How auditors test expenditures, payables, payroll, and related fraud risks through substantive procedures.
Purchases, expenditures, and payroll testing focuses on whether expenses and related liabilities are complete, valid, accurate, and recorded in the proper period. Unlike revenue, where overstatement is often the dominant risk, purchases and payables frequently raise completeness concerns: goods may have been received or services performed before year-end, but the liability may not be recorded.
Payroll has a different risk profile. The auditor considers whether recorded payroll was paid to real employees, calculated at authorized rates, classified properly, and accrued for work performed before period-end.
flowchart LR
A["Requisition"] --> B["Purchase order"]
B --> C["Receiving report"]
C --> D["Vendor invoice"]
D --> E["Accounts payable"]
E --> F["Payment"]
F --> G["General ledger"]
The audit response depends on whether the risk is understatement, overstatement, cutoff, or classification.
| Assertion | Risk | Common substantive response |
|---|---|---|
| Completeness | Payables or accrued expenses are omitted | Search subsequent disbursements, inspect unmatched receiving reports, and review vendor statements |
| Occurrence | Recorded purchases did not happen | Vouch recorded purchases to purchase orders, receiving reports, and vendor invoices |
| Accuracy | Quantity, price, tax, freight, or discount is wrong | Recalculate invoice extensions and agree terms to purchase orders or contracts |
| Cutoff | Goods received before year-end are recorded after year-end, or vice versa | Compare receiving dates, invoice dates, and recording dates around period-end |
| Classification | Expenses are recorded in the wrong account or capitalized incorrectly | Inspect invoices and evaluate account coding |
| Rights and obligations | Liability does not belong to the entity | Inspect vendor contracts, invoices, and receiving evidence |
The strongest answer often depends on direction of testing. To test completeness, the auditor starts outside the recorded payables population. To test occurrence, the auditor starts with recorded transactions and vouches to support.
The search for unrecorded liabilities is a core payables procedure. It addresses the risk that liabilities existing at year-end were not recorded.
Common procedures include:
For example, if a payment made on January 12 relates to goods received on December 28, the auditor evaluates whether a payable should have been accrued at December 31.
The purchase-to-pay cycle often uses a three-way match among purchase order, receiving report, and vendor invoice. Substantive testing may reperform that match to determine whether the recorded purchase and payable are valid, accurate, and properly authorized.
| Document | What it supports |
|---|---|
| Purchase order | Authorization, approved terms, quantity, and price |
| Receiving report | Evidence that goods were received and when |
| Vendor invoice | Amount billed, vendor identity, tax, freight, and payment terms |
| Check or electronic payment record | Evidence of payment and timing |
Fraud risks include duplicate invoices, fictitious vendors, unauthorized vendor-master changes, and payments for goods not received. The auditor may scan for duplicate invoice numbers, round-dollar payments, new vendors with employee addresses, or bank account changes near payment dates.
Payroll testing addresses whether payroll expense and liabilities are valid, complete, accurate, and properly classified. The auditor connects payroll records to HR authorization, timekeeping, payroll registers, bank disbursements, and tax filings.
| Payroll risk | Substantive response |
|---|---|
| Ghost employees | Compare payroll register to HR personnel files, active employee listings, and termination records |
| Unauthorized pay rates | Agree pay rates and salary changes to approved HR documentation |
| Inaccurate hours or overtime | Recalculate pay using approved time records and overtime rules |
| Misclassified costs | Inspect job roles, cost-center coding, and capitalization of labor |
| Unrecorded payroll liabilities | Review accrued wages, bonuses, payroll taxes, benefits, and vacation obligations |
| Improper deductions or withholdings | Reconcile payroll registers to tax filings and benefit remittances |
Payroll analytics are useful when tied to expectations. Examples include payroll cost per employee, overtime by department, headcount changes, payroll expense as a percentage of revenue, and comparisons of gross payroll to payroll tax filings.
Cutoff is important because receiving goods, receiving invoices, recording payables, and issuing payments can occur on different dates. The auditor should determine when the obligation arose, not merely when the vendor invoice arrived.
Classification matters when expenditures may be capitalized instead of expensed, recorded in the wrong department, or classified as payroll, contractor, benefits, or bonus costs incorrectly. Misclassification may affect ratios, covenant calculations, tax accounts, and disclosures.
Do not use vouching when the objective is completeness of payables. Vouching recorded payables to invoices tests validity or occurrence; completeness usually requires searching subsequent disbursements or tracing receiving reports to recorded liabilities.
Do not assume payment after year-end means the expense belongs after year-end. The relevant question is when the goods were received or services were performed.
Do not treat payroll analytics as sufficient when fraud risk is specific. A ghost-employee concern requires employee existence and authorization testing.
Do not ignore vendor-master-file changes. Unauthorized changes can create fraudulent payments even when invoice matching appears normal.