Skip to content

Internal and Forensic Audit · Internal Audit of Specific Functions

Internal Audit of Procurement and Purchase Cycle

Updated 11 October 2026 · Fact-checked

Internal audit of procurement and purchase is a review of the full buying cycle: requisition, vendor selection, purchase order, goods receipt, invoice matching and payment. You identify risks at each stage, test the controls, gather evidence, and report gaps such as unauthorised buying, weak vendor checks, overpayment and fraud.

Understand Internal Audit of Procurement and Purchase

Procurement is how a business gets goods and services from outside. Purchase is the transaction part of it. Money leaves the company at the end of this cycle, so it is a high-risk area for waste, errors and fraud. That is why internal auditors review it often.

The cycle has a clear flow. A user department raises a purchase requisition. Purchase staff select a vendor after quotations or tenders. A purchase order (PO) is issued. The store receives goods and prepares a goods receipt note (GRN). Accounts receive the vendor invoice, match it with the PO and GRN, record the liability and make payment.

Each stage carries a risk. Requisitions may be unneeded or unapproved. Vendors may be fictitious, related to staff or chosen without competition. Orders may be placed at inflated rates or without a PO. Goods may be short, damaged or of poor quality. Invoices may be duplicated or wrongly priced. Payments may go to the wrong party or be made early.

Controls answer these risks. The key ones are segregation of duties (the person who requests, orders, receives and pays should differ), delegated approval limits, an approved vendor list, competitive quotations, three-way matching of PO, GRN and invoice, and system checks against duplicate payment.

In the exam, think like an auditor. For each stage, state the risk, the control that should exist, the test you will perform, and the likely finding. Link your answer to the facts given in the case.

Key rules to remember

Three-way matching
Pay only if Purchase Order = Goods Receipt Note = Vendor Invoice (item, quantity, rate, terms)
Some entities add a fourth match with the inspection or quality report. Differences beyond the set tolerance need approval before payment.
Segregation of duties in purchasing
Requisition ≠ Approval ≠ Ordering ≠ Receiving ≠ Invoice processing ≠ Payment
Where full separation is not possible, use compensating controls such as independent review.
Price variance
Price variance = (Invoice rate − PO rate) × Quantity invoiced
A positive result means overpayment against the agreed rate.
Quantity variance
Quantity variance = (Quantity invoiced − Quantity received) × PO rate
A positive result means you are billed for goods not received.

How to solve Internal Audit of Procurement and Purchase questions

Use this order for any question on auditing the purchase function. It keeps your answer structured and tied to the facts.

  1. 1Read the facts and mark the stage of the cycle where the problem sits: requisition, vendor, PO, receipt, invoice or payment.
  2. 2State the objective of the audit for that stage, for example that all purchases are authorised, genuine, priced correctly and recorded.
  3. 3List the key risks at that stage in one line each.
  4. 4Name the controls that should exist, such as approval limits, approved vendor list, three-way match and segregation of duties.
  5. 5Describe the audit procedures: inspect documents, re-perform the match, confirm with vendors, sample POs and trace to GRN and payment, run data analytics for duplicates.
  6. 6Give the likely findings from the facts and their impact, such as loss, fraud exposure or non-compliance.
  7. 7Conclude with recommendations and management follow-up, written in practical terms.

Quickest way: Risk-Control-Test by stage

When to use it: Use this when a question asks for an audit checklist, procedure or key controls in a limited time.

  1. Write the six stages as a list: requisition, vendor, PO, receipt, invoice, payment.
  2. Against each, write one risk, one control and one test in a single line.
  3. Add two cross-cutting points: segregation of duties and system or access controls.
  4. Finish with two lines on reporting: findings with root cause, and recommendations.

Common mistakes in Internal Audit of Procurement and Purchase

  • Listing controls without naming the risk they address.

    Students memorise checklists and skip the link to risk.

    Fix: Write each point as risk, then control, then test. This shows audit thinking.

  • Confusing the internal auditor's role with approving purchases.

    Students mix management's operating duties with audit duties.

