Bank detail edits are still among the highest-impact AP risks. Yet many workpapers only show a screenshot of the new IBAN. That is not a trail; it is a moment.
Capture who approved, not only what changed
Inside the financial auditing app, link the change request, the approver identity, and the timestamp. If dual approval is a design claim, both approvals must appear — or you have an operating failure to write.
Test dormant reactivations deliberately
Reactivating sleeping vendors often bypasses the same gates as new vendor setup. Include at least one reactivation in your sample when the population exists.
Know the limitation
Some mid-market ERPs cannot surface dual-approval screens the way large platforms do. Document that system constraint early so findings do not pretend a control exists. Our flagship course states this limitation plainly in its FAQ.
Continue with Control Audit Mastery Module 4 for facilitated practice.