Automated AP does not produce audit-ready records by default. Indian statutory audits require verified GSTR-2B reconciliation, a complete system-enforced approval trail, and TDS compliance records. Most AP tools do not generate these without deliberate configuration and manual closure. A finance controller running automated AP needs to run four specific checks in the two to four weeks before audit, not on the day the auditor arrives.
This article covers accounts payable audit readiness for Indian mid-market finance teams running automated AP. It applies to companies in the ₹100–₹2,000 Cr revenue range operating on SAP B1, Oracle, Tally, or a standalone AP tool, facing statutory or internal audit.
The assumption that automation handles audit readiness tends to surface as a problem at the worst possible time. Most finance controllers discover the gaps when the auditor asks for documentation that exists in four different places, or not at all.
What Indian Auditors Check in Automated AP, and Where They Find Gaps
When AP runs on paper, auditors follow the paper trail. When AP is automated, they shift to system logs, approval timestamps, and exception reports. The entry point changes; the scrutiny does not.
Three areas get attention first. Approval trail completeness: every invoice above a defined threshold should have a system-recorded approval with a timestamp and approver name. Auditors check for gaps, and the most common gap in practice is approvals that happened outside the system, over email or messaging apps, entered retroactively or not at all.
Second is vendor master accuracy. Duplicate vendors, vendors with mismatched PAN and GSTIN data, or vendors marked active without current KYC documentation create immediate audit queries. In automated AP, the vendor master feeds every downstream transaction, so errors compound across the year.
Third is GST documentation linkage. Every invoice with GST has a corresponding GSTIN. Auditors verify that ITC claimed ties back to valid tax invoices from registered suppliers and that GSTR-2B reflects the same transactions.
Automation changes the nature of gaps rather than eliminating them. A manual AP team might miss an approval. An automated AP team more often has approvals that happened outside the configured workflow because someone needed to move faster than the system allowed. The audit log shows the invoice was approved. It does not show the approval happened via a message after the fact.
For a broader view of what auditors prioritise when they enter an AP function, see What Auditors Look for First in Automated AP Environments.
The Three India-Specific Records That Must Be Audit-Ready
Three record categories are specific to Indian statutory audit and need separate preparation from the general AP audit trail.
GSTR-2B reconciliation. ITC claimed in the books must reconcile with what appears in the GSTR-2B statement for each period. Under GST Rule 36(4), as typically interpreted, ITC claims are subject to a provisional cap: a company may claim up to 105% of the eligible credit reflected in GSTR-2B for invoices not yet uploaded by suppliers. This buffer has been progressively tightened from 20% to 10% to 5% since the rule was introduced, and enforcement ties to monthly GSTR-3B filings. Any ITC claimed beyond the GSTR-2B-matched amount carries disallowance risk and will draw auditor scrutiny. This is an interpretive position based on current CGST Rules as commonly applied; verify the current position with your CA before treating it as definitive.
Finance teams running automated AP often have a GSTR-2B reconciliation process, but the reconciliation is frequently months behind by the time audit begins. The auditor will ask for the reconciliation statement for each quarter of the year under audit. If it is not ready, the audit stalls.
TDS on vendor payments. Two sections apply to most AP vendor payments.
Under Section 194C, as typically applied, TDS is required on contractor and sub-contractor payments exceeding Rs. 30,000 per single payment or Rs. 1,00,000 aggregate in a financial year. The rate is 1% for individuals and HUFs, 2% for all other entities, and 20% where the vendor has not provided a PAN.
Under Section 194J, as typically applied, TDS applies on professional and technical service payments above Rs. 50,000 per financial year (the threshold was increased from Rs. 30,000 effective FY 2025-26, as commonly understood). Technical services and certain royalties attract a 2% rate; professional services attract 10%; payments without PAN attract 20%. These are interpretive positions based on current provisions; verify applicable rates and thresholds with your CA, particularly for any Finance Act changes in the current year.
The audit check is whether TDS was deducted correctly, deposited on time, and reflected in quarterly Form 26Q returns. Automated AP tools log payments. They do not verify TDS deduction compliance at the invoice level. That gap requires manual closure before audit.
Vendor PAN-GSTIN integrity. Every active vendor should have a valid, verified PAN and GSTIN where applicable. Vendors with unverified or mismatched data can trigger ITC disallowance queries or questions on TDS deduction basis. A verification pass before audit is faster than explaining mismatches under audit pressure.
AP Audit Readiness: The Finance Controller’s Four-Week Preparation Checklist
Four weeks is enough time to prepare for most finance teams, if the work starts then.
Weeks four and three before audit: Pull the GSTR-2B reconciliation for all periods under audit. Categorise unreconciled items by reason, whether supplier not filed, timing difference, or data mismatch, and assign an owner to each category. Do not leave this to the final week. The reconciliation itself takes time when invoice volumes are high.
Weeks three and two: Audit the approval trail in the system. Run a report of all invoices above the approval threshold and verify each has a recorded, timestamped system approval. For invoices approved outside the workflow, document the business reason and attach the supporting email or message chain as evidence. Undocumented exceptions are a material risk. Documented ones, with explanations, are manageable.
Weeks two and one: Pull the TDS deduction register for the audit period and cross-check against Form 26Q filings. Confirm deposits were made within due dates. Flag any vendor where service classification and TDS applicability are ambiguous, and confirm the position with your CA before the auditor asks.
Week of audit: Package the exception log with explanations for each item. Brief the AP team on what documentation requests to expect and where each document lives in the system. Auditors move faster when the team knows what they are looking for.
For how control design affects the volume of exceptions that reach audit, see AP Controls vs Operational Speed: Where the Trade-off Actually Lives.
The early warning indicators that predict AP process risk before audit findings appear are worth reviewing alongside this checklist. Most audit findings were visible in the operational data weeks earlier.
Key observations
- Automated AP changes what auditors check, not how thoroughly they check it. System logs, approval timestamps, and exception reports replace paper trails as the primary audit entry point.
- GSTR-2B reconciliation is, in practice, the most common unresolved item at audit time in Indian mid-market AP. Under GST Rule 36(4) as typically interpreted, ITC claims beyond 105% of GSTR-2B-matched credit carry disallowance risk.
- Approval trail gaps in automated AP typically come from approvals that happened outside the configured workflow, not from missing approvals in the system record.
- TDS compliance requires active management at the invoice level. The payment log records the transaction. It does not verify the deduction rate was correct or the deposit was timely.
- Four weeks of structured preparation is sufficient for most finance teams. The day the auditor arrives is too late.
Published by IQInvoice
IQInvoice is an accounts payable automation platform for Indian mid-market finance teams, covering invoice capture, GST compliance validation, approval routing, and ERP integration.