# How does a Controller build the case for a spend audit? > A Controller's playbook for building an internal case for a spend audit: what evidence to gather, how to frame it, and who signs off. Read the full guide. Source: https://valuexpa.com/insights/how-does-a-controller-build-the-case-for-a-spend-audit Publisher: ValueXPA (https://valuexpa.com) Updated: 2026-10-22 --- Margin drift is the gap between what a vendor contract says and what the invoice actually charges. A Controller who suspects this gap exists usually cannot see it directly. It shows up as a gross margin that will not reconcile, an AP team that closes the month anyway, and a CFO who wants a reason before approving anything new. Building the case means turning that suspicion into something a CFO can act on: a defined cost, a defined scope, and a defined next step. ## Executive Summary A Controller does not need certainty to build the case for a spend audit. They need three things a CFO will act on: a named symptom, a bounded cost of finding out, and a scope that does not require new headcount or a new system. The symptom is usually a [gross margin bridge](/insights/building-a-gross-margin-bridge-that-separates-inflation-from) that will not close against price and volume alone. The bounded cost is the difference between a fixed-scope diagnostic and an open-ended internal project with no end date. The mechanism that makes the case land is separating two different problems that get treated as one. Three-way matching in the ERP confirms an invoice matches a purchase order and a receipt. It does not confirm the rate on that invoice matches the rate card, or that a surcharge condition has actually expired. A Controller who can show that distinction, in writing, with a small set of invoice examples, has done the hard part of the case already. What changes the decision is framing the audit as a bounded, reversible cost rather than an open commitment. A fixed-scope diagnostic with a stated delivery window is a different ask than "let's investigate this." The Controller's job is to present it that way, with the evidence that makes the delivery window credible. ## 1. What evidence does a Controller need before raising this? **A Controller needs three artifacts before raising a spend audit: a gross margin bridge that shows an unexplained residual after price and volume are accounted for, a short list of specific invoices where the billed rate does not match the contracted rate, and a one-line description of what the current AP process actually checks. None of these require new tools or new access. All three come from data the Controller already closes the books against every month.** The gross margin bridge is the anchor. If price and volume explain the movement in gross margin, there is no case. If they do not, the residual has a name: cost, and cost hides in vendor terms more often than in production. The invoice examples matter because they are concrete. A CFO who hears "we think we're being overbilled" hears an opinion. A CFO who sees three invoices where the rate on the page does not match the rate in the contract sees a fact, and facts do not need to be argued with. The process description closes the loop: it explains why AP did not catch this. Three-way matching checks the invoice against the purchase order and the receipt. It does not check the invoice against the rate card, the volume tier, or a surcharge's expiration date. That is a description of what the control does, not a criticism of the AP team. ## 2. How does a Controller separate a pricing problem from a compliance problem? **A pricing problem is a rate that was negotiated up. A compliance problem is a rate that was negotiated correctly but billed incorrectly. The distinction decides who owns the fix: pricing changes belong to procurement and category managers, while compliance drift belongs to the invoice-to-contract matching that AP does not currently perform. A Controller who conflates the two will get the wrong owner assigned and the case will stall.** This separation is what makes the case actionable instead of political. If the Controller frames rising service costs as a negotiation failure, the response is a renegotiation project owned by procurement, months long, with no guarantee the new rate will be honored either. If the Controller frames it as a compliance gap, the response is narrower: check whether the rates already agreed to are the rates already being billed. That is a checkable, bounded question, not a renegotiation. Both problems can exist at once. But naming them separately lets the Controller ask for the smaller, faster thing first: confirm compliance before opening a pricing conversation that may not be necessary. ### A. Pricing drift The contract itself no longer reflects market terms or the volume the company now runs. Fixing this requires a renegotiation, owned by procurement or category management, and it takes as long as any vendor negotiation takes. ### B. Compliance drift The contract terms are fine, but the invoice does not follow them: a rate card that reverted to list price, a surcharge that outlived its trigger condition, a volume tier that was never applied. This is a matching problem, not a negotiation problem, and it is what a spend audit is built to find. ## 3. Who signs off on a spend audit at a $50M+ manufacturer? **At a manufacturer above $50M in revenue, sign-off usually sits with the CFO, because a spend audit touches vendor relationships and AP process outside the Controller's direct authority. The Controller's job is not to seek approval for an investigation. It is to bring the CFO a decision that is already scoped: a defined set of categories, a fixed engagement window, and a cost the CFO can compare against the size of the residual already shown.