What Is a Procurement Audit?
A procurement audit is a structured review of how an organization buys goods and services and what it pays for them. It answers two questions. Did purchases follow the organization's own rules for approvals, competition and contracts? And did suppliers bill what their contracts allow?
Many guides cover only the first question. This one covers both, along with the types of procurement audit, the steps to run one and a checklist you can use.
What a procurement audit covers
A procurement audit follows purchases through the whole cycle and checks the records at each stage:
- Requisitions and approvals: who asked for the purchase and who approved it.
- Supplier selection: whether bids or quotes were obtained when policy required them, and how the winner was chosen.
- Contracts: terms, price lists, amendments, rebates and renewal dates.
- Purchase orders and receiving: what was ordered and what actually arrived.
- Invoices and payments: whether invoices match the PO, the receipt and the contract, and whether anything was paid twice.
- Supplier performance: delivery, quality and service levels against the contract.
A procurement audit is not the same as a spend analysis. A spend analysis summarizes where money goes and points to opportunities. An audit tests individual transactions against rules and contracts, and it produces findings that someone has to act on.
Types of procurement audits
| Type | What it checks | Usually run by |
|---|---|---|
| Process and internal-control audit | Whether purchasing followed policy: approvals, bid thresholds, segregation of duties, conflict-of-interest rules | Internal audit or external auditors |
| Supplier contract-compliance audit | Whether suppliers billed contract prices, discounts, rebates, freight terms and fees | Procurement or finance, often with an outside specialist |
| Transaction or payment audit | Whether payments were accurate: duplicates, wrong amounts, payments without receipts | Accounts payable or internal audit |
| Performance audit | Whether the procurement function and its suppliers deliver value: cycle times, service levels, supplier performance | Procurement leadership or internal audit |
| Special-purpose audit | One specific concern, such as suspected fraud, a new system or a merger | Internal audit, investigators or advisers |
Internal-control audit vs. supplier contract-compliance audit
Both are called procurement audits, but they answer different questions and produce different results.
| Internal-control audit | Supplier contract-compliance audit | |
|---|---|---|
| Question | Did our people follow our rules? | Did our suppliers follow our contracts? |
| Focus | Approvals, competition, segregation of duties, documentation | Unit prices, discounts, rebates, freight, fees, quantities |
| Main data | Policies, requisitions, approval logs, bid files | Contracts and price lists, invoice line detail, supplier transaction history |
| Output | Control findings and recommendations | A list of billing discrepancies, with amounts |
| Recovery | Not the aim | Overbilling found is claimed back as credits or refunds |
| Timing | Set by the internal-audit plan | By supplier or category, often on a rolling basis |
Most organizations need both. An internal-control audit keeps the process sound. A supplier contract-compliance audit checks that the prices negotiated during sourcing are the prices actually paid. Dryden's procurement audit services include this second kind of review.
Benefits of a procurement audit
- Recover overbilling. Prices above contract, missed rebates and fees the contract doesn't allow can be claimed back from suppliers and corrected going forward.
- Find control gaps before they cost money. Weak approvals, purchases split to stay under bid thresholds, or one person able to set up a supplier and approve its payments are easier to fix when found early.
- Confirm suppliers honor the contract. An audit tells suppliers that the terms are being checked.
- Improve the next sourcing round. Findings show which contract terms were unclear and which suppliers performed. That feeds directly into the next RFP.
- Keep records ready for review. External auditors, boards and grant reviewers ask for the same documents an audit assembles.
How to conduct a procurement audit, step by step
- Set the scope and objectives. Decide which audit you are running (controls, supplier billing or both), the period to cover and which categories or suppliers to include. Indirect categories such as office supplies, MRO, facilities services and lab supplies are common starting points, because they combine many transactions with many price points.
- Check your audit rights and record retention. Read each contract's right-to-audit clause: which records the supplier must provide, how much notice it needs and how far back you may look. Then check how long your own systems keep invoice and PO detail. Together, these set a realistic lookback period.
- Gather documents and data. Collect contracts, amendments and price lists, purchase orders, receiving records, invoices with line detail, payment records and approval logs. For a billing audit, ask suppliers for their transaction history for the period. It often holds more detail than your own invoices.
- Test the transactions. Run three-way matches of PO, receipt and invoice. Compare invoiced unit prices with contract prices. Check that discounts, rebates and freight terms were applied, and look for duplicate payments and approvals that bypassed policy. Where the data allows, test every transaction rather than a sample, because small errors repeated across thousands of invoices are what samples miss.
