Internal Audit Teams
How do internal audit teams review invoice compliance controls?
Internal audits of invoice compliance review the design and operating effectiveness of controls covering invoice format, VAT accuracy, transmission channel, archiving, and audit trail. Audit procedures include sampling invoices for compliance attributes, testing VAT number validation processes, reviewing archive retrieval procedures, and assessing governance and monitoring controls. Findings are rated by compliance risk and reported to the audit committee.
What procedures do internal auditors use for invoice compliance reviews?
Invoice compliance internal audit procedures:
- Invoice sampling: Random or risk-based sample of issued and received invoices tested against compliance criteria
- VAT accuracy testing: Verify VAT rates on sample invoices; recalculate VAT amounts to confirm arithmetic
- VAT number validation: Re-run VIES checks on supplier VAT numbers from sample to confirm validation was done
- Transmission testing: Confirm sample invoices were transmitted via the required channel (Peppol, PDP, etc.)
- Archive testing: Confirm sample invoices are retrievable from archive with original file integrity intact
- Audit trail review: Confirm every sample invoice has a complete lifecycle audit trail
- Governance review: Assess compliance policy, oversight, and change management processes
Frequently Asked Questions
- What sample size is appropriate for an invoice compliance audit?
- Sample size for invoice compliance auditing depends on the total invoice population and the desired confidence level. Statistical sampling tables (e.g., from AICPA or IIA guidance) provide minimum sample sizes for given confidence levels and tolerable error rates. For populations above 10,000 invoices, a sample of 60-150 invoices typically provides 95 percent confidence that the compliance rate is above 97 percent. Higher risk areas (new jurisdictions, recent system changes) warrant larger samples.
- How should findings from an invoice compliance audit be prioritized?
- Invoice compliance audit findings should be prioritized by compliance risk: findings that could result in VAT assessment or regulatory penalty are high priority regardless of frequency; systemic issues affecting large invoice volumes are high priority; isolated errors in low-risk areas are lower priority. A risk matrix combining likelihood (frequency of error) and impact (financial exposure per error) guides prioritization. High-priority findings require immediate management action; medium-priority findings are included in the next remediation cycle.