Why Vendor master audit matters to internal audit and controllers
The vendor master is where many payment frauds start. A fictitious vendor or a changed bank account turns a routine payment run into a loss.
Typical tests look for vendors that share a bank account, tax ID or address, and compare vendor details with employee records. In the US the tax ID is the TIN; in India it is the PAN and GSTIN.
Changes need testing too: bank details changed without approval or just before a payment, dormant vendors reactivated, and vendors created and paid in the same week.
A clean vendor master makes every later AP test more reliable.
An example
Two vendor codes carry the same bank account under different names. One was created last month by a user who also approves payments. Together, those facts make the vendor a priority for review.
How IRAME handles it
IRA, IRAME's AI auditor, tests the full vendor master in one run and routes each flag to an owner. In one review it tested 251 vendors and flagged 129 for missing evidence. Vendor risk checks are part of IRAME's AP control.
See AP control or read the story: Vendor master review: 251 vendors tested in one run, 129 flagged.