- Report the findings with evidence. For each finding, show the contract term, the transaction, the difference and the period affected. Group findings by supplier and by cause so it is clear what needs fixing.
- Recover and fix. Share billing findings with each supplier, agree on the corrections and obtain credits or refunds. Correct catalog and system prices so the error stops. For control findings, change the policy, system setting or approval rule that allowed them.
- Monitor. Recheck the highest-risk suppliers and categories on a schedule, and add the tests that found problems to routine invoice review.
Procurement audit checklist
Process and controls
- Is there a written purchasing policy, and is it current?
- Are approval limits set, and do approvals in the system match them?
- Were bids or quotes obtained wherever policy required them?
- Can any one person set up a supplier, approve a purchase and approve its payment?
- Are conflict-of-interest declarations on file for the people who choose suppliers?
- Is every contract stored centrally, with its renewal date tracked?
- Can you produce the full record for a sample purchase, from request to payment?
Supplier billing
- Do invoiced unit prices match the contract price list?
- Were contracted discounts applied on every invoice?
- Have all rebates and credits due under the contract been received?
- Were freight, delivery and minimum-order terms followed?
- Do invoices carry fees the contract does not allow, such as surcharges or expedite fees?
- Do quantities billed match quantities received?
- Was any invoice paid twice?
What procurement audits commonly find
- Prices above the contract rate, for example when a list-price increase is applied to contracted items.
- Contract discounts missing from some invoices.
- Volume rebates or credits that were due but never paid.
- Freight or shipping terms not followed.
- Late fees, expedite charges or surcharges with no basis in the contract.
- Duplicate payments, for example from an invoice that was sent twice.
- Quantities billed that were never received.
- Purchases placed outside the contract, at higher prices.
- Contracts that renewed automatically on old terms.
Audits are slowed down by the same few problems. Data sits in several systems, contracts live in email and shared drives, some contract terms are vague enough to argue about, and suppliers can be slow to provide records. Clear contract language and a right-to-audit clause make the next audit easier.
Auditing suppliers in more than one country
When a supplier bills in several countries, the audit needs a few extra steps:
- Collect every regional contract. Terms and price lists often differ by country.
- Fix the price basis first. Agree on the currency and exchange-rate basis to test against before comparing prices.
- Separate tax from price. Pull VAT, GST or sales tax out of the item price, so tax differences are not mistaken for overcharges.
- Plan for more data sources. Expect to pull data from more than one regional system, and give suppliers more time to supply records.
Procurement audits in higher education and the public sector
Public universities, government bodies and other organizations that spend public or grant money face closer review, and their procurement audits look harder at process.
Two references are worth knowing. The first is the Institute of Internal Auditors' practice guide Auditing Procurement in the Public Sector, 2nd edition, issued December 19, 2025. It sets out the risks and controls to test at each phase of procurement.
The second applies to purchases made with federal grant funds. The Uniform Guidance requires records "sufficient to detail the history of each procurement transaction." Those records include the rationale for the procurement method, the contract type, contractor selection or rejection, and the basis for the contract price (2 CFR 200.318(i)).
At universities, the hardest part is usually decentralized buying. Departments, labs and campuses buy on their own, and purchasing cards cover many small orders. An audit that only samples central purchasing will miss much of that spend. See how Dryden works with higher education and government clients.
Common questions
How often should you do a procurement audit?
Internal-control reviews follow the internal-audit plan, which sets the cycle by risk. Supplier billing checks work best on a rolling basis: the largest suppliers and highest-volume categories first, then the rest over time. Any major contract should also get a billing check before it is renewed.
Who should conduct a procurement audit?
Internal-control audits should be run by people independent of the purchasing team, usually internal audit or an external auditor. Supplier billing audits need people who can read contracts and analyze invoice line data. Procurement, finance or an outside specialist can do them, as long as they can get the supplier's records.
What is the difference between a procurement audit and a spend analysis?
A spend analysis looks across all spend to show where money goes and where the opportunities are. A procurement audit tests specific transactions against rules and contracts and produces findings to act on. A spend analysis often tells you which suppliers to audit first.
How far back can a supplier audit go?
As far back as the contract's right-to-audit clause and both parties' records allow. Check the clause for a lookback period and the supplier's record-keeping obligations, and check how long your own systems keep invoice line detail.
Talk to Dryden about a procurement audit
Dryden Group is a procurement consulting firm based in Radnor, PA. Since 2001 we have worked with universities, hospitals and health systems, state, county and local governments, and businesses in every industry, including global Fortune 1000 companies. Learn about our contract compliance audits, or contact us to talk through scope.
Related service: Procurement Audits →
.svg)