Accounts payable audit: what it catches when it runs before the money leaves

The annual accounts payable audit finds last year’s duplicate payments and takes a cut of the recovery. Run continuously, against your own vendor rules, it catches the overcharge before the money leaves. What the audit actually catches — and what changes when it runs in front of the payment run.

Every AP department already has an audit. It runs once a year, it belongs to a contingency firm, and it works backward: twelve months of payment history, a sweep for duplicates and overcharges, a percentage of whatever gets clawed back. The model exists because the leaks are real — vendors double-bill, contract rates drift, surcharges appear — and because no internal team has the hours to read every invoice line against every contract. The annual sweep is better than nothing. It is also, by design, a year late.

What an accounts payable audit actually catches

Start with the duplicate that looks different every time. Same vendor, same service, new invoice number, a slightly different amount, sometimes a different remit address. No two look alike, so no exact-match filter finds them. Catching one means remembering every bill you already paid, and at thousands of invoices a month nobody remembers. A controller doing this by hand pulls the vendor’s invoices, sorts them by amount and date, and reads them side by side looking for the pair that is the same bill wearing a new number. It works on one vendor. It does not work on eight hundred.

Then contract-rate drift. The rate sheet in the contract says one number; the invoice says another; the difference per line is small enough that it never trips an approval threshold. The manual check is tedious in a specific way: pull the contract, pull the rate sheet, line the invoice up against it line by line. Most AP teams do this at renewal and never again — and the drift happens in between, a few cents or a few points at a time.

Then the unit-of-measure overcharge. The contract prices the item by the case; the invoice bills by the each at the case price — or the other way around, depending on which direction favors the vendor that month. Every distributor formats it differently, and the person keying the bill has no reason to know the item’s contracted unit. By hand, this is the check everyone agrees matters and almost nobody runs, because it requires knowing the item, not just reading the bill.

Then the fuel surcharge that appeared mid-contract. A surcharge table was agreed at signing; in month seven a new “fuel adjustment” line shows up, priced off a different index, and nothing on the invoice announces the change. Catching it means comparing this month’s bill structure against last month’s for every vendor — the kind of check a person runs once and a spreadsheet forgets.

And the pass-through charges that should have been billed back. Your customer’s contract says certain fees are recoverable; the vendor bill arrives; nobody ties the charge to the clause fast enough, so the fee lands on your P&L instead of the customer’s invoice. This is the quietest leak of the five, because nothing is wrong with the vendor bill — the money was recoverable and simply was never recovered.

Why the same leaks reopen next quarter

The annual sweep finds all of this — in arrears. The recovery firm samples the year, confirms the overcharges with evidence, negotiates the clawback, takes its percentage, and leaves. What it does not touch is the process that produced the leaks: the same inbox, the same keyed entries, the same rate sheets nobody re-checks. The leaks reopen before the recovery firm’s own invoice is paid, because nothing about how bills get approved has changed. An audit of accounts payable that runs once a year is a recovery mechanism. It is not a control.

A recovery audit finds last year’s leaks and charges you a percentage of your own money. A continuous audit stops this week’s.

What changes when the audit runs before payment

Move the same checks in front of the payment run and the economics invert. The duplicate gets flagged while the bill is still a bill, not after it is a disbursement — a short email to the vendor instead of a months-long recovery claim. Rate drift gets caught at the first invoice that drifts, not sampled out of twelve months. The checks are the same checks a controller would run by hand; what changes is that they run on every invoice, every time, without the fatigue that sets in at 4pm on a Friday.

That is what encoding the rules means in practice. The knowledge your best AP person carries — this vendor’s case-vs-each quirk, that contract’s surcharge table, which fees are pass-through — gets written down as a rule set, and every invoice line gets read against it. Reading is the part that used to break first: legacy OCR pulls 40–50% of fields off an emailed vendor bill, which is why the inbox needed humans in the first place. Systems that read for meaning against your vendor dictionary hit 97–98%, and at that accuracy the audit can run on everything instead of a sample. The scale math inverts too. One AP organization runs 3,000 invoices a day with 130 people matching by hand; with the rules encoded, roughly 500 of every 5,000 bills route to human review — the exceptions, each with the reason attached — and the rest post clean. That is the shape of the continuous AP audit we build (zaigo.ai/workflows/ap-recovery-audit).

What still belongs to people

The honest limits: encoding the checks does not encode the judgment. A flagged duplicate is evidence, not a decision — someone who owns the vendor relationship decides whether to short-pay, dispute, or let it ride, and vendors remember how you handle disputes. Rate increases arrive legitimately, and someone has to decide which ones the contract actually allows. New vendors, new fee types, new contract structures all start as judgment calls; the rule set grows when a person writes the new rule down. And the audit is only as current as the contracts behind it — if the rate sheets live in a drawer, the first weeks of any engagement are spent getting them out.

The same before-the-money logic applies on the other side of the ledger: payroll has its own version of this audit, and it runs before payday for the same reason (zaigo.ai/insights/payroll-audit-before-payday). Auditing accounts payable is the pay-side half of the same discipline.

If you suspect the leaks but have never seen them itemized, the starting point is a two-week audit: we map the rules your bills are actually judged by, run them against your recent payment history, and put a payback estimate on the table before anything gets built. If the map says the leaks are small, that is the answer — and it cost you two weeks instead of a contingency percentage. The next step is a 30-minute working call: zaigo.ai/book-a-call. Bring a month of vendor invoices, and we will tell you on the call what a continuous accounts payable audit would catch.