Research · · Verified
What Share of Vendor Invoice Exceptions Lack an Approval Record?
An audit method for measuring invoice exceptions that were released without a named approval, with a coding scheme that separates a missing record from an inaccessible one.
On this page
Research question and decision supported
The question is what share of resolved vendor invoice exceptions have a record showing who approved the release or payment. The decision supported is whether the accounts payable control is strong enough to rely on during a payment run, an audit, or a vendor dispute. An invoice can be paid correctly and still lack the evidence that the exception was authorized. The method measures the record, not the quality of the underlying commercial decision.
State whether the audit covers all vendors or a defined group, and whether it includes partial payments and provisional releases. A control that works for routine invoices may fail for bank-detail changes or disputed amounts. Report the scope beside the approval rate so the result is not read as a universal compliance score. The decision should follow the scope that matters most to the finance owner.
Define the approval record
An approval record identifies the exception, the person who approved it, the authority they relied on, the evidence reviewed, and the time of the decision. For a missing purchase order, the approval may come from the budget owner. For a bank-detail change, it may require a second reviewer and a callback. Write the required record for each exception type rather than one generic signature. A note that says approved without the approver and evidence is not a record under this definition.
Include the difference between an approval and a resolution. An exception can be resolved because the vendor supplied the missing document, with no payment decision needed. The audit should not treat every resolved item as an approval case. Code the decision type first, then check whether the required record exists for that type.
Draw the sample of resolved exceptions
Select exceptions resolved in a defined period and include every payment run in scope. Stratify by cause, vendor, amount, and owner so a high-volume routine category does not hide a small high-risk group. Include items released with a partial payment and items that were closed without payment. Exclude items still open at the time of the audit, because their approval may not yet be due. Record the sample rule and the population count.
Check that the sample includes the roles that can approve releases. If one approver group is missing, the result cannot describe that group. Review the age distribution and include exceptions that were resolved quickly as well as slowly. A sample that covers only clean months will understate the problem. Keep the sampling frame with the working papers.
Build a four-part evidence test
For each approval case, check whether the record names an approver, shows the authority, links the evidence, and states the decision. Score each part separately rather than reducing the case to pass or fail. A record with an approver but no evidence is different from one with evidence but no named authority. The four parts show where the control breaks and give the team a specific repair. They also prevent one missing field from making an otherwise adequate record look worthless.
Have two reviewers score an overlapping sample and compare the results. Discuss any case where one reviewer accepts the approval and the other does not. The discussion clarifies the standard and exposes fields that are ambiguous. Keep the agreed examples with the audit template so the next review applies the same test.
Measure missing approval by cause
Report the share of approval cases missing each part, grouped by exception cause, vendor group, and amount band. Look for a cause that consistently lacks an approver, such as a manual adjustment or a verbal release. Check whether the workflow allows a free-text note to substitute for the required approval. Compare the missing-record rate with the number of exceptions so a high-volume category is not judged only on raw counts. Show the cases that fail more than one part.
A case that lacks both the approver and the evidence is a different risk from one that lacks only the authority reference. Report the combinations rather than a single percentage. Add a short note for the most common gap and the system where it occurs. Finance owners can act on a table with causes and counts more easily than a list of percentages without denominators.
Separate absence from inaccessibility
A record may exist but be unavailable because of permissions, retention, or a broken link. Test access with the same role a reviewer would use, not with an administrator account. If the approval sits in a system the auditor cannot open, record it as inaccessible rather than missing. If the source is a message in a channel that expires, note the retention period. The distinction changes the fix: an access problem needs a permission or retention change, while a missing record needs a process change.
Record the exact error or permission screen when access fails. Do not ask an administrator to retrieve the record for the audit, because that hides the access problem the reviewer would face. If the record is in a different system, note the system and its owner. The reviewer's experience is the relevant evidence for whether the control is usable.
Check whether approval predicts rework
Link the sampled items to later corrections, vendor disputes, or payment reversals where those records exist. Compare the rework rate for items with complete approval evidence and items with missing evidence. A higher rate among incomplete records would support the idea that approval is a real check rather than paperwork. A similar rate would suggest that the approval form is not capturing the risky cases. Read a few rework examples in both groups before drawing a conclusion.
Use the same rework definition and time window for both groups. If the data is not available, state that the check could not be performed. Do not infer a relationship from a few examples. The comparison is useful only when both measures come from the same cohort and the same period.
Use the result to fix one control
Pick the most common and most consequential gap and change one control. If the approver field is missing, make it required and route the release through the approval step. If the evidence link is missing, add a document picker rather than a free-text box. If the record is inaccessible, fix the permission or the retention rule. Train the team on one complete example and one incomplete example. Re-audit the same sample frame after the change.
Test the changed control on a small set of exceptions before rolling it out. Ask the team whether the field is clear and whether the evidence is easy to attach. Check that the change did not create a step people complete with a placeholder. A required field that accepts any text is not a control. Compare the new sample with the old one using the same four-part test.
Limitations
The method depends on approval records that are complete enough to code and on a population that can be defined. A vendor may approve an exception through a phone call that is legitimate but undocumented, which the audit will count as missing. Reviewers may disagree about whether a particular message constitutes authority. Small samples and mixed exception types make the rate unstable.
A missing approval record is not proof that the payment was wrong. It means the decision cannot be reconstructed from the available evidence. Use the result to improve the approval path and the record, not to assign blame from a single case. Report the sample, the definitions, and any system change so the next audit is comparable.
Sources
- U.S. Small Business Administration, Manage your business
- NIST Cybersecurity Framework 2.0
- U.S. Bureau of Labor Statistics, Occupational Employment and Wage Statistics
- Federal Trade Commission, Data Security
- U.S. Department of Labor, Employer Responsibilities
- NIST Privacy Framework
- U.S. Department of Labor, Recordkeeping
- NIST SP 800-53, Security and Privacy Controls
- Internal Revenue Service, Recordkeeping
- U.S. Small Business Administration, Manage your finances