Prepare an AP Audit Sample

Direct answer

What this role should do

An AP audit sample is defensible when the population, period, selection method, and evidence package are fixed before anyone sees the results. Missing items stay visible, and the preparer does not replace them with a more convenient record.

Read the request before pulling data

Clarify the control being tested, the entity, the period, the population, and the evidence the auditor expects. Ask whether the sample is statistical or judgmental and whether the auditor will select the items or accept a company selection.

Write the request interpretation in the workpaper and confirm it with the auditor. A sample pulled from the wrong period or entity wastes days and can make a valid control look broken. The confirmation should be in writing, not a hallway understanding.

If the request is ambiguous, ask one consolidated question rather than starting the pull and correcting it later. The clarification and the answer belong in the workpaper. Record the auditor's name and the date of the request so the package has a clear owner and timeline.

Define the population and the period

Build the population from the system of record using a stated query and date range. Record the report name, run time, filters, row count, and control total. Include cancelled, reversed, and on-hold items unless the request explicitly excludes them.

Reconcile the row count to an independent control, such as the invoice register or the general ledger activity. If the population cannot be reconciled, document the gap before sampling. A sample from an unreconciled population cannot support a conclusion about the whole.

Save the query text and the parameters with the extract. A screenshot of the result is not enough to reproduce the population. If the population changes after the extract, take a new extract and keep both versions rather than editing the first.

Preserve the selection method

If the auditor selects the items, keep the selection file exactly as received. If the company selects, document the method, the random seed or starting point, and the person who ran it. Do not re-draw because the first sample produced an inconvenient item.

Record any stratification, such as high-value invoices or manual payments. A judgmental sample should state the judgment. The point is to make the selection reproducible, not to make it look statistical when it is not.

If a selected item is later found to be outside the population, keep it in the sample and document the reason. Removing it after selection changes the sample and should require the auditor's agreement.

Assemble the evidence package

For each item, collect the invoice image, PO, receipt or service evidence, approval, vendor master extract, payment record, and any exception note. Use the same evidence standard for every item so the sample is comparable.

Index the files by sample number and document type. A reviewer should be able to open one folder and see the complete trail without searching an inbox. Keep file names stable and avoid duplicates with slightly different labels.

Use a consistent naming convention and a file index that maps each sample number to its documents. Avoid scanning a document twice under two names, because duplicates confuse the evidence count. Redact unrelated supplier data only where the auditor agrees; otherwise keep the document intact so the evidence is not altered.

Handle missing items without substitution

If an item is missing, record what was requested, where it was searched, who was asked, and the date. Mark the item as missing or partially supported. Do not replace it with a similar invoice that has better evidence.

Escalate a missing item to the control owner with a specific request. If the evidence cannot be produced, say so in the package. The auditor needs to distinguish a control failure from a filing problem, and substitution destroys that distinction.

Tell the auditor early when an item cannot be produced. A late disclosure is harder to interpret than an early one, and the auditor may have an alternative procedure.

Keep preparer and reviewer separate

The person who assembles the package should not be the only person who confirms its completeness. Add a reviewer check for population reconciliation, sample completeness, and evidence quality. Record the reviewer and date.

If the same small team performs both roles, document the compensating check. Separation is a control, but a documented second look is better than an undocumented assumption that someone checked.

The reviewer should check a sample of the sample, not only the tracker. Open a few folders and confirm the document matches the item and the index.

Index the sample for review

Create a sample tracker with item number, invoice number, supplier, amount, date, evidence status, exception, owner, and reviewer note. Link each row to the folder or document identifier. Keep the tracker versioned.

Summarize the sample size, population size, selection method, and evidence status. Do not summarize the result as a pass rate unless the auditor defined what counts as a pass. The tracker should support the auditor's conclusion, not replace it.

Keep the tracker and the files in the same repository version so a reviewer is not reading a later list against earlier evidence. If the tracker changes after review, note the change and the reason.

Answer follow-up questions with evidence

When the auditor asks about an item, respond with the document and the explanation, not a narrative that cannot be traced. If the answer changes the package, add a note with the date and the source of the new information.

Keep a log of questions and responses. A repeated question may mean the index is unclear or the evidence is hard to find. Fix the package structure rather than answering the same question three times.

If a follow-up reveals a control gap, document the gap and the remediation owner. Do not rewrite the original evidence to make the sample look cleaner.

Close the sample with a control note

Close when every selected item has a status, the population reconciliation is attached, the reviewer has signed, and open questions have owners. The control note should state what was tested, what was found, and what remains unresolved.

Retain the package for the required period and restrict access to the people who need it. An audit sample contains supplier and payment data; it should not circulate as a general team file after the review ends.

State the evidence status for every item, including the ones that were fully supported. A package that lists only exceptions gives the reader no sense of coverage. Retain the final tracker with the reviewer sign-off and the auditor's follow-up log.

Continue with AP reporting and evidence support and the invoice intake and document control.

Check the audit sample package

The request, control, entity, and period are confirmed in writing
Population query, run time, row count, and control total are recorded
Selection method and any stratification are documented
Every item has a stable index and evidence set
Missing items are recorded, not substituted
A separate reviewer checks completeness
The tracker shows status, owner, and open questions

Common questions

Accounts payable virtual assistant FAQs

Can we replace a missing invoice with a similar one?

No. Record the missing item and the search performed. Substitution changes the sample and hides whether the control actually left evidence.

Who should select the sample?

Follow the auditor's instruction. If the company selects, document the method and the person who ran it so the selection can be reproduced.

What if the population does not reconcile?

Document the gap and resolve it before sampling, or disclose the limitation to the auditor. A sample from an unreconciled population has limited evidentiary value.

How should the package be stored?

In the approved audit repository with restricted access, a stable index, and retention aligned to the company's records schedule.

Factual checks

Sources

These sources support the tax-form, access-control, and phishing guidance in this article. The planning numbers above are labeled examples and do not come from these sources.

NARA: Records management policyRecords-management policy supporting an indexed, retained audit evidence package.
NIST SP 800-53 Rev. 5Control catalog context for audit logging, evidence retention, and separation of duties.
SBA: Stay legally compliantSmall-business compliance guidance used as general context for documented records.
EEOC: Recordkeeping requirementsRecordkeeping guidance used only for retention discipline, not as AP audit criteria.

International Labour Organization guidance on remote work arrangements reinforces why remote role briefs should document expectations, communication rhythms, and accountable handoffs.