Accounts payable audit software runs tests across an entire ledger rather than a sample, which is genuinely different from what a person can do and is the whole of its value. It will check every invoice for a duplicate, every supplier against an employee address list, every payment for a round number just below a threshold, and every bank detail change against its history. Those are mechanical tests over a full population, and they find things sampling misses. What such software cannot do is judge whether what it found matters, and a tool that produces hundreds of exceptions nobody reviews is worse than a monthly look at the supplier list. This page is what it tests and whether you need it.
What full-population testing genuinely adds
Sampling finds systematic problems and misses the single fraudulent supplier. Testing every record finds the one, which is exactly the risk that matters most in a small business where a single scheme can be significant relative to profit.
The tests that are worth having
Duplicate detection on supplier, amount and date. Supplier details matched against employee records. Amounts clustered under approval thresholds. Bank detail change history. Round-number and weekend-dated payments. None is complicated and all benefit from covering everything.
What it cannot do
Decide whether an exception matters. Every one of these tests produces false positives, and somebody has to look. A tool whose output is not reviewed is an expense, and at small scale a person spending an hour on the supplier list often finds the same things.
Questions people ask about accounts payable audit software
Do we need this at our size?
Probably not as a purchase. Most of these tests can be run as spreadsheet checks on an export, which is where we would start rather than with a licence.
Is it the same as continuous monitoring?
Continuous monitoring is these tests run automatically and often, with alerts. The value is the same and the discipline of reviewing alerts is where it usually fails.
Can our accounting package do any of it?
Duplicate detection, usually. The supplier and threshold tests generally need an export and a few minutes with a spreadsheet, which is a reasonable place to stop.