Your internal audit team reviews payment controls quarterly. Your external auditors sign off on your financials. Your AP manager investigates exceptions. Yet duplicate payments persist in SAP, Oracle and JD Edwards environments across industries.
The reason is structural. Internal audit procedures test whether controls operate as documented. They do not test whether the underlying data contains payments made twice.
What Internal Audit Actually Tests
Internal auditors working on accounts payable typically examine:
- Segregation of duties in payment approval workflows
- Compliance with authorization matrices and spending limits
- Proper coding of expenses to general ledger accounts
- Adherence to documented payment procedures
- Functionality of preventive controls within the ERP
They select samples of transactions. They verify that invoices carry proper approvals. They confirm that three-way matching operated where required. They check that payments went to intended recipients.
This methodology answers: “Did we follow our own rules?” It does not answer: “Did we pay this invoice already under a different reference?”
Four System Gaps That Hide Duplicates
1. Vendor Master File Variations
A supplier exists in your vendor master under three variations: the full legal name, a shortened trade name, and an acquisition legacy name. Your ERP treats these as separate vendors. An invoice from the same company processed under two different vendor codes bypasses any duplicate-checking logic tied to vendor ID.
Internal audit verifies that each vendor record contains required information and follows setup protocols. Auditors do not normalize vendor names across the master file to identify hidden duplicates.
2. Invoice Entry Through Multiple Channels
Invoices arrive via EDI, email, supplier portal, and paper mail. Some route through a PO workflow. Others enter as non-PO invoices. Urgent invoices get keyed manually. This creates parallel processing paths inside SAP, Oracle or JD Edwards.
The same invoice entering through two channels—once via EDI against a blanket PO, once manually as a non-PO invoice—generates two payment documents with different reference numbers. Three-way matching operates on the PO invoice. The manual entry bypasses matching because no PO exists.
Internal audit confirms that each processing channel has appropriate controls. Finding that one invoice entered twice through different channels requires cross-channel data analysis that audit procedures do not include.
3. Partial Payments and Credit Memos
You pay an invoice in installments due to budget phasing or dispute resolution. Your system records multiple payment documents against one invoice number. Later invoices with similar amounts create ambiguity. A duplicate might appear to be another installment.
Credit memos offset previous payments. Replacement invoices follow rejected ones. Amended invoices correct earlier versions. These create legitimate scenarios where similar amounts, dates and vendor combinations recur.
Auditors reviewing a sampled transaction see the supporting documentation for that specific payment. They do not analyze every other payment to the same vendor across the past three years to identify patterns indicating duplicates hiding among legitimate split payments.
4. Decentralized Payment Operations
Your company operates shared service centers in three regions, each with payment authority. A multinational vendor invoices each regional entity separately. The same invoice, addressed to different legal entities within your group, gets paid by different service centers.
Each payment is technically to a different bill-to party. The ERP permits both payments. Only by analyzing invoice details—line items, amounts, dates, descriptions—across all entities do you see the duplication.
Internal audit scopes by entity or by process. Cross-entity duplicate detection requires consolidating payment data across the group and comparing it at a granular level, which happens outside the audit process.
Why External Auditors Don’t Close the Gap
External auditors test whether financial statements present a true view of your financial position. Duplicate payments do not distort your balance sheet. They flow through the income statement as operating expenses.
External audit samples aim to assess material misstatement risk, not payment efficiency. A duplicate payment is correctly recorded as an expense, properly approved within authority limits, and paid to a legitimate vendor. It meets the criteria external auditors test.
Recovering duplicate payments improves cash flow and operating margin. It does not change whether your financial statements comply with accounting standards.
Detection Requires Different Methodology
Finding duplicates requires analyzing every payment transaction—not a sample—and comparing each one against every other payment across multiple data fields: vendor name variants, invoice numbers, amounts, dates, payment terms, and descriptions.
This produces a large volume of potential matches. Most are false positives: similar amounts paid on similar dates to the same vendor for different invoices. Distinguishing actual duplicates from coincidental similarities requires examining the underlying invoice documents and applying judgment based on payment patterns.
Internal audit teams lack the capacity and mandate to perform this work. Their coverage spans financial reporting, compliance, operational risk and IT controls across the organization. Systematic duplicate payment detection for a multi-million dollar AP environment is a specialized, time-intensive exercise.
If you suspect duplicate payments exist in your ERP history and want them identified and recovered, the work requires dedicated data extraction, specialized analysis tools, and manual document review—none of which standard audit procedures deliver.
Frequently asked questions
Why do internal auditors miss duplicate payments in our ERP system?
Internal auditors typically review controls and sample transactions after payment, not every invoice before it’s paid. They test whether approval workflows function, not whether the system prevents paying the same invoice twice under different document numbers or vendor IDs. Duplicate detection requires cross-referencing multiple data fields across the entire payment history, which sits outside standard audit scope.
What percentage of duplicate payments does internal audit typically catch?
Internal audit teams working from samples and control testing catch a small fraction of duplicates. Their methodology focuses on whether processes operate as designed, not on systematically scanning every payment against every other payment for matching amounts, dates, and vendor details. Duplicates often exist in clusters that random sampling statistically misses.
Which ERP systems have the most duplicate payment problems?
SAP, Oracle and JD Edwards all permit duplicate payments when invoices enter through different channels, use slight vendor name variations, or get coded to different cost centers. The problem stems from how organisations configure and use these platforms, not from inherent system flaws. Payment factories and shared service centers processing high volumes create more duplicate risk.
How do duplicate payments get past three-way matching?
Three-way matching compares purchase order, goods receipt and invoice but doesn’t check whether you’ve already paid this vendor this amount on this date through a different PO number or invoice reference. Non-PO invoices bypass three-way matching entirely. Partial payments, credit memos and amended invoices create legitimate exceptions that duplicates hide within.
What’s the best way to find duplicate payments after they’ve been made?
Data analysis across your entire payment history, matching on vendor name variants, amounts, dates, invoice numbers and payment terms simultaneously. This requires extraction and normalization of payment data, then applying pattern recognition that accounts for how duplicates actually occur—not just identical invoice numbers. Most companies lack the tools and methodology to do this internally.
Should I rely on our external auditors to find duplicate payments?
External auditors test financial statement accuracy and controls, not payment efficiency. They sample transactions to assess risk and verify balances. Finding duplicate payments requires analyzing 100% of payment records across multiple dimensions, which falls outside the scope of a financial statement audit. External auditors may note control weaknesses but won’t systematically hunt duplicates.
