Supplier Statement Reconciliation as an Audit Control: How It Gets Tested

Is it a key control?

In control terms it is a detective control over accounts payable. We searched the text of the PCAOB’s AS 2201 for “supplier” and “payable” and got no hits at all. That standard covers the audit of internal control over financial reporting (ICFR). “Reconciliation” and “vendor” each turn up once, in passing. The hits are in the appendix on service organizations and in a note on purchased software. Neither has anything to do with accounts payable. What AS 2201 does is tell the auditor to pick controls by whether they address the risk of misstatement, whatever the control is called.

Suppose your risk assessment says unrecorded liabilities or duplicate payments could be material. Suppose also that no other control would pick them up in time. Then the reconciliation is a key control, and the auditor can be expected to test it. Three-way matching (purchase order, receipt and invoice agree) may already cover those risks. So may the reconciliation of the AP subledger (the detail of what you owe each supplier) to the general ledger. In that case the statement reconciliation may only be a secondary control, and the auditor may decide not to rely on it.

What it catches and what it misses

What goes wrong is usually simple. The supplier billed you and the invoice never reached your ledger, or they issued a credit and you never received it. Duplicate payments turn up here as well. Auditors call the first problem one of completeness: is every invoice you owe in the ledger? Each such claim is called an assertion. Accuracy and cut-off are assertions too. Cut-off means each item landed in the right period.

This is a different job from three-way match. Match starts from your purchase order, so it cannot see an invoice you never entered. The statement starts from what the supplier recorded, so it can. Our guide on statement reconciliation against invoice matching compares the two. This page covers the month-end control, because that is the one auditors test.

Why the statement is useful evidence

PCAOB AS 1105, paragraph 8, says evidence from a knowledgeable source independent of the company is more reliable than evidence from internal sources. It also says evidence the auditor obtains directly is more reliable than evidence obtained indirectly. A supplier’s statement is a record you did not write, and that is why auditors like it.

What it will not catch

A fictitious vendor never sends a statement, so this control cannot see it. Supplier master data and bank detail controls have to deal with that one. Where the account is real, the reconciliation does catch duplicate billing, inflated invoices, missing credits and a balance that moved when nobody told you.

Does SOX, Provision 29 or Australian law require it?

None of the four names supplier statement reconciliation. For a private company the pressure is practical, not legal.

A UK subsidiary of a US-listed parent can fall under the parent’s SOX testing, and that is separate from Provision 29. The Western Australian Auditor General’s guidance on internal control lists reconciliations among control activities. It says key controls must be designed to prevent or detect misstatements in the assertions that matter.

A control narrative to copy

Plenty of controls exist only in someone’s head, and the evidence gets rebuilt from email every year. Put yours in the risk and control matrix (a table of each risk and the control that answers it) as one row. Variant A suits a few dozen suppliers. Variant B suits hundreds.

What a reviewer must actually do

Precision just means how exact the review rule is, such as a dollar threshold or an age. “Reviewed by the controller” describes a task but gives the auditor nothing to test. “The reviewer checks the unmatched list and escalates anything over the threshold or older than 60 days” can be tested. That is what makes it a control. Write the number down once and do not change it quietly partway through the year.

The reviewer should also be independent of the work. This is segregation of duties (no one person should handle both sides of a task). Whoever posts a supplier’s invoices should not sign off its reconciliation. The sign-off needs a date as well. Without one there is no way to show that the review happened by day 10 rather than after the auditor asked for it. In a small team one person may have to do both jobs. Say so in the control narrative and add a compensating control (a second check that covers the gap). One example is the controller re-performing two reconciliations each quarter.

How does an auditor test it?

Expect four steps, though each firm’s methodology sets the details.

1. 1

   Walk-through

   The auditor picks one supplier and one month. They follow the statement from receipt to the filed reconciliation. AS 2201 describes this walkthrough at paragraph .37. You sit alongside and answer questions. If the control was never written down, this is where the auditor finds out.

2. 2

   Sample the months

   For a monthly control, the auditor picks a few months to test. That count is the sample size, and it is usually two to four depending on risk. You do not get to choose which months. If a skipped month is pulled, they will usually widen the sample and ask what else was missed. They count a deviation whenever a sampled item shows the control did not operate as designed.

3. 3

   Inspect the evidence

   For each selected month, the auditor wants the statement as received, the ledger report at the same date and the tie-out. They also want every reconciling item classified and cleared, and who prepared and reviewed it, with dates.

4. 4

   Re-perform one

   The auditor will usually re-do a reconciliation from the statement and the ledger and compare the answer with yours. AS 2201 (paragraph .50) puts test types in order from least to most evidence. They start with inquiry and move through observation and inspection of documentation to re-performance. It adds that inquiry alone does not provide sufficient evidence about a control. So saying “yes, we reconcile every month” is unlikely to be enough on its own.

The guide is written for single audits, and issuer audits use firm-specific tables that look similar. These samples assume zero deviations. A single deviation in one of the pulled months fails the sample. In practice the auditor then tends to look harder at the rest of the population (every month, not just the ones pulled).

Statements are not confirmations

A statement you downloaded yourself from a supplier portal is weaker evidence than a confirmation, because it came through you. A confirmation is a reply the auditor gets straight from the supplier. So the auditor may ask a principal supplier to send a statement of account straight to the audit firm. The auditor decides which suppliers to ask, and big balances or thin reconciliations tend to get picked first.

