Most AP audits look backwards to satisfy external stakeholders — auditors, regulators, tax authorities. They confirm you followed policy. They spot a few red-flag outliers. Then they close the file.
What they almost never do is find the money you already paid and should not have.
Audits answer the wrong question
A typical financial audit asks whether your controls are working. Did someone approve the invoice? Does it tie back to a purchase order? Did you apply the right tax treatment?
That is not the same as asking whether you paid the correct amount, once, to the right vendor.
Duplicate invoices can sail through with full approval if the duplicate reference number was keyed differently or if one copy arrived by email and another by EDI. Pricing errors pass when the PO itself was wrong. Missed credits sit unnoticed if the vendor issued them months after the original invoice closed.
The audit finds nothing wrong because, procedurally, nothing was wrong. The controls worked. You still overpaid.
Why auditors do not chase recoveries
External auditors are not paid to recover cash. Their scope is defined by accounting standards and materiality thresholds. A duplicate payment worth a few thousand dollars does not move the needle on a balance sheet carrying hundreds of millions in assets.
Internal audit teams have limited time and a long list of compliance priorities. Chasing individual overpayments across thousands of vendors and years of history is labor-intensive work with uncertain return. Most finance teams lack the dedicated headcount to do it systematically.
Even when an audit does flag an overpayment, there is rarely a mechanism to pursue it. Who calls the vendor? Who tracks the refund? Who confirms it was applied correctly in the ERP?
The data problem
AP recovery is a data-mining problem, not a controls-testing problem. You need to compare invoice line items across time, match payments to credits, reconcile contract pricing against actual charges, and cross-reference vendor remittances with posted transactions.
That requires line-level detail from your ERP — often spanning five to ten years — normalized across system upgrades, chart-of-account changes, and vendor master cleanups. Most audit tools are not built for that kind of longitudinal analysis.
What recovery-focused analysis looks like
AP recovery starts with a full transaction history export. Every invoice, payment, credit memo, and debit memo. The analysis compares each record against every related record to find patterns auditors do not look for.
Duplicate detection goes beyond matching invoice numbers. It compares amounts, dates, vendor IDs, and line-item descriptions to catch invoices submitted twice with slight variations. It flags payments made before a credit was applied, even if the credit exists in the system.
Pricing validation checks whether the amount paid matches the contract rate, even when both the PO and the invoice were wrong. It identifies short-ships where you paid for a full order but received partial delivery and never claimed the difference.
Credit reconciliation matches every vendor credit memo against subsequent payments to confirm it was actually deducted. Unclaimed credits often sit in the system marked as applied but never netted against an invoice.
The vendor conversation
Finding the overpayment is half the work. Recovering it requires documentation the vendor will accept and a process to track the refund through their AP system and yours.
That means producing a line-by-line reconciliation, referencing original invoice numbers and payment dates, and often working through the vendor’s own records to confirm the error. It is not a finance-department skill set. It is a recovery operations skill set.
Contingency models remove the risk
A traditional audit is a fixed cost. You pay whether or not it finds anything worth recovering. That works when the goal is compliance. It does not work when the goal is cash.
A contingency-based recovery model flips the economics. The service provider earns a percentage of what they actually recover. If they find nothing, you pay nothing. If they find millions, you keep the majority and they take a share of the result.
That aligns incentives. The provider is motivated to dig deeper, pursue smaller claims, and stay engaged through the entire refund cycle. You avoid upfront cost and get a team with the tools and relationships to close recoveries, not just flag them.
For finance leaders who have watched audit findings sit unactioned in a spreadsheet, that operational follow-through is often worth more than the analysis itself.
If your AP spend exceeds fifty million annually and you have not run a dedicated recovery analysis in the past three years, the likelihood of unclaimed overpayments sitting in your transaction history is high. A contingency engagement lets you find out at no upfront cost and keeps your internal team focused on current-period controls instead of historical cleanup.
Frequently asked questions
What types of overpayments do AP audits typically miss?
AP audits typically miss duplicate invoices with slight variations in reference numbers or submission channels, pricing errors that passed PO approval, credits issued after invoice closure, and short-shipments where partial deliveries were paid in full. These errors comply with procedural controls but still represent incorrect payments that require line-level transaction analysis to detect.
Why don’t internal audit teams focus on accounts payable recovery?
Internal audit teams prioritize compliance and control testing over cash recovery because overpayment pursuit is time-intensive, requires specialized data analysis across years of transactions, and often falls below materiality thresholds that define audit scope. Most finance departments lack dedicated headcount for systematic recovery work and have no defined process for vendor negotiation and refund tracking.
How far back should an AP recovery analysis look?
AP recovery analysis typically examines five to ten years of transaction history, limited by ERP data retention policies and the practical ability to normalize records across system upgrades and chart-of-account changes. Older data may exist but often requires significant cleanup. Statute-of-limitations considerations vary by jurisdiction but most commercial overpayment claims remain viable for several years.
What does a contingency-based AP recovery model cost?
A contingency-based AP recovery model charges a percentage of actual refunds collected, with no upfront fees or costs if nothing is recovered. The provider absorbs the analysis, vendor negotiation, and tracking work. You pay only from successfully returned cash, keeping the majority while the recovery firm takes a share of the result as their fee.
Can AP recovery work alongside an existing audit program?
AP recovery runs independently of standard audit programs and addresses a different objective—cash recovery rather than control validation. It uses transactional data from your ERP but does not interfere with audit scope or compliance reporting. Many organizations run recovery analyses between scheduled audits to capture overpayments that procedural reviews are not designed to find.
How long does an accounts payable recovery engagement take?
A full AP recovery engagement typically spans three to six months from data extraction through final refund collection. Initial analysis takes several weeks depending on transaction volume and ERP complexity. Vendor outreach, documentation review, and refund negotiation add time. Actual payment receipt depends on each vendor’s processing cycle, which the recovery provider tracks through completion.
