Twelve questions an auditor will ask about your supplier ledger

An auditor looking at your supplier ledger wants to know who made each posting decision, on what evidence and under whose authority; how recurring and variable supplier invoices are checked; how duplicates and mismatches are caught; where approval limits are written down; and who, by name, is accountable. The twelve questions below cover that ground. A finance director at a UK services firm should be able to answer each one with a document, not a recollection.

They are written with MSPs, agencies and consultancies in mind, where supplier invoices are frequent, variable and often tied to customer work. Nearly all of them apply to any firm.

1. Who made the posting decision, on what evidence and under what authority?

For any invoice, you should be able to name the decision-maker, person or system, show what they relied on, and point to the written limit that allowed them to act. "Accounts did it" is not an answer.

2. Who checks month-to-month changes in CSP or licensing invoices?

Cloud and software licensing bills move every month as seats are added and removed. Someone should compare each invoice with the last one and with customer orders, and that check should leave a trace. Unexplained seat growth is a margin leak, not a rounding error.

3. Are distributor invoices coded to a project after it has been invoiced?

Hardware and services from distributors often arrive after the customer has been billed. If the cost lands on a closed project, margin reporting is wrong and rebilling is missed. The auditor will look at the timing, and so should you.

4. What happens when a carrier bill does not match the quote?

Connectivity and carrier invoices drift from quotes through installation charges, early termination fees and price changes. There should be a defined route: who compares the bill with the quote, who decides, and where that decision is recorded.

5. Which invoices are approved without being opened?

Every finance team has them: the recurring bill waved through because it always arrives. Know which they are, why they are trusted, and how you would notice if one changed.

6. Which coding rules exist only in the AP lead's head?

If a rule matters enough to apply every month, it matters enough to write down. Unwritten rules fail when the person is on leave, and they cannot be evidenced to anyone else.

7. How many invoices were posted twice, and how were they found?

Duplicates happen: a PDF and a paper copy, a reminder processed as a fresh invoice. The auditor cares less about the number than the method. Found by a control is reassuring. Found by the supplier's credit controller is not.

8. Where is the single-approver limit written down?

The value above which an invoice needs a second approver should sit in a signed, dated document, not in habit. Expect to be asked for the version in force during the year.

9. Are supplier statements reconciled, filed or deleted?

Statements are a free external check on your ledger. Reconciling them catches missing invoices and unapplied credits. Filing them unread is a missed control. Deleting them is a finding waiting to happen.

10. Of ten random postings, how many could you explain in under five minutes?

This is the practical test of everything above. Pick ten yourself before the auditor does. Anything that needs a search through email, or a conversation with whoever was on shift that week, is a gap.

11. What share of month-end delay is waiting on supplier invoice coding?

If the close slips because invoices sit unposted while someone works out where they belong, that is a process problem with a cost. Measure it, even roughly, so you know whether it is improving.

12. Who, by name, is accountable for the posting decision?

Not a team, not a system, not a supplier. A person. If automation makes some of the decisions, that person still owns the limits it works within and the exceptions it raises.

What the twelve have in common

Each question asks for evidence of authority, consistency or ownership. None asks whether you use clever software. Firms that answer them well tend to share three habits: limits written down and signed, every decision recorded where it cannot be quietly changed, and one named owner.

Mandate is built for firms that want to answer these questions with evidence. Its agent, Invoice Maestro, makes the posting decision on supplier invoices inside a mandate the finance owner signs, scores its confidence on five factors, escalates unclear cases to a named person, and writes each decision to a tamper-evident, append-only audit trail. To see how your own ledger answers the twelve, the 60-Day Proof runs read-only and free on your invoices across two month-ends, with a day-60 report you keep: runmandate.co.uk/60-day-proof.

Frequently asked

When should we work through these questions?

Two or three months before year-end, so there is time to close gaps. Repeating the exercise after each quarter-end keeps the answers current.

Do these questions still apply if we use AI for accounts payable?

Yes, and the first becomes sharper. The auditor will want to see the signed limit the system worked within and a record of each decision it made.

Who should own the answers?

The finance director or financial controller. Individual answers may come from the AP lead, but one person should own the whole set.