** A CFO evaluating this request is weighing two things: whether the finding is real, and whether the process of finding it will disrupt AP, procurement, or vendor relationships during it. The Controller's evidence package answers the first question. The scope answers the second. Scope should name the categories in question, freight, contract labor, MRO, IT and professional services, rather than propose a blanket review of everything the company buys. A named scope is easier to approve because it is easier to say no to later if it does not deliver. The Controller should also be honest about what they cannot answer: how much will actually be recovered, and how long it will take internal AP staff to do this work themselves without disrupting close. Those are legitimate open questions, not weaknesses in the case. ## 4. What belongs in the business case document? **A one-page business case for a spend audit needs four sections: the symptom (the margin bridge residual), the mechanism (what AP checks today and what it structurally cannot check), the ask (a fixed-scope diagnostic against named categories, delivered on a stated timeline), and the alternative (what happens if nothing changes, stated plainly rather than dramatically). A CFO should be able to read it in five minutes and know what decision is being requested.** Keep the symptom section to the bridge and nothing else. Resist the urge to attach every invoice anomaly the Controller has ever noticed; three clear examples carry more weight than twenty scattered ones. The mechanism section is where the Controller earns credibility. Stating plainly that three-way matching does not test a rate card or a surcharge condition shows the CFO this is a structural gap, not a staffing failure, which changes the conversation from blame to process. The ask should specify categories and a delivery window rather than an open-ended engagement. The alternative section should avoid urgency language and simply state the mechanical fact: unexamined vendor terms do not self-correct, and the residual in the bridge will recur next quarter under the same conditions that produced it this quarter. ## 5. How does a Controller quantify the size of the opportunity before the audit runs? **Before an audit runs, a Controller cannot cite a specific recovery figure. What can be quantified is the exposure: total service vendor spend across the categories in question, multiplied by the share the Controller believes is under-monitored today. That calculation gives the CFO a ceiling to reason against, framed explicitly as a scoping estimate rather than a finding, because no finding exists yet.** The honest way to present this is algebraic, not numeric. Take total annual spend in freight, contract labor, MRO, and IT and professional services combined. That figure alone, compared against total operating cost, is usually enough to justify a scoped look, without needing to guess at a recovery rate. Resist the temptation to attach a percentage estimate that sounds precise but is not sourced to anything the company has measured. A CFO who later finds that number was invented will discount everything else in the case. What can be cited is the delivery structure: a fixed-scope engagement produces a prioritized recovery and prevention roadmap in 2 to 4 weeks, across ValueXPA diagnostics. That is a claim about the process, not a promise about the number it will produce, and it is the honest way to give the CFO a timeline to plan around. ## 6. What should a Controller do if the CFO says no? **A no is usually a timing or evidence objection, not a permanent rejection. The Controller's response is to keep building the margin bridge every close cycle so the residual either resolves on its own, which answers the question, or persists and compounds, which strengthens the case each quarter. Reopening the request with a bigger, more specific residual and a tighter invoice sample is more effective than repeating the same ask.** A CFO declining the first ask is often declining the scope or the timing, not the premise. Post-acquisition integration, a system migration, or a tight quarter close can all be legitimate reasons to wait, and the Controller should ask directly which of those it is rather than assuming the case itself was rejected. In the interim, the bridge itself is free to maintain. Each month it is rebuilt, the residual either shrinks, which means the original concern was noise, or it persists, which means the case gets stronger without any new work beyond what close already requires. When the Controller returns, bring the updated bridge and a larger invoice sample rather than reopening the same document. A case that has compounded over two or three quarters is harder to decline a second time, because it is no longer a suspicion. It is a trend line. For the wider pattern this sits inside, start with the [margin drift](/insights/margin-drift-spend-leakage-guide) guide. See also [the six categories drift hides in](/insights/indirect-spend-audit-categories) and [what is margin erosion? causes and prevention for manufacturers](/insights/what-is-margin-erosion-causes-and-prevention-for). ## 7. Frequently Asked Questions (People Also Ask) ### What is the first document a Controller should prepare? A gross margin bridge that separates price and