Financial auditing guidance for procurement control testing

What “good” looks like before you open the extract

Procurement control testing fails quietly when teams jump to samples without naming the assertions and control activities in play. Completeness of the vendor population, accuracy of invoice amounts, and cutoff around goods receipt each demand different evidence shapes. App Networking’s approach starts with a one-page control universe — not a binder of screenshots.

Control objectives across the P2P cycle

• Authorization — requisitions and purchase orders align with delegated thresholds and documented exceptions.
• Vendor integrity — master data changes, especially bank details, follow dual control and leave an auditable trail.
• Matching — price, quantity, and receiving evidence reconcile before payment release.
• Payment release — maker-checker roles are real in the bank file process, not only on paper.
• Segregation of duties — conflicting access is identified, explained, and residual risk accepted consciously.

Failure modes we see repeatedly in Korea-based engagements

After-the-fact approvals clustered around month-end. Receiving dates that float to protect inventory metrics. Duplicate invoices that survive OCR because suppliers rotate reference formats. Vendor bank changes approved by the same operator who maintains the master. None of these are exotic — they become findings when documentation stops at “control operated” without showing how the exception was cleared.

How our programs map to each stage

The Procurement Control Audit Intensive covers the full cycle across twelve modules, ending in a peer challenge lab. Sampling Design Studio isolates population and selection choices. Finding Narrative Clinic focuses on writing that managers can schedule. Use this guide as orientation; use the courses for rehearsal.