Duplicates also turn up in a recovery audit, but that is a one-off hunt for overpayments, not a control. Our comparison sets a recovery audit and ongoing reconciliation side by side.

Three audit samples: one passes, two fail

Ostrander Components, Inc. is an SEC registrant with 140 active suppliers, and it runs the control monthly. For one supplier, Penhallow Industrial Packaging, the auditor selects March, July and October 2025. Both the company and every number below are made up. Treat it as an illustration, not a real audit. The terms are the PCAOB’s, and a private company’s auditor would use similar ones under AICPA or international standards. We say credit memo, as US companies do. Elsewhere you will see credit note.

March first. The three markers on Penhallow’s statement are what the workpaper (the file of evidence for that month) has to explain.

The workpaper carries an as-at date and an aging of open items at 9 April. The preparer is the AP analyst (8 April) and the reviewer is the finance manager (9 April). The one open item, the credit memo requested on 8 April, is one day old. By a 30 April follow-up it is 22 days old, still inside the 60-day rule. The control was due by 10 April. March passes.

The supplier emails for a gap like this one are in the guide to missing credit notes and duplicate payments.

What the deviation turns into

A deviation is not yet a finding. The auditor weighs how big the possible error is and how likely it is. A material weakness means there is a reasonable possibility that a material error will not be prevented or caught on time. A significant deficiency is less serious, but it still deserves the attention of those overseeing financial reporting.

Expect the auditor to ask what else would have caught the same error. That means the AP subledger to general ledger reconciliation, the search for unrecorded liabilities and any duplicate payment scans. Controls like these are called compensating controls. If they ran and would have caught a material error, the finding usually stays small. If the statement reconciliation was the only check on a risky group of suppliers, it gets bigger.

Where these controls break

Three failures worth checking your own process for:

• Coverage is picked by spend. A supplier whose invoices you never booked shows a nil balance, so a list ranked by balance cannot find it. Teams that reconcile only the top 20 miss exactly the accounts this control exists for.
• Open items sit for months. Without an aging rule, a credit memo requested in April is still “pending” in October.
• Timing differences are accepted on explanation alone. Picture a note reading “payment in transit” against a 2,516.40 item. The auditor asks for the bank record and the next statement. If neither was kept, the note is just a claim.

The coverage gap, illustrated

Doubling the list does not double the work if most of the extra suppliers are small. The other 100 suppliers can be done quarterly, as in Variant B, with a written cut-off rule. The habits that keep it running are in the best practices guide.

When software does the matching

You do. Automated matching changes the preparer, not the owner. The reviewer still looks at the exceptions and signs. The auditor still tests the control as management designed it. If you use a tool, including ours, expect to be asked how you know the matching is complete and accurate. AS 1105 treats a tool’s output as information produced by the company. So the auditor will either test the output or test the controls over the tool. The auditor will also want the log of how matching decisions are made.

• Keep the statement as received, with the receipt date, rather than only the tool’s reading of it.
• Keep the list of exceptions, who cleared each one, and when.
• Keep the version or setting of any matching rules that changed during the year.
• Have the reviewer sample some matched lines, not only the exceptions. A wrong match drops a real difference off the exceptions list.

Ask where the statements go and how long they are kept, since your evidence retention is only as good as the tool’s. Our security page covers storage and retention.

What evidence should you keep?

Build the pack month by month. The month-end routine that feeds these cards is in a repeatable checklist, and a reconciliation template gives you the tie-out layout.

How long to keep it depends on your jurisdiction and your auditor’s requests. Expect the auditor to ask for the period under audit, and sometimes the prior year. Check your tax authority’s record-keeping rules, which can be longer than the audit period.

If you work in the US, vendor reconciliation is the wider term and covers more than statements.

Questions people ask

Sources

• PCAOB, AS 2201: An Audit of Internal Control Over Financial Reporting, read 30 Oct 2026
• PCAOB, AS 1105: Audit Evidence, read 30 Oct 2026
• SEC, Release 33-9142: Internal Control Over Financial Reporting in Exchange Act Periodic Reports of Non-Accelerated Filers, read 30 Oct 2026
• FRC, UK Corporate Governance Code (Provision 29), read 30 Oct 2026
• Corporations Act 2001 (Cth) section 295A, AustLII, read 30 Oct 2026
• Office of the Auditor General for Western Australia, System of internal control, read 30 Oct 2026
• AICPA audit guide Government Auditing Standards and Single Audits, Table 13-1 control sample sizes, as reproduced by PwC, read 30 Oct 2026
• SEC, Accelerated filer and large accelerated filer definitions (small business compliance guide), read 30 Oct 2026
• ACFE, Occupational Fraud 2026: Report to the Nations, read 30 Oct 2026

What changed

• 30 Oct 2026: First published. Standards read on the dates in Sources. AS 1105 paragraph 8 and AS 2201 paragraphs .37 and .50 were checked against the PCAOB text on this date. Other paragraph numbers are deliberately not cited. Retention of records is left to your tax authority and auditor.
• 31 Oct 2026: Long sentences were split, plain-language explanations were added for technical terms, and repeated points were cut.