Transaction risk intelligence
Automated supplier statement reconciliation
Supplier risk intelligence
Managed AP recovery audit
Supplier file performance review
Forensic risk analysis
Consulting and bespoke reporting
Audits are getting tougher
Strong controls keep you on track
Ask any Finance team how their last audit went, and you’ll usually get the same answer. The results were fine, the prep and the process though… Exhausting. A scramble for evidence. A late night reconciling a statement. A question from the auditor that couldn’t be answered.
That scramble is getting harder to write off as just part of the job.
Audits are getting more rigorous. As of April 2026, the UK’s Financial Reporting Council published a revised version of ISA (UK) 240, the standard that governs how auditors handle fraud.¹ It requires more rigorous fraud risk assessment and more transparency in what auditors report back to the board. While takes effect for audits beginning on or after 15 December 2026, auditors are already starting to ask for more information and more clarity.
If you’re reading this outside the UK, the international version of the same standard has been issued by the IAASB. Regulators in other jurisdictions are adopting it at their own pace.² Wherever you sit, the practical result is the same: your auditor will be required to probe deeper into whether your controls truly work.
Every finance team has a gap or two in their controls. The key is knowing where they are, and closing them.
This blog looks at four areas where those gaps tend to sit, and what you should be able to demonstrate in each, so you can get ahead of the next AP audit.
Goal 1: Ledger accuracy
Auditors will check that what’s on your ledger reflects reality:
- Transactions recorded correctly and reflected in the ledger.
- Invoices matched to the right purchase orders, with no duplicates.
- Supplier statements reconciled, with every invoice accounted for.
- Transactions sit in the correct period, with no unrecorded liabilities.
What you should be able to show:
A consistent, accurate process running month to month, covering the majority of your supplier spend. That’s the difference between ledger accuracy being a discipline or a scramble. If your team is doing this manually at scale, ask yourself whether that’s really sustainable, or whether automation is necessary.
Goal 2: Thorough fraud risk controls and prevention
Fraud in AP doesn’t wait for a policy review. A supplier’s bank details get changed by a fraudster. A duplicate invoice slips into a payment run. A dormant account gets reactivated years after anyone last checked it. These are live, everyday risks, and your controls need to catch them.
ECCTA comes up a lot in this conversation: The Failure to Prevent Fraud offence requires reasonable procedures against fraud intended to benefit your organisation, which can include internal cases like inflated figures or a bribe paid to win a contract. Most AP fraud sits outside that specific offence, but not always. Your fraud risk assessment should cover off all eventualities.
Here’s what a credible fraud risk assessment should be able to show:
- Documented and enforced segregation of duties.
- Preventative internal and external fraud controls in place.
- A working process to detect fraud before payment.
- Completed, evidenced, supplier checks, including dormancy and duplication in the supplier file.
What you should be able to show:
Fraud controls don’t hold up on a policy document alone. What does is systematic controls which cover all transactions, with an audit trail and measurable results.
You need records of who approved what, with two people signed off on every payment above your threshold. Evidence of invoices flagged and resolved before payment. A dated report showing when your supplier file was screened for dormant or duplicate records, and what happened as a result. Clear employee-supplier conflict of interest checks.
Goal 3: Clear authorisation and documentation
Controls only count if they’re followed consistently, and if you can prove it. Here’s what auditors are looking for:
- Audit trails, organised and accessible across all systems.
- Clear, standardised approval processes, followed by staff.
- Approval limits and delegated authority, respected in practice.
- Manual entries, reviewed and validated.
What you should be able to show:
You should be able to produce evidence that these processes are completed and are working over time via a clear audit trail. You should be able to demonstrate a process for document approval which cannot be circumvented, and be able to easily find when procedure has been overruled. Once again there should be records of who approved what.
Goal 4: A clean, complete, correct supplier file
Your supplier file is a common source of audit findings, and the easiest to overlook. Auditors look for:
- Minimal dormant and duplicate suppliers.
- Supplier details, including VAT information, current and correct.
- Bank detail changes, verified before they’re actioned.
What you should be able to show:
Continuous monitoring for dormancy, duplication, and compliance issues, with evidence of action taken as soon as something surfaces. Routine sanctions screening, and evidence of removed sanctioned suppliers. Changes to supplier details carefully recorded, with approval information.
More control, less reaction
Getting ahead of your next audit comes down to clear, documented controls. Auditors need to see evidence that your team are handling risks, day to day.
Audits are getting sharper, and the standard behind them has changed to match. Treating controls as an ongoing discipline, rather than a pre-audit sprint, is what separates teams who dread audit season from the best in class.
Our P2P risk management software is built to close many of these gaps. It keeps watch on transactions and supplier data, flags what needs a second look, and keeps a human in the loop of every decision. Your team focus their judgement where it matters, and you have evidence of risk controls that work.