    Fix: Say the auditor reviews and recommends. Management owns approval and the controls.

  • Ignoring vendor master data.

    Focus stays on the PO and payment stages.

    Fix: Include checks on vendor creation, approval, change of bank details, related parties and duplicate or dormant vendors.

  • Treating three-way matching as only an invoice check.

    The term is learned as a definition without its purpose.

    Fix: Explain that it confirms you ordered it, received it and are billed correctly. Mention tolerance limits and exception approval.

  • Giving generic answers that ignore the case facts.

    Students write a ready-made checklist.

    Fix: Pick up facts such as one person handling orders and payments, and name the exact weakness and fix.

  • Omitting recommendations and follow-up.

    Time runs out after listing procedures.

    Fix: Reserve the last few lines for practical recommendations and management response.

Worked examples

Example 1

During an internal audit of Sharma Engineering Ltd, you find that the purchase officer selects vendors, raises POs, receives goods at the gate and also authorises payments up to ₹5,00,000. Identify the risks and recommend controls.

Show the solution
  1. Identify the weakness: one person performs ordering, receiving and payment approval. This is a failure of segregation of duties.
  2. State the risks: fictitious or favoured vendors, inflated rates, payment for goods not received, and concealment of errors or fraud.
  3. Recommend separation: requisition by the user department, vendor approval by a committee or head, PO by purchase, receipt by stores, and payment by accounts.
  4. Recommend approval limits: higher-value POs and payments to need a senior sign-off.
  5. Recommend three-way matching by accounts before payment.
  6. Suggest audit tests: sample POs and trace to GRN, invoice and payment; review vendors used by this officer for concentration and related parties.

Answer: The combination of duties is a serious control gap that allows fraud and error to go unnoticed. Segregate the duties, set approval limits, enforce three-way matching, and review the officer's past transactions as a follow-up.

Example 2

Purchase order: 500 units at ₹240 per unit. Goods received: 480 units. Vendor invoice: 500 units at ₹250 per unit. Compute the overbilling and state what the auditor should do.

Show the solution
  1. Correct payable should be 480 × ₹240 = ₹1,15,200.
  2. Invoice amount is 500 × ₹250 = ₹1,25,000.
  3. Excess billed = ₹1,25,000 − ₹1,15,200 = ₹9,800.
  4. Split it: price variance = (250 − 240) × 500 = ₹5,000.
  5. Quantity variance = (500 − 480) × ₹240 = ₹4,800.
  6. Check: ₹5,000 + ₹4,800 = ₹9,800.

Answer: The invoice is overstated by ₹9,800 (₹5,000 for price and ₹4,800 for quantity). The auditor should check whether the invoice was paid, ask why the three-way match failed to block it, seek a debit note or recovery, and report the control failure.

Exam tips

  • Structure answers by stage of the cycle. It earns marks for completeness and is easy for the examiner to follow.
  • Use the case facts. Name the exact weakness, then give the control and the audit test.
  • Always mention segregation of duties, approval limits, vendor master control and three-way matching where relevant.
  • Do the arithmetic cleanly in numerical cases and show the check.
  • Close with recommendations and follow-up, as papers are written and case-based.

Practice questions from Internal Audit of Specific Functions

Internal Audit of Procurement and Purchase in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Audit of Procurement and Purchase: frequently asked questions

What are the main stages audited in the purchase cycle?

They are requisition, vendor selection, purchase order, goods receipt, invoice matching and payment. You audit risks and controls at each stage. Vendor master data is also reviewed.

What is three-way matching?

It is a control where the purchase order, goods receipt note and vendor invoice are compared before payment. Item, quantity, rate and terms must agree. Differences beyond tolerance need approval.

What are the red flags in procurement audit?

Common ones are splitting orders to avoid approval limits, repeat purchases from one vendor, vendors with staff-linked addresses, duplicate invoices, round-sum invoices and changes to vendor bank details. Each needs follow-up.

Is the internal auditor responsible for approving purchases?

No. Management approves and operates the controls. The internal auditor evaluates them independently and recommends improvements.