Accounts Payable Recovery Audit: Finding Duplicate Payments

An accounts payable recovery audit is a look-back review of supplier payments you have already made, to find money you are owed: duplicate payments, credit notes you never used, prices above the contract rate, missed discounts and payments to the wrong vendor. Unlike a financial statement audit, its goal is not an opinion on your accounts but cash returned to your bank account.

Recovery audits are often run by specialist firms paid a percentage of what they recover, and some public bodies require them. A Virginia state report, for example, records a statewide recovery audit programme run under the Code of Virginia in which duplicate payments made up most of the recoveries. You can also run the core tests yourself with an export of your payables data. This guide explains what to look for, how to test for it, a worked example, and how to stop the same leaks recurring.

What a recovery audit looks for

• Duplicate payments. The same invoice paid twice, often because it was entered once from the emailed PDF and again from a posted copy or a reminder.
• Unapplied credits. Credit notes issued by a supplier for returns, short deliveries or rebates that were recorded but never deducted from a later payment, or never recorded at all.
• Pricing errors. Unit prices on invoices higher than those agreed in the contract or price list.
• Missed discounts. Early-payment or volume discounts you were entitled to but did not take or did not receive.
• Tax errors. Sales tax, VAT or GST charged incorrectly, or input tax you were entitled to reclaim but did not.
• Freight and surcharges. Delivery charges or fuel surcharges billed in breach of the agreed terms.
• Vendor debit balances. Suppliers who owe you money on your own ledger because you overpaid, but nobody asked for it back.

How to test for duplicate payments yourself

Exact duplicates are easy to catch at entry. The ones that get paid are near-duplicates, where something small differs. A good AP audit runs several tests, from strict to loose, over at least 12 to 24 months of paid invoices.

1. Export the data. You need, per payment line: vendor ID and name, invoice number, invoice date, amount, payment date and payment reference. Include voided and reversed items, flagged as such.
2. Normalise invoice numbers. Strip spaces, hyphens, slashes, leading zeros and prefixes such as INV, so that INV-01043, 1043 and INV1043 all become 1043.
3. Test 1: same vendor, same normalised invoice number. The strongest signal.
4. Test 2: same vendor, same amount, invoice dates within a short window. Catches invoices re-entered with a typo in the number.
5. Test 3: same invoice number and amount, different vendor ID. Catches a supplier that exists twice in your vendor list, for example once under its trading name and once under its legal name.
6. Test 4: same amount, same vendor, digits transposed or one character different in the invoice number. Catches OCR and keying errors.
7. Review every hit against the documents. Many hits will be legitimate, such as monthly rent of the same amount. Only claim items you can prove.

Reconcile supplier statements

The second major test is reconciling each significant supplier's statement to your ledger. Ask suppliers for a full statement of account, including paid items and credits, for the review period. Differences reveal credit notes you never received, payments the supplier applied to the wrong invoice, and unallocated cash sitting on their side as an overpayment. Suppliers can usually see overpayments on their own ledger far more easily than you can.

Worked example: an 18-month review at a hotel group

A group of three boutique hotels in Cape Town decides to run its own recovery audit over the previous 18 months before changing accounting systems. The finance controller exports 14,200 paid bill lines.

Step 1: duplicate tests. After normalising invoice numbers, the four tests return 41 pairs. Most are legitimate: recurring service contracts whose invoice numbers collapsed to the same value once prefixes were removed, and monthly charges of the same amount. After checking documents, three real duplicates remain.

• A linen hire invoice paid twice, once from the PDF and once from the paper copy: $4,860.00
• A maintenance contractor invoice entered as 7731 and later as 7713, both paid: $1,212.50
• A furniture supplier set up twice under two names, with the same invoice paid to each record: $9,400.00

Step 2: statement reconciliation. The controller requests statements from the 25 largest suppliers. The food distributor's statement shows a credit note for a returned delivery of $2,750.00 that was never entered in the hotel group's books and never deducted.

Step 3: contract pricing. The cleaning products contract fixes the price of one item, but 600 units were invoiced at $0.35 above the contract price: 600 × $0.35 = $210.00.

Step 4: add it up.

• Duplicates: $4,860.00 + $1,212.50 + $9,400.00 = $15,472.50
• Unused credit note: $2,750.00
• Pricing overcharge: $210.00
• Total recoverable: $18,432.50

Step 5: recover it. The controller writes to each supplier with copies of the paid invoices, the remittance advice and the bank references, and asks for either a refund or a credit against the next invoice. The linen and food suppliers credit the next bill immediately. The furniture supplier refunds after confirming the double payment on its own records. The pricing claim takes two emails and a copy of the contract.

Had the group used an external firm on a contingency basis at, say, 20%, the fee on $18,432.50 would have been $3,686.50. Running it in-house cost staff time instead. Either way, the more valuable result was the list of causes: a duplicate vendor record, a paper-and-PDF double intake, and no supplier statement reconciliation.

Common mistakes in AP recovery audits

• Claiming without proof. A spreadsheet hit is not evidence. Send the supplier the two invoices, both remittances and both bank references.
• Waiting too long. Suppliers close periods, staff move on and records are archived. Legal time limits for reclaiming overpayments vary by country and contract, so act while the trail is fresh.
• Damaging good relationships. Most errors are honest and many are yours. Approach suppliers as a reconciliation exercise, not an accusation.
• Forgetting the accounting. Record the recovery properly: reverse the duplicate expense against the supplier balance, and record any tax adjustment, so the recovery does not distort your profit or your tax returns.
• Fixing the money, not the cause. A recovery audit is retrospective. If the vendor list still has duplicates and paper invoices are still entered alongside PDFs, the same leaks continue.

Preventing the next round of duplicate payments

• Choose one intake channel for supplier invoices and ask suppliers to stop posting paper copies.
• Merge duplicate vendor records and restrict who can create new ones.
• Check vendor, invoice number and amount before every bill is entered.
• Match bills for goods to the purchase order and the goods received note before approval.
• Reconcile major supplier statements every month, not once every two years.
• Review vendors with debit balances at each month end and ask for refunds.

hellobooks< / a > -helps-with-ap-audits-and-prevention">How HelloBooks helps with AP audits and prevention

HelloBooks keeps each bill linked to its original document, its approver and its payment, and the audit trail shows who entered, changed and approved it. That is the evidence trail a recovery claim needs. You can export bills and payments to CSV to run the duplicate tests above, and use vendor statements and AP aging to spot debit balances and old unmatched items.

For prevention, bills go through approval workflows, and for goods HelloBooks performs 3-way matching against the purchase order and goods receipt note, sending variances to an approver. AI document extraction reads supplier invoices into draft bills from a single upload, which helps you move to one intake channel. A person still reviews every draft and decides what is paid.