A P2P internal audit programme converts procure-to-pay risks into fieldwork procedures covering vendor onboarding, purchase approval, GRN or service acceptance, invoice booking, tax checks, payment release, vendor reconciliation and ERP access.
P2P is a high-leakage cycle because master data, procurement, stores, accounts payable, tax and banking controls meet in one flow. The audit programme must prove that the population is complete before testing invoices and payments.
Objective: Only valid, approved and independently verified vendors are active.
Vendor master, change log, KYC pack, approval workflow, related-party list.
New vendors and master changes during the period, plus high-value active vendors.
Objective: Purchases are approved before commitment and within delegated authority.
PR, budget file, RFQ, comparative, PO, approval matrix, exception log.
Risk-based PO sample, all high-value/emergency items.
Objective: Invoices are booked only for accepted goods or services.
GRN, service entry, invoice, quality note, match exception report.
Sample across goods, services, non-PO and period-end items.
Objective: Tax and payment controls operate before cash leaves the company.
Tax invoice, GSTR-2B/recon, TDS working, MSME ageing, payment file, UTR, BRS.
High-value tax-coded invoices, MSME suppliers and payment runs.
ICAI IASB lists the Compendium of Standards on Internal Audit as on February 2026 as applicable from 1 April 2026. Use this page as a practical workpaper starter, then verify the latest standard, law, regulation, ERP report and client fact pattern before concluding.
It should cover vendor master, purchase requisition, RFQ, PO, GRN or service entry, invoice booking, GST/TDS/MSME review, payments, vendor reconciliations and ERP access.
No. It is a fieldwork starter. The internal auditor must tailor it to the approved scope, ERP, delegation matrix, locations, volumes, materiality, prior findings and current legal position.
Yes. Use the linked CORAA workbook for the cycle. It contains editable RCM, testing, evidence and monitoring sheets that can be used as a fieldwork base.
