Internal audit process reviews for procure-to-pay, order-to-cash and payroll

The cycle is tested control by control. Each row below is a control the review looks for, the evidence it asks to see and the exception that usually turns up.

The full population goes through data tests first: duplicate amounts, round-dollar payments, payments just under an approval limit and vendors sharing a bank account or address with an employee. Samples are then drawn from what those tests and the risk assessment point to.

Order-to-cash controls protect revenue and the cash that follows it. The review tests that a customer is approved and credit-checked before a sale, that prices and discounts follow an authority table, that revenue is recorded in the right period, that credit memos and write-offs are approved by someone other than the person who issued the invoice, and that cash received is applied to the right invoice.

The tests lean on cutoff and exceptions. A sample of shipments and invoices straddling each period end shows whether revenue landed in the right month. A listing of credit memos by user and approver shows who can issue and who can approve. A comparison of the bank deposits to the cash application log shows how long cash sits unapplied. Cash application practices matter here because unapplied cash hides both errors and theft.

For nonprofits the same cycle covers pledges, grants receivable and restricted gifts, and the review checks that restrictions are recorded when the gift is recorded, not when the money is spent.

Payroll is a closed loop, which makes it easy to test and easy to neglect. The review traces a sample of employees from the HR record to the pay register to the bank, and compares the register to the tax deposits and filings. It tests that new hires and terminations are approved and dated correctly, that pay-rate changes carry authority, that hours are approved before they are paid, that off-cycle checks are logged and that nobody on the payroll file lacks a matching HR record.

The ACFE's 2024 study counted payroll schemes in 190 of 1,921 cases, a median loss of $50,000, and found that payroll, billing and expense reimbursement schemes typically ran 18 months before detection. A single review a year will not catch everything, but it shortens the window in which an unapproved rate change or a former employee still on the register goes unseen.

Payroll processors such as Gusto or ADP run the payroll and own its calculations. Finbryn reviews the controls around the file and the approvals, using exports, and does not touch the processor's settings.

A control gap is a place where something could go wrong. Fraud exposure is a place where someone has the access and the incentive to make it go wrong. The review reads both. The ACFE's 2024 report counted billing schemes in 424 of 1,921 cases (22%) with a median loss of $100,000. Check and payment tampering appeared in 217 cases (11%) with the highest median loss of the asset misappropriation schemes, $155,000. Expense reimbursement schemes appeared in 248 cases with a median loss of $50,000.

The AFP's 2025 survey adds the outside view: 79% of organizations faced attempted or actual payments fraud in 2024, business email compromise was the top route at 63% and vendor impersonation was cited by 45%. That is why the vendor bank-detail change process is tested before almost anything else.

When a test produces a pattern that looks like fraud, the review stops at the facts, tells the audit committee and recommends a specialist. It does not interview suspects or build a case. Forensic accounting support is where that work starts, and the committee decides whether to take it up.

Every finding has the same shape so the committee can compare them: the criteria (what should happen), the condition (what did happen), the cause, the effect, the recommendation, a management response with a named owner and a due date, and a rating on a scale the committee defined before the first review. Positive observations are listed too, because a report that only lists problems teaches management to argue with it.

The report goes to the process owner for a written response before it goes to the audit committee, and the committee receives the finding and the response together. Standard 15.2 of the Global Internal Audit Standards has the chief audit executive confirm that agreed actions were implemented, so the follow-up log stays open until each action closes, and the committee sees the log at each meeting.

The workpapers are yours. They carry the population, the sample, the evidence reference and the result for each item, and they are stored in your environment so a successor, a lender or your external auditor can read them.

Internal audit support here is planned and reported against the IIA Global Internal Audit Standards for management and the audit committee. Conformance is the chief audit executive's to demonstrate through the function's quality program. It is not an external audit, review, compilation or attestation, and Finbryn gives no opinion on financial statements or on internal control over financial reporting under AICPA or PCAOB standards.

It also does not conclude on a fraud allegation, test controls at a service organization such as a payroll processor, or replace the controls the company has to run itself. Sample-based testing can miss an exception that is not in the sample, and the report says what the sample was. If a lender requires an examination report on internal control, an independent public accounting firm issues it.