Procure to pay covers everything from a purchase requisition to the cash leaving the bank. It carries exposure to vendor fraud and duplicate or unauthorized payments. This post gives an RCM you can adapt, the test step for each control, and the analytics that replace sampling where data allows. For issuers, the legal anchor for authorization and recording controls is Section 13(b)(2)(B) of the Exchange Act, which requires reasonable assurance that transactions are executed in accordance with management's authorization and recorded so statements can be prepared under GAAP. See /us/blog/exchange-act-13b2-internal-accounting-controls-and-books-and-records.
The RCM
| ID | Risk | Control | Type | Assertion | Test step |
|---|---|---|---|---|---|
| P2P-01 | Payment to a fictitious or unapproved vendor | New vendor request approved by someone outside AP; W-9 and registration check before creation | Preventive, manual | Occurrence | Select new vendors in period; agree to approval, W-9 and registration evidence |
| P2P-02 | Vendor bank details changed fraudulently | Bank detail changes verified by callback to a known contact and approved by a second person; monthly change report reviewed | Preventive and detective | Occurrence | Obtain full change log; for each change inspect callback evidence and approver |
| P2P-03 | Purchase made without authority | Requisitions and purchase orders approved per delegation matrix, enforced by system | Preventive, automated | Occurrence | Compare PO approver to matrix for all POs above threshold; test system configuration |
| P2P-04 | Goods or services paid for but not received | Receipt recorded before invoice approval; three-way match (PO, receipt, invoice) with tolerance | Preventive, automated | Occurrence, accuracy | Test match configuration; reperform match for sample; analyze invoices paid with no receipt |
| P2P-05 | Duplicate payment | System duplicate check on vendor and invoice number; weekly review of exceptions | Preventive and detective | Accuracy | Full-population match on vendor, amount, date; inspect review evidence |
| P2P-06 | Unauthorized payment release | Payments released by two approvers in the bank portal; no single user can create and release | Preventive | Occurrence | Export portal approval log; compare to payment file; test user entitlements |
| P2P-07 | Liabilities not recorded in the right period | Month-end accrual review of receipts without invoices; subsequent disbursement review | Detective | Completeness, cutoff | Reperform accrual for sample; test disbursements after period end |
| P2P-08 | Segregation conflicts | Role conflict review quarterly | Detective | Occurrence | See /us/blog/segregation-of-duties-conflict-matrix-design-and-testing |
| P2P-09 | Required tax information missing | W-9 collected before first payment; year-end Form 1099 reporting reviewed | Preventive | Presentation | Compare vendor list to W-9 file; reperform 1099 eligibility for sample |
| P2P-10 | Manual overrides of match or approval | Override report reviewed monthly by controller | Detective | Occurrence | Obtain override report; sample items; check explanation and approval |
Analytics that replace samples
Data analytics can test an entire population instead of a sample. For P2P these run well on the full invoice and payment data:
- Duplicate payments. Match on vendor and amount with dates within a window, and on normalized invoice numbers. See /us/blog/audit-data-analytics-full-population-testing.
- Vendor to employee matches. Compare vendor bank account numbers, addresses and phone numbers to the employee master.
- Round-dollar and just-under-threshold payments. Payments clustered just under approval limits.
- Invoices paid without receipts. Paid invoices with no receiving record.
- Vendor master changes followed by payment. Bank change within days before a large payment.
- Weekend or off-hours approvals. Using timestamps from the approval log.
- Sequence gaps. Check numbers or payment batch gaps.
Worked example: Form 1099 control
Row P2P-09 reflects a tax reporting obligation as well as a control. The IRS Instructions for Forms 1099-MISC and 1099-NEC set the Form 1099-NEC reporting threshold for nonemployee compensation at $2,000 for payments made in 2026 (it was $600 for earlier years). Form 1099-NEC is due to the recipient and the IRS by January 31, and reportable payments are subject to backup withholding when the payee has not given a taxpayer identification number. A control that collects a W-9 before the first payment, flags vendors likely to be reportable by type, and reconciles year-end payments to the 1099 filing reduces the penalty and backup withholding exposure. For the thresholds in detail, see /us/blog/form-1099-thresholds-2026-obbba-nec-misc-1099-k.
Test: obtain all payments to unincorporated vendors for the year, filter to service-type spend at or above the threshold, and agree to the 1099 filing. Missing W-9s at the time of first payment are a design deficiency in P2P-09 even if the 1099s were eventually filed.
Result sample
A review of the matrix at a company with $90 million of disbursements concludes: P2P-01, P2P-03, P2P-04 and P2P-06 effective; P2P-02 effective with exceptions (callback evidence missing for 6 of 41 changes); P2P-05 not effective for invoice number variants (see the duplicate payment example in /us/blog/internal-audit-findings-criteria-condition-cause-and-effect-standard-14-3); P2P-10 not tested because no override report exists. Findings are rated high for P2P-05 and P2P-02, medium for the others, because Standard 14.3 Evaluation of Findings requires internal auditors to prioritize each finding by significance.
Linking to ICFR
For SEC registrants, the key P2P controls address risks of unrecorded liabilities, misappropriation and unauthorized payment. The SEC's interpretive guidance for management says management identifies financial reporting risks first and then the controls that address them, and that the extent of evidence depends on ICFR risk. See /us/blog/control-testing-evidence-by-risk-direct-tests-versus-ongoing-monitoring.
Mistakes to avoid
- Testing the three-way match on a sample without testing the system's tolerance setting.
- Accepting a review control without evidence of what was reviewed.
- Treating vendor master changes as an IT matter outside AP scope.
- Omitting 1099 controls from the P2P matrix.
CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.
Sources
- Securities Exchange Act of 1934, section 13(b)(2)(B), 15 U.S.C. 78m(b)(2)(B): https://www.law.cornell.edu/uscode/text/15/78m
- IRS, Instructions for Forms 1099-MISC and 1099-NEC (2026 payments): https://www.irs.gov/instructions/i1099mec
- SEC, Release No. 33-8810, Sections II.A.1 and II.A.2: https://www.sec.gov/rules/interp/2007/33-8810.pdf
- The IIA, Global Internal Audit Standards (2024), Standard 14.3 Evaluation of Findings: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/
Part of CORAA University · Internal controls and SOX: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error