A contract audit checks whether the business is doing what its contracts say, and whether the contracts themselves are managed well. Money leaks when prices drift from agreed rates, renewals lapse into worse terms, discounts are applied that nobody approved, or obligations are missed and penalties follow.
Last reviewed: 17 October 2026. Facts checked. This post sets out an audit method and does not depend on a statute or published standard. We did not open any legal text, so it does not advise on contract law, stamp duty or enforceability. Those need legal advice. We checked existing site posts to link only to pages that exist.
What a contract audit is, and is not
It is a compliance and control audit of how contracts are created, approved, recorded, performed and renewed, and whether transactions follow them. It is not a legal review of clause wording. Auditors can flag risky clauses, such as unlimited liability or automatic renewal, but the legal opinion belongs to counsel.
It sits alongside process audits. A procure-to-pay audit tests whether purchases follow the process. A contract audit asks whether the price paid on the invoice matches the contract, which is a different question. Our P2P checklist covers the process side. See types of internal audit for where this fits.
Scoping
Contracts are too numerous to test all at once. Rank them by:
- Annual value.
- Strategic importance (single source suppliers, key customers).
- Risk (regulated activity, data handling, safety).
- Age and renewal date.
- Past issues.
Build a contract inventory first. If the business cannot list its contracts, that is the first finding.
Programme: five blocks
Block 1: Inventory and repository
- Is there a central register of contracts, with counterparty, value, dates, owner and status?
- Does the register agree to a sample of actual contracts, and to the vendor and customer master?
- Are signed copies findable? Test by requesting ten at random.
Block 2: Approval and authority
- Were contracts approved at the level set in the delegation of authority?
- Was the signatory authorised?
- For high-value or non-standard terms, was legal or finance review obtained?
- Was competitive sourcing used where policy requires it?
Block 3: Performance against terms
This is where leakage is found. Take a sample of contracts and compare, term by term, with what actually happened.
| Term | Test |
|---|---|
| Pricing | Invoice rates against contract rates and rate cards |
| Discounts and rebates | Were agreed rebates claimed or given? Were unapproved discounts allowed? |
| Volumes and minimums | Were commitments met, and were shortfall charges raised or paid? |
| Escalation clauses | Were price changes applied as the clause allows, no more and no less? |
| Payment terms | Are invoices paid on the agreed days, not early or late? |
| Deliverables and service levels | Were credits or penalties applied for misses? |
| Taxes | Is tax treated as the contract states and the law requires? |
Data analytics helps. Match invoice lines to contract rates across the full population and review the exceptions. Our post on vendor invoice matching shows the idea.
Block 4: Renewal and expiry
- Are renewal dates tracked, with notice periods?
- Are there contracts running past expiry with no extension?
- Did any contract auto-renew without review?
- Is spend continuing with suppliers whose contracts have lapsed?
Spend without a contract is a finding in itself: no agreed price, no liability terms.
Block 5: Obligations and risk
- Does the business meet its own obligations, such as reporting, confidentiality and data security?
- Are there clauses with significant exposure, and does anyone own them?
- For key suppliers, is there a review of performance, financial health and continuity?
- Are changes and amendments recorded and approved?
For suppliers handling data or running critical services, see supplier and third-party audits.
Customer contracts
The same logic applies on the sales side. Test that billing matches the contract, that rebates are accurate, that revenue is recognised in line with the terms, and that unusual terms were approved. Accounting treatment for revenue sits with the finance team and the statutory auditor; see our worked example in Ind AS 115 tested against a contract.
Using AI on contracts
Tools that read contracts can speed up extraction of terms into a table, which then feeds the tests above. The auditor must check the extraction against the source for a sample, because a missed clause or a misread number defeats the purpose. Our post on choosing a model for contract and lease review explains what to verify.
Reporting
Quantify leakage where you can: overbilling found, credits not claimed, penalties incurred. A finding written as "invoice rates exceeded contract rates on a sample of 40 lines" is stronger with an amount and a root cause, such as the rate card not being loaded into the system.
Typical root causes:
- Contract terms not loaded into the ERP.
- No owner for the contract after signing.
- Amendments agreed by email and never recorded.
- Renewal dates tracked in personal calendars.
A starting checklist
- Build the contract inventory.
- Rank by value and risk.
- Select a sample across suppliers and customers.
- Test performance against terms using data.
- Check renewals and expired contracts.
- Quantify and report leakage and root causes.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error