Accounts payable audit procedures are written for populations and teams larger than most businesses have, and applying them unscaled produces either a great deal of work or a quiet decision to skip them. Neither is a good outcome. The useful question for a business with two people in finance is which procedures still earn their place, which can be skipped because the risk they address is covered elsewhere, and what compensates for the ones you cannot run at all because there are not enough people. This page answers those three, and is direct about the segregation problem that small teams cannot solve by procedure.
Keep: after-date payments, the supplier list, and duplicates
Three procedures that find the errors most likely to matter and take an afternoon between them. Each is within reach of one person and none depends on having a department. Together they cover the understatement risk, the fraud risk and the error most likely to be recoverable in cash, which is a reasonable return for one afternoon a year.
Skip with reason: extensive statement reconciliations and large samples
Chasing statements from every supplier and testing large samples costs more than it returns at small volumes. Skipping them is defensible when written down as a decision with a reason, and indefensible when it just does not happen.
Compensate for: segregation you cannot achieve
In a two-person finance function the same person often enters, approves and pays. No procedure fixes that. The recognised answer is a compensating control: an owner or director reviews new suppliers, bank detail changes and the payment run before release, and that review is recorded. It is weaker than separation and it is honest.
Questions people ask about accounts payable audit procedures
Is a compensating control good enough?
It is what small businesses do and what auditors expect to see, provided it is real and evidenced. A control described but never performed is worse than an acknowledged gap.
Who should perform the review if the owner is also the bookkeeper?
Then the gap is genuine and should be stated. Options are an external bookkeeper reviewing periodically or a non-executive reviewing payment runs, and both cost something.
How do we evidence a review?
A dated record that it happened and what was looked at. An unrecorded review is indistinguishable from no review when somebody asks a year later.