O2C Internal Audit Checklist: Order-to-Cash RCM for Revenue and Receivables
Order-to-cash internal audit tests whether sales are authorised, dispatched, invoiced, collected and reported correctly. It covers customer onboarding, credit approval, sales orders, delivery, billing, GST, collections, credit notes and receivables ageing.
The O2C cycle is where operational pressure most often meets financial reporting risk. Sales teams want orders released. Finance wants collection. Audit needs evidence that revenue is real, correctly timed, collectible and taxed properly. The RCM below is illustrative and should be tailored to the company's revenue model, GST profile, credit policy and internal-audit scope.
O2C RCM: core risks and controls
| Sub-process | Risk | Control | Internal audit test |
|---|---|---|---|
| Customer onboarding | Fictitious or high-risk customer created | Customer KYC, GSTIN/PAN and credit approval should happen before first sale | Test new customers and first invoices |
| Credit limit | Sales released beyond approved credit | ERP credit block and override approval should be configured where credit terms exist | Compare orders to credit limit and overdue ageing |
| Sales order | Unapproved price or discount | Price master and discount approval matrix should govern overrides | Test discounts, manual price overrides and free goods |
| Dispatch | Goods dispatched without approved order | Dispatch should require approved SO and stock availability | Match SO, delivery challan/e-way bill and invoice |
| Invoicing | Revenue booked without delivery or service completion | Invoice generation should follow dispatch/service acceptance evidence | Test invoice date vs dispatch/service evidence |
| GST | Wrong tax rate, place of supply or e-invoice status | GST master validation and e-invoice applicability check should be built into billing review | Compare invoice tax to GST master, IRN and GSTR-1 |
| Collections | Receipts misapplied or delayed | Customer-wise allocation and ageing review should be performed | Match bank receipts to customer ledger and ageing |
| Credit notes | Credit notes used to reverse sales without approval | Credit-note approval and reason code should be mandatory | Test post-period credit notes and unusual reasons |
| Bad debts / ECL | Receivables overstated | Ageing review and provision matrix should support valuation | Test old balances, disputes and collection history |
Customer and credit control checklist
- New customers added without PAN/GSTIN
- Customers sharing bank account, phone number or address
- Customers created by sales users without finance approval
- Credit limit not approved or last reviewed more than 12 months ago
- Orders released despite overdue balances
- Manual override of credit block
- Sales concentrated in customers with poor collection history
Reportable observation example: 18 orders worth ₹1.6 crore were released despite overdue balances above 90 days. In 11 cases, the credit-block override was approved by sales without finance review.
Revenue cut-off checklist
Revenue cut-off is not just a statutory-audit issue. Internal audit should test it at the cadence set in the annual plan because late dispatch and early invoicing distort operating performance.
- Invoice date before dispatch date
- E-way bill generated after invoice date
- Dispatch before sales-order approval
- Services invoiced without service completion evidence
- Revenue booked in March and reversed by April credit note
- Goods-in-transit without clear transfer-of-control basis
- Manual journal entries to revenue near period-end
GST and e-invoicing overlay
O2C audit in India should include tax and e-invoice checks:
- Correct GSTIN and place of supply
- Correct tax rate and HSN/SAC
- E-invoice applicability and IRN generated where required
- E-way bill generated where required
- GSTR-1 agrees with sales register
- Credit notes reported within statutory time limits
- Export/LUT documentation for zero-rated supplies
- Whether any outward supply is notified under reverse charge, with correct invoice disclosure and GSTR-1 treatment
Recipient-side self-invoice testing belongs mainly in P2P or inward-RCM audit work, not in the normal outward revenue checklist.
Receivables and collections
Receivables testing should connect sales, credit, cash and provisioning.
| Test | Why it matters |
|---|---|
| Ageing by customer and invoice | Finds old and disputed balances |
| Subsequent receipts | Validates collectability |
| Credit-note review | Detects revenue reversal after reporting date |
| Round-sum receipts | Flags possible accommodation entries |
| Customer confirmations | Supports existence and rights |
| Dispute tracker | Separates slow collection from genuine dispute |
| ECL/provision matrix | Links ageing to financial-statement valuation |
What to report
Weak observation: "Credit control needs improvement."
Useful observation:
- Condition: 24 invoices worth ₹2.1 crore were issued to customers already beyond approved credit limit.
- Criteria: Credit policy requires finance approval for any sale exceeding sanctioned credit limit or where invoices are overdue beyond 60 days.
- Cause: ERP credit-block override is available to regional sales managers without finance workflow.
- Effect: Increased bad-debt exposure and possible revenue recognition before collectability is supportable.
- Recommendation: Restrict credit-block override to finance controller, require reason code, and produce monthly exception report to internal audit.
O2C audit data fields to request
The O2C audit file should let the reviewer trace each sale from customer approval to cash collection.
| Data table | Minimum fields |
|---|---|
| Customer master | Customer code, legal name, PAN/GSTIN, credit limit, credit terms, creator, approval date |
| Sales orders | SO number, customer, item/service, quantity, rate, discount, approver, approval date |
| Dispatch/service evidence | Delivery challan, e-way bill, dispatch date, service completion, transporter/customer acknowledgement |
| Sales register | Invoice number/date, customer GSTIN, taxable value, tax, HSN/SAC, IRN, GSTR-1 status |
| Receipts | Receipt date, bank account, customer allocation, invoice reference, unapplied amount |
| Credit notes | Credit-note date, invoice reference, reason code, approver, GST reporting period |
O2C internal audit FAQ
What is O2C in internal audit?
O2C, or order-to-cash, is the audit cycle covering customer onboarding, credit approval, order release, dispatch or service completion, invoicing, GST reporting, collections, credit notes and receivables ageing.
What is the biggest O2C audit risk?
The highest-risk areas are usually credit override, revenue cut-off and unsupported credit notes. These directly affect collectability, reported revenue and GST reporting.
How should internal audit test revenue cut-off?
Internal audit should compare invoice date, dispatch or service-completion evidence, e-way bill, sales-order approval and subsequent credit notes around the period end. The test should focus on exceptions, not only a random invoice sample.
Related CORAA resources
- Internal Audit Software for India
- Receivables Ageing Analyzer
- E-Invoice Applicability Checker
- Credit Note and ITC Time-Limit Checker
Sources
- ICAI Internal Audit Standards Board, Compendium of Standards on Internal Audit - as on February 2026 and listed by ICAI as applicable from 1 April 2026
- Companies Act, 2013, Section 138 and Section 143(3)(i)
- CBIC Tax Information Portal, CGST Act, 2017 - Section 31, Section 34 and return reporting provisions
- Ind AS 115 / AS 9 revenue recognition principles, as applicable