The purchasing cycle has two main risks. One is understatement of liabilities and expenses (invoices not recorded). The other is misappropriation (payments to fictitious or inflated vendors). A walkthrough that follows one purchase from need to payment shows how the client addresses each. This post documents one, with the fraud points emphasized. The method is in internal control questionnaire and walkthroughs, and the revenue counterpart is in order-to-cash walkthrough. For the internal-audit view, a risk and control matrix with a test step per control, see the procure-to-pay RCM; this post covers the auditor's walkthrough record: the narrative, the interviews and the deviations from what management described.
The transaction
Pick a purchase of goods with a purchase order, a receiving report and an invoice, so the three-way match can be seen. Pick a second for a service without a receiving report, since services are where controls tend to be weaker, and a third for a manual or non-PO payment.
The example: a distributor purchasing inventory and operating supplies
| Step | Who | What happens | Control point | Evidence |
|---|---|---|---|---|
| 1. Vendor set-up | Purchasing manager and AP clerk | New vendor request with W-9, bank details and approval | Segregation: requester does not enter the vendor; independent review of the vendor master change report | Vendor form, W-9, change report |
| 2. Requisition | Department buyer | Requisition entered in the system | Budget check; approval by department head above a limit | Requisition record |
| 3. Purchase order | Purchasing | PO created from the approved requisition | PO approval levels by amount; PO numbers sequential | PO listing |
| 4. Receipt | Warehouse | Goods received against the PO; receiving report created | Receiver does not create POs; quantity counted | Receiving report |
| 5. Invoice receipt | AP clerk | Vendor invoice scanned and entered | Duplicate invoice check by vendor and number | Duplicate check report |
| 6. Three-way match | System | Invoice compared with PO and receiving report | System blocks payment on variance beyond tolerance; exceptions resolved by purchasing | Match exception report |
| 7. Coding and approval | AP clerk and approvers | Account coding, approval by the budget owner | Approval for non-PO invoices; coding review | Approval records |
| 8. Payment run | AP manager and treasurer | Payment batch prepared and approved; ACH file or checks | Dual approval above a threshold; bank details from the vendor master only | Approved batch, bank file |
| 9. Signing and release | Treasurer | Checks signed or ACH released | No check signing by the person who prepared the batch | Signed check register |
| 10. Recording | System | Disbursement posted to cash and AP | Daily posting; AP subledger reconciled to GL monthly | Reconciliation |
| 11. Bank reconciliation | Controller | Monthly reconciliation of the disbursement account | Performed by someone who does not approve payments | Reconciliation, sign-off |
| 12. Accruals | Controller | Month-end accrual of received-not-invoiced and unprocessed invoices | Review of the GRNI report and open POs | Accrual workpaper |
Fraud and error points to probe
Ask the questions that expose weak spots.
- Vendor master. Who can add or change a vendor? Who can change bank details? Is a call-back to a known number made to verify bank changes? Does anyone review the vendor change log?
- Duplicate payments. How are duplicate invoices detected? Does the system match on vendor, invoice number and amount?
- Non-PO payments. What share of spend bypasses the PO system, and who approves it?
- Split purchases. Are purchases split to stay under approval limits? Review for repeated amounts just below limits.
- Manual checks. Who can issue a manual check outside the run, and how are they approved?
- Receiving. Is every material receipt recorded the day it arrives? Are receiving reports used in the match?
- Related party and employee vendors. Is there any check of the vendor list against employee data?
- Accruals. How does the client capture goods received but not invoiced and services performed but not billed at month-end?
Deviations from the narrative found in the example
- Vendor bank detail changes are made by an AP clerk without independent review. A report exists but nobody looks at it. This is a misappropriation risk.
- Non-PO invoices account for about a fifth of expense lines by count, mostly services and utilities. The budget owner approves, but the approval is an email to the AP clerk, kept in the clerk's mailbox.
- The duplicate invoice check works only on exact invoice number. Variants such as "INV-1042" and "1042" pass.
- The accrual relies on the controller's memory of large items and does not use the GRNI report.
Each goes in the file with its risk, the assertion and the effect on the plan.
From walkthrough to tests
| Finding | Follow-up |
|---|---|
| Vendor master change control gap | Test changes to bank details for the year: all changes, with support. Data test of vendor bank accounts against employee data. See ghost employee testing for the matching approach |
| Duplicate check limited to exact match | Data test of payments for near-duplicates by vendor and amount |
| Non-PO approvals in email | Test approvals on a sample of non-PO invoices; request the emails |
| Three-way match control | Attribute test of a sample of payments. See attribute sampling |
| Dual approval of payment batches | Inspect approvals for a sample of runs |
| Accrual weakness | Extend the search for unrecorded liabilities and test receiving reports around year end |
| Bank reconciliation control | Inspect for the year and test by an independent recompute for selected months |
Link to the rest of the audit
The walkthrough supports the control risk assessment for accounts payable, expenses and cash. Weak controls over completeness lead to larger samples for unrecorded liabilities and accounts payable confirmations. The vendor and disbursement fraud risks lead to journal entry testing and the evaluation of management override. Findings that matter go to management and governance in the deficiency letter.
Documentation
Narrative or flowchart, the transactions traced with references, the people interviewed with dates, the control points with risk and assertion, the deviations from the description, and the conclusion on design and implementation. Update the walkthrough in each audit for key controls to confirm the process is unchanged.
CORAA prepares ready-to-review audit files for US CPA firms; the firm keeps the client, the review and the signature. See /us.
Sources
- AICPA, AU-C Section 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement; AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained
- AICPA, AU-C Section 240, Consideration of Fraud in a Financial Statement Audit
- U.S. Government Accountability Office, Financial Audit Manual, Volume 1 (GAO-26-108577), June 2026, sections 320 and 350 (walk-throughs to confirm the understanding of business processes, and the nature of control tests): gao.gov
Part of CORAA University · Working papers and documentation: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error