How should internal audit design a duplicate payment analysis that is more than a simple exact-match test?

Question

AcadiFi · Accepted Answer

A reliable duplicate payment analysis combines exact matching, fuzzy matching, and control follow-up. Exact matches are a starting point,...

Unlock with Scholar — $19/month

Get full access to all Q&A answers, practice question explanations, and progress tracking.

Start 7-Day Free Trial Compare Plans

No credit card required for free trial

At fictional Rivergate Manufacturing, internal audit receives 84,000 payment records. The team first standardizes vendor names, invoice numbers, dates, and amounts. Then it runs several tests: same vendor and amount within 30 days, same invoice number after removing punctuation, same bank account across different vendor IDs, and round-dollar payments just below approval thresholds.

```mermaid
flowchart TD
  A[Payment population] --> B[Clean fields]
  B --> C[Exact duplicate tests]
  B --> D[Fuzzy duplicate tests]
  C --> E[Exception queue]
  D --> E
  E --> F[Validate against source documents]
  F --> G[Root cause and control action]
```

The audit work is not finished when exceptions are listed. Auditors must validate whether each exception is a true duplicate, timing difference, credit, split shipment, or legitimate recurring charge. Then they should identify root causes: weak vendor master controls, poor invoice-number validation, manual emergency payments, or inadequate review of payment runs.

For CIA purposes, connect analytics to engagement objectives. The test provides evidence, but the conclusion depends on validation and control implications. A dollar recovery is useful; a fixed process is better. Practice more in our CIA question bank.

How should internal audit design a duplicate payment analysis that is more than a simple exact-match test?

Master Part 2 with our CIA Course

Related Questions

Practice Questions