the audit: the four-stage process

The four stages of an AP audit are planning, fieldwork, reporting, and follow-up. Here is what each stage looks like when you are the only person in the room.

Planning

Define the scope. Which fiscal period? Which vendor accounts? All transactions or a specific threshold? Set a timeline, identify who needs to be involved, and confirm you have all the documents listed above.

A successful AP audit requires coordination across AP staff, finance managers, system administrators, and department heads who approve purchases. In a small business, two or three of those roles may be the same person. That is fine, as long as you are explicit about which hat you are wearing at each step.

Fieldwork

This is where most of the time goes. Due to the volume of AP documents, auditors typically review random samplings rather than every transaction. Pull a representative sample, then work through each of the four procedures above: completeness, compliance, validity, accuracy.

Random sampling only works if your records are organized enough to pull a genuinely random set. If half your invoices live in email and the other half in a filing cabinet, you are sampling from whatever you can find, not from your actual transaction population.

Reporting

Document what you found. List discrepancies, control weaknesses, and compliance gaps. Note which procedures passed and which did not. If you found unrecorded liabilities or duplicate payments, quantify them.

Follow-up

Implement the corrections. Making AP audits a periodic habit, preferably annual, allows you to confirm that recommendations from the previous audit were implemented and to pinpoint problems before you file your annual reports.

One practical recommendation: even if you do not work with an accountant regularly, hire one externally to conduct the AP audit. A professional outsider's perspective catches the things you have stopped noticing because you see them every day. Strong AP controls also require segregation of duties, separating the person who records transactions from the person who approves them. When one person handles both, an external auditor provides the separation you cannot build into your daily workflow.

Red flags and when to trigger an unscheduled audit

AP audit timing falls into two categories: scheduled audits at regular intervals, and triggered audits initiated in response to red flags or unusual AP activity.

Red flags that warrant a closer look:

• Duplicate payments. Same vendor, same amount, different invoice numbers. Or the same invoice paid twice.
• Unrecorded liabilities. You received goods or services but the obligation never hit the ledger. This produces a false bottom line.
• Missed payments. Defaults and fines on invoices that should have been paid on time.
• Non-compliance. Tax filing irregularities or payment processes that deviate from your documented SOPs.

If any of these surface outside a scheduled audit cycle, do not wait for the next annual review. Run a triggered audit scoped to the affected vendor accounts or transaction types.

How AP automation makes self-directed audits tractable

AP audits do more than check compliance. They also identify bottlenecks, redundancies, and areas for improvement by assessing the effectiveness of AP controls, workflows, and documentation. Companies use these insights to streamline processes, automate tasks, and enhance internal controls.

But the relationship runs in both directions. Automation does not just come out of an audit as a recommendation. It makes the next audit dramatically easier to run.

The fieldwork stage is where small-team audits break down. You need to pull a random sample of transactions, then trace each one from purchase order to payment through the original source documents. When invoices are scattered across email inboxes, desktop folders, and physical filing cabinets, assembling that sample is the bottleneck.

AP automation tools that capture and index invoices at the point of receipt solve the fieldwork problem before it starts. The audit trail builds itself as a side effect of processing invoices, not as a separate compliance project you staff up for once a year. Random sampling becomes a query instead of a filing cabinet excavation.

If you are evaluating tools, our guide to three-way matching in accounts payable covers the document matching workflow that underpins most AP audit checks, and our AI document processing page explains how automated extraction fits into the AP pipeline.

FAQ

How often should a small business run an AP audit?

Annual AP audits are the recommended minimum. Running one each year allows you to confirm that previous audit recommendations were implemented and to catch problems before filing annual reports. Triggered audits should happen whenever red flags surface, regardless of schedule.

Can I run an AP audit myself, or do I need to hire someone?

You can run the process yourself, but hiring an external accountant gives you a professional outsider's perspective and provides the segregation of duties that small teams cannot build into daily operations. The procedure is the same either way.

What happens if I do not have documented SOPs?

Auditors stop fieldwork until formal SOPs exist. If you are running a self-directed audit, write your SOPs before you begin. Document your approval procedures, payment process, and internal controls. Trying to audit a process you have not documented is auditing a black box.

What is the difference between an AP audit and an IRS audit?

An AP audit is a voluntary internal or external review of your payables processes and controls. You decide when it happens and what it covers. An IRS audit is initiated by the IRS to verify tax compliance. The two may overlap in scope, but an AP audit is a proactive measure you control.

Is accounts payable hard to audit?

AP departments handle high transaction volumes, which makes the ledger prone to errors and a potential hiding place for fraudulent entries. The audit procedures themselves are straightforward. The difficulty is practical: assembling the documents, pulling representative samples, and tracing transactions through fragmented records.