Guide
How to Audit Invoice Approvals
By Keelstar Team · Updated June 1, 2026
The short answer
For each sampled invoice, produce the invoice image, PO or contract support if required, the approval chain showing each approver and timestamp, evidence the correct matrix tier was applied, and payment record. Gaps in the chain or approvers below threshold for the amount are findings — 'approved in email' without a central trail is a finding waiting to happen.
Define the audit objective
Common objectives: approvals comply with the matrix, segregation of duties held, support exists for services billed, and payments match approved amounts. Scope informs which invoices to pull — capital, T&E, utilities, new vendors each carry different risks.
Evidence per sampled invoice
Assemble a complete packet auditors can follow without AP narration.
- Vendor invoice PDF and receipt date
- PO, receipt, or contract excerpt if policy requires
- Approval log: actor, role, date-time, action
- Matrix version showing required approvers for amount and department
- Payment authorization and bank record
Tests auditors run
Was the approver authorized for this amount? Did anyone approve their own submission? Was there a second approver when required? Did payment occur before approval? Were vendor bank details changed near the payment date? Software trails answer these in seconds; email cannot.
Common findings and fixes
Split approvals across email and ERP. Approvers below threshold. Rubber-stamp approvals with no review evidence. Late approval after payment. Fix with enforced workflow, training, and periodic AP control self-assessments — not only at year-end audit.
Continuous monitoring vs point-in-time
Strong teams run monthly exception reports: invoices paid without approval, matrix overrides, new vendors with immediate large payments. Continuous monitoring reduces audit surprises and fraud window.
Frequently asked questions
- How many invoices should we sample?
- Internal audit typically uses risk-based sampling — more from high-dollar, new vendors, and manual payments. There is no universal count; document your methodology.
- Do we need PO matching for every invoice?
- Policy-dependent. Auditors look for consistency — PO required vendors without PO support is a common finding.
Related guides
Put this into a monitored workflow
Invoice Approval handles this continuously — with reminders and an audit trail.