Description

This curriculum spans the full lifecycle of procurement auditing, equivalent in depth to a multi-phase internal audit program, covering risk assessment, policy compliance, forensic techniques, and continuous monitoring across direct and indirect spend domains.

Module 1: Defining the Scope and Authority of Procurement Audits

Determine whether the audit will cover direct procurement, indirect spend, or both, based on organizational spend concentration and risk exposure.
Establish reporting lines for audit findings—whether to internal audit, compliance, or directly to the procurement leadership team.
Negotiate access rights to procurement systems, supplier contracts, and requisition data with legal and IT departments.
Define thresholds for materiality (e.g., transactions over $50,000 or recurring vendor relationships) to prioritize audit focus.
Assess whether audits will be reactive (post-incident) or proactive (scheduled cycle), balancing resource constraints with risk mitigation.
Clarify if the audit function has authority to halt procurement activities pending investigation.
Document exceptions where business-critical purchases (e.g., emergency repairs) may fall outside standard audit protocols.
Align audit scope with regulatory mandates such as SOX, FCPA, or public sector procurement laws.

Module 2: Risk Assessment and Audit Planning

Map supplier concentration risks by identifying vendors representing more than 10% of total procurement spend.
Identify departments with historically weak purchase order compliance and prioritize them for audit cycles.
Use spend analytics to detect anomalies such as frequent sole-source justifications or repeated split purchases.
Integrate fraud risk indicators (e.g., employee-supplier affiliations) into the audit planning model.
Develop risk scoring models that weigh factors like contract value, supplier tenure, and payment terms.
Coordinate with finance to identify unrecorded liabilities or off-contract spending through AP data analysis.
Plan surprise audits for high-risk categories such as consulting or temporary labor.
Allocate audit resources based on the complexity of procurement methods (e.g., RFPs vs. spot buys).

Module 3: Evaluating Procurement Policy Compliance

Verify whether purchase requisitions consistently include required approvals based on delegation of authority matrices.
Check if competitive bidding requirements are met for contracts exceeding policy-defined thresholds.
Review exceptions logs to determine if policy waivers are properly justified and escalated.
Assess adherence to preferred supplier programs and evaluate business justification for deviations.
Validate that non-PO invoices are reviewed and approved according to policy before payment.
Examine whether emergency procurement procedures are being misused to bypass standard controls.
Test consistency in contract template usage and identify unauthorized modifications by business units.
Review segregation of duties between requisition, approval, receipt, and payment roles in high-volume categories.

Module 4: Supplier Due Diligence and Onboarding Verification

Audit supplier registration files to confirm valid tax IDs, banking details, and anti-bribery certifications.
Trace new vendor setups to supporting due diligence documentation, including background checks and financial health assessments.
Identify duplicate supplier records across ERP instances that may indicate circumvention or fraud.
Validate that politically exposed persons (PEPs) or high-risk jurisdictions trigger enhanced due diligence.
Assess whether suppliers are classified correctly (e.g., local, minority-owned, international) for reporting and compliance.
Review vendor master data change logs for unauthorized modifications to payment terms or bank accounts.
Confirm that supplier risk assessments are updated periodically, especially for long-term contracts.
Test whether terminated suppliers are deactivated in the system to prevent re-engagement.

Module 5: Contract Management and Performance Auditing

Sample executed contracts to verify that key terms (pricing, SLAs, termination clauses) match approved versions.
Check if contract renewals are subject to re-bidding or performance review as per policy.
Validate that contract milestones and deliverables are tracked and formally accepted by stakeholders.
Audit pricing compliance by comparing invoiced rates to contracted rates, including volume discounts.
Assess whether contract variations or change orders follow formal approval workflows.
Review contract repositories to ensure all agreements are centrally stored and accessible for audit.
Identify contracts missing key clauses such as audit rights, data privacy, or anti-corruption provisions.
Measure actual supplier performance against KPIs and determine if penalties or incentives were applied.

Module 6: Purchase-to-Pay Process Controls Testing

Trace a sample of purchase orders from requisition to goods receipt and three-way match in the ERP system.
Identify instances where goods were received but no PO was issued, indicating process bypass.
Test whether automated workflows enforce required approvals based on dollar thresholds and commodity type.
Review user access rights in the procurement system to detect inappropriate segregation of duties.
Validate that non-PO invoices are matched to valid receiving documents or service entry sheets.
Check for duplicate payments by analyzing invoice numbers, amounts, and supplier bank details.
Audit catalog compliance rates and investigate business units with high non-catalog spend.
Assess whether automated controls flag split purchases intended to stay under approval thresholds.

Module 7: Data Integrity and System Audit Trails

Extract and validate audit logs from the ERP system to confirm immutability of procurement transactions.
Test whether system configurations prevent backdating of purchase orders or invoices.
Verify that user role assignments in procurement software follow least-privilege principles.
Review data reconciliation between procurement, inventory, and general ledger systems for discrepancies.
Assess the reliability of spend categorization codes and their consistency across business units.
Identify manual journal entries in the GL that offset procurement variances without explanation.
Validate that system-generated reports used for decision-making are based on accurate, real-time data.
Check if data retention policies preserve procurement records for the legally required period.

Module 8: Fraud Detection and Forensic Investigation Techniques

Use Benford’s Law analysis on invoice amounts to detect unnatural number patterns suggesting manipulation.
Identify shell vendor schemes by analyzing supplier addresses, bank accounts, and contact information overlaps with employees.
Correlate employee expense reports with procurement data to detect disguised personal purchases.
Investigate round-dollar invoices or invoices just below approval thresholds as potential red flags.
Trace vendor payments to personal bank accounts or third-party intermediaries.
Review after-hours system access logs for procurement data modifications by unauthorized users.
Conduct interviews with receiving staff to verify whether goods were actually delivered as invoiced.
Use network analysis to map relationships between suppliers, employees, and approvers for conflict of interest.

Module 9: Reporting Audit Findings and Driving Remediation

Structure audit reports to include root cause analysis, not just observed control failures.
Assign risk ratings to findings using a consistent methodology accepted by internal audit and compliance.
Define clear remediation timelines and assign ownership to specific managers or departments.
Track open findings in a centralized issue register with escalation paths for overdue actions.
Validate remediation by retesting controls or reviewing updated documentation, not relying on assertions.
Present findings to executive leadership with comparative benchmarks (e.g., peer performance, prior audits).
Recommend process redesigns where controls are repeatedly bypassed due to operational inefficiency.
Document management responses to each finding, including acceptances of risk and compensating controls.

Module 10: Continuous Monitoring and Audit Function Maturity

Implement automated alerts for high-risk procurement events such as single-source justifications or override usage.
Develop dashboards that track audit metrics like policy compliance rates, exception volumes, and closure times.
Integrate procurement audit insights into enterprise risk management (ERM) reporting cycles.
Conduct periodic maturity assessments of the procurement audit function using a capability model.
Rotate audit staff across categories to reduce familiarity bias and increase detection capability.
Benchmark audit practices against industry standards such as IIA, ISACA, or procurement associations.
Use robotic process automation (RPA) to continuously validate three-way match compliance in real time.
Review audit methodology annually to incorporate changes in procurement technology and fraud tactics.