On this page
Key takeaways
- A procurement audit is an independent review of whether buying activities follow policy and law, deliver value and control risk.
- This is different from auditing a supplier. A supplier audit checks a vendor; a procurement audit checks your own function.
- Plan by risk. Focus on high spend, high risk and areas with known control gaps, not an even sweep.
- Test each stage of the cycle: need, sourcing, award, contract, receipt and payment.
- Findings only matter if they lead to owned, dated actions that you check later.
Free PDF: Procurement audit work programme. Get it below
Imagine a head of internal audit who is asked to review procurement this year. She has forty days. The function buys across eleven categories and three regions. She cannot test everything. If she plans an even sweep, she will test a little of everything and find nothing that matters. If she plans by risk, she will find the dozen contracts where a gap would cost the most.
The case is invented. The decision it describes is the first one in any audit: where to look.
A procurement audit is an independent, structured review of the buying function that tests whether purchasing follows policy and law, delivers intended value and controls the risks that arise in the process.
How is a procurement audit different from a supplier audit?
A supplier audit examines a vendor: its quality system, security or labor practices. Our supplier audit checklist covers that. A procurement audit looks inward, at your own team, policies, approvals and records. It asks whether the right supplier was chosen in the right way, the contract was sound and payment matched delivery. The two can inform each other, but they are separate pieces of work with separate checklists.
How do you scope it?
- Get the spend picture. Total spend, top suppliers, categories and any spend with no purchase order. Our spend analysis guide shows how to build it.
- List the risks. Use the procurement risk register if one exists. If not, interview the head of procurement and finance.
- Choose objectives. Examples: controls over supplier selection, accuracy of savings reporting, compliance with approval limits.
- Set the period and boundaries. Twelve months of transactions is typical. State what is out of scope and why.
- Pick the sample method. Risk-based picks for high value contracts, random picks for routine purchases.
What do you test at each stage?
| Stage | Question | Typical test |
|---|---|---|
| Need and approval | Was the purchase authorized by the right person? | Compare approver to the limit table for a sample of orders |
| Sourcing | Was competition used as policy requires? | Check quotes or tender records above the threshold |
| Supplier onboarding | Was the supplier vetted before first payment? | Compare onboarding date with first payment date, check the vetting record |
| Award | Was the winner chosen on stated criteria? | Review the evaluation and check scoring against criteria |
| Contract | Are terms in place and signed before work began? | Match contract date to the first invoice date |
| Receipt | Was delivery confirmed? | Match goods receipt to invoice |
| Payment | Did payment match order, receipt and invoice? | Three way match test and a duplicate payment test |
Add fraud tests from the procurement fraud guide: vendor and employee data matches, approvals just under limits and unusual price changes. For the rules these tests check, see procurement compliance.
Free PDF
Procurement audit work programme
A work programme with scope questions, stage by stage tests, sampling notes and a findings log, ready to adapt to your own audit standards.
- Scope and risk questions
- Stage by stage test table
- Sampling and evidence notes
- Findings log with owners and dates
How do you sample?
Avoid choosing items by feel. Use two groups. The first is a risk-based selection: the largest contracts, new suppliers, sole source awards and any purchase flagged by a data test. The second is a random selection of routine purchases, so that results speak for the whole population. State the sample size and how you chose it in the working papers. The size you need depends on your methodology and your firm's standards, and we do not give a universal number.
How do you rate and report findings?
| Rating | Meaning | Action |
|---|---|---|
| High | A control is missing or has failed in a way that exposes real loss or breach | Report to the audit committee, fix within 30 to 60 days |
| Medium | A control works partly or inconsistently | Fix within one quarter |
| Low | A minor weakness with little exposure | Fix in the normal course |
The timing is our suggestion, since each organization has its own policy. Write each finding in four parts: what you found, the evidence, why it matters and what to do. Name an owner and a date for each action. Share a draft with the procurement lead before issuing so that facts are agreed and surprises are rare.
What goes wrong in procurement audits?
- An even sweep. Equal attention to every category finds little.
- Testing the policy, not the practice. Reading the policy tells you what should happen, not what does.
- Findings with no owner. An unowned action is never done.
- No follow-up. Retest high rated findings within six months.
- Auditing in isolation. Talk to buyers early, because they know where the process breaks.
What does the evidence say about weak controls?
The ACFE's 2024 study of 1,921 fraud cases found the median scheme lasted 12 months before detection, and corruption appeared in 48 percent of cases. The length of time is the number that matters to an auditor. Controls that test activity every quarter shorten the window in which a scheme can run unseen. Deloitte's 2025 survey of more than 250 CPOs also found that the top barrier to delivering value was siloed ways of working at 57 percent, so audit teams should look at handoffs between functions, not only inside procurement.
The audit work programme in the download below turns these ideas into a working document. For the plan that audit supports, see the procurement strategy guide.
Sources
- ACFE, Occupational Fraud 2024: A Report to the Nations: 1,921 cases, 138 countries.
- Deloitte, Global CPO Survey 2025: more than 250 CPOs in 40 countries.
- Audit steps, ratings and timings are editorial summaries of common internal audit practice. Follow your own audit standards.
Frequently asked questions
What is a procurement audit?
It is an independent, structured review of the buying function that tests whether purchasing follows policy and law, delivers intended value and controls risk.
What is the difference between a procurement audit and a supplier audit?
A supplier audit checks a vendor, such as its quality system or labor practices. A procurement audit checks your own function: policies, approvals, sourcing, contracts and payments.
How do you plan a procurement audit?
Gather the spend picture, list the risks, choose objectives, set the period and boundaries and pick a sampling method that combines risk-based and random selection.
What should a procurement audit test?
Test each stage: authorization, competition, supplier vetting, award criteria, contract timing, goods receipt and payment matching, plus data tests for fraud patterns.
How often should procurement be audited?
Many organizations review it every one to three years, with high-risk areas more often. Set the cycle by risk and by results of previous audits.