Audit library / 04 Duplicate payments and vendor master
Duplicate Payments and Vendor Master Audit Kit
A complete, ready-to-use audit plan for vendor master data integrity, duplicate and fictitious payments. 19 procedures in 6 phases, each showing what to do, the assertion, the risk and the evidence to obtain.
- Step-by-step guide on how to use the plan
- 19 audit procedures, from planning to sign-off
- Covers vendor master integrity, duplicate payment testing, recovery and root cause and fraud red flags
- Status and result dropdowns with an automatic progress tracker
- Fillable PDF version you can complete on screen
- Full English and Arabic versions (4 files)
Preview the checklist
Here are the first procedures from the kit. Buy the kit to unlock everything.
| Ref | Procedure | Assertion | Status | Result |
|---|---|---|---|---|
| A. Data and planning | ||||
| A1 | Obtain the full vendor master file and full payment history for the period (and preferably the prior 2 years) as system exports.Risk: Testing performed on incomplete data. | Completeness | Not started ▾ | |
| A2 | Reconcile the exported payment totals to the general ledger and bank statements to confirm completeness of the data.Risk: Analysis misses payments outside the export. | Completeness | Not started ▾ | |
| B. Vendor master integrity | ||||
| B1 | Review who can create and amend vendors, and check segregation from invoice processing and payment approval.Risk: One person can create a vendor and pay it. | Controls | Not started ▾ | |
| B2 | Identify duplicate vendors: same or similar names, tax registration (VAT) numbers, bank accounts, addresses or phone numbers.Risk: Duplicate vendors used to process duplicate or fictitious payments. | Fraud | Not started ▾ | |
| B3 | Test a sample of new vendors created in the period for supporting documents: commercial registration, VAT certificate, bank letter and approval.Risk: Fictitious vendors added without verification. | Existence | Not started ▾ | |
| B4 | Review all bank account changes on vendor records. Check each was requested in writing, verified by call-back to a known contact and approved.Risk: Payments diverted to fraudsters through fake change requests. | Fraud | Not started ▾ | |
| B5 | Identify dormant vendors (no activity for 12 months or more) that received payments, and vendors with incomplete master data.Risk: Dormant accounts reactivated to route fraudulent payments. | Fraud | Not started ▾ | |
12 more procedures are inside the full kit
Plus the step-by-step guide, dropdowns, progress tracker and the fillable PDF.
Add to basket