Finance Index
What should an AP audit trail capture?
Reference guide to AP audit trail what to capture, including control design, audit evidence, risk points, finance procedures, and compliance review.
A complete invoice audit trail captures every consequential event with four attributes: who (named user), what (the action, with before/after values for field changes), when (timestamp), and context (what the actor saw - the invoice version, coding, and attached documents at that moment). The standard is simple: could a stranger reconstruct the invoice's full history from the record alone?
At a Glance
| Aspect | Short Answer | Why It Matters |
|---|---|---|
| What should an AP audit | A complete invoice audit trail captures every consequential event with four attributes: who (named user), what (the action, with before/after values for field changes), when (timestamp), and context (what the actor saw. | Keeps evidence clear and reduces control risk. |
| Control point | Log everything; pay attention selectively. | Keeps evidence clear and reduces control risk. |
| Approval path | As one connected chain, not a set of parallel logs. | Keeps evidence clear and reduces control risk. |
| Audit evidence | The chronological, attributable record of everything that happened to a transaction - receipt, edits, coding, approvals, payment - that lets you prove the process operated. | Keeps evidence clear and reduces control risk. |
| The audit trail record | Yes - rejections are control successes and their reasons are process intelligence. | Keeps evidence clear and reduces control risk. |
Should every field change be logged, or only control-relevant fields?
Log everything; pay attention selectively. Storage is cheap and you can't retroactively log what you didn't capture - but your review and alerting should concentrate on control-relevant changes: amount, vendor, banking details, GL coding, entity, and approval-related fields. The before/after pair is what makes a change log useful: "amount edited" is a fact, "amount changed from $4,800 to $48,000 by user X after approval" is evidence. Edits made after initial entry - and especially after approval - deserve their own scrutiny, because that's where both honest errors and manipulation concentrate.
How should the audit trail link an invoice to its PO, receipt, approvals, and payment?
As one connected chain, not a set of parallel logs. The invoice record should reference the matched PO and receipt, carry its own approval history (including delegations and reassignments), and link forward to the payment that settled it - so an auditor can walk commitment -> delivery -> validation -> authorization -> cash in either direction. Fragmented logs (an ERP object history here, an email approval there, a bank record elsewhere) are where audit prep time goes to die; chain-of-custody connection is the property to demand from any system.
What is an audit trail in accounts payable?
The chronological, attributable record of everything that happened to a transaction - receipt, edits, coding, approvals, payment - that lets you prove the process operated. It is the difference between asserting controls exist and demonstrating they ran.
Should the audit trail record rejected invoices and the reasons, not just approvals?
Yes - rejections are control successes and their reasons are process intelligence. A trail that only shows approvals can't demonstrate that review was real, and rejection patterns (by vendor, by error type) tell you what to fix upstream.
How do I capture the approval context - what the approver actually saw at the moment they approved?
The system should bind each approval to the invoice state at action time: the amount, coding, documents, and flags as they stood. This is the strongest answer to the auditor question "did the approver have what they needed?" - and it's why approvals inside the invoice workspace beat approvals in a detached email or list view.
Do comments and questions between AP and approvers belong in the audit trail?
Yes. The question "is this the contracted rate?" and its answer are part of how the decision was reached - evidence of genuine review. When that dialogue lives in email instead, the trail shows a bare approval and the diligence behind it is invisible.
What are the audit trail requirements for invoices that were edited after initial entry - who changed the amount and when?
Every edit needs actor, timestamp, and before/after values - and material post-approval edits should trigger re-approval, since the authorization applied to different numbers. Auditors specifically probe the edit-after-approval window; make sure your system can answer it.
What audit trail capabilities should I demand from an AP automation tool before buying?
Immutability (no edit or deletion of history, by anyone); field-level before/after capture; approval history including delegation and reassignment; human vs. AI action attribution; in-context communication capture; linkage across PO, receipt, invoice, and payment; and clean export for auditors. Then test it in the demo: change a field, approve, and ask to see - and to alter - the log.
Stampli perspective
Stampli captures the audit trail as a byproduct of doing the work: every dispatch, coding change (with before/after values), approval, rejection, question, comment, delegation, skip-approval reason, recall, and ERP sync event lands on the invoice's activity record - alongside the invoice image, documents, and conversation. Because communication happens on the invoice rather than in email, the approval context is part of the evidence, and invoice data can be exported when auditors ask. The trail is immutable: it documents what happened, including corrections, rather than allowing history to be rewritten.