volume from everything else. If those two factors explain the full movement in margin, there is no case yet. If a residual remains after both are accounted for, that residual is the starting evidence for the rest of the case. ### Does the Controller need CFO approval before pulling invoice samples? No. Reviewing a handful of existing invoices against their contracts is normal AP oversight and does not require sign-off. Approval becomes necessary only when the Controller wants to commission a broader, resourced engagement across categories. ### Can a Controller build this case without new software? Yes. The evidence, a margin bridge, a short invoice sample, and a description of what the current AP process checks, comes from data already available in the ERP and existing contract files. No new system is required to build the case itself. ### How is this different from asking procurement to renegotiate vendor rates? Renegotiation addresses whether the contracted rate is competitive. A spend audit addresses whether the billed rate matches the rate already agreed to. The two are separate problems with separate owners, and a Controller should name which one they are raising. ### What if the margin bridge residual is small? A small residual is still worth documenting, but it changes the ask. Instead of proposing a full diagnostic, the Controller can propose a narrower look at the one or two categories driving the residual, which is an easier approval and still tests the underlying concern. ### Should the Controller name a target recovery figure in the business case? No. Without a completed diagnostic there is no sourced basis for a specific recovery number. The business case should state total exposure across the categories in question and let the audit itself produce the figure. ### How long should the Controller expect the audit to take once approved? A fixed-scope diagnostic delivers a prioritized recovery and prevention roadmap in 2 to 4 weeks, across ValueXPA diagnostics. The Controller can use this window directly in the business case as the delivery commitment being requested. ### What if AP pushes back, believing this questions their work? Frame the gap as structural, not a performance issue. Three-way matching checks an invoice against a purchase order and a receipt. It was never designed to test a rate card or a surcharge's expiration condition, so finding drift there is not a finding against AP's diligence. ### Is this case different at a multi-entity manufacturer? The bridge and invoice evidence still apply, but exposure calculations should be built entity by entity before rolling up, since vendor terms and volume tiers often differ by entity even under one master contract. ### What happens if the Controller raises this and nothing changes? The residual in the margin bridge typically persists into the next close cycle, since the conditions producing it, unmonitored invoice-to-contract matching, have not changed. Documenting that persistence over successive quarters is itself useful evidence for a second ask. ### Is contract complexity quietly draining your operating margin? A small systematic drift between your negotiated contracts and your actual vendor billing compounds quietly across a year of invoices. Stop guessing at your exposure and run a targeted audit. **[Take the Free Screener → https://valuexpa.com/margin-drift-screener](https://valuexpa.com/margin-drift-screener)** ## Executive Summary A Controller does not need certainty to build the case for a spend audit. They need three things a CFO will act on: a named symptom, a bounded cost of finding out, and a scope that does not require new headcount or a new system. The symptom is usually a [gross margin bridge](/insights/building-a-gross-margin-bridge-that-separates-inflation-from) that will not close against price and volume alone. The bounded cost is the difference between a fixed-scope diagnostic and an open-ended internal project with no end date. The mechanism that makes the case land is separating two different problems that get treated as one. Three-way matching in the ERP confirms an invoice matches a purchase order and a receipt. It does not confirm the rate on that invoice matches the rate card, or that a surcharge condition has actually expired. A Controller who can show that distinction, in writing, with a small set of invoice examples, has done the hard part of the case already. What changes the decision is framing the audit as a bounded, reversible cost rather than an open commitment. A fixed-scope diagnostic with a stated delivery window is a different ask than "let's investigate this." The Controller's job is to present it that way, with the evidence that makes the delivery window credible. ## 1. What evidence does a Controller need before raising this? A Controller needs three artifacts before raising a spend audit: a gross margin bridge that shows an unexplained residual after price and volume are accounted for, a short list of specific invoices where the billed rate does not match the contracted rate, and a one-line description of what the current AP process actually checks. None of these require new tools or new access. All three come from data the Controller already closes the books against every month. The gross margin bridge is the anchor. If price and volume explain the movement in gross margin, there is no case. If they do not, the residual has a name: cost, and cost hides in vendor terms more often than in production. The invoice examples matter because they are concrete. A CFO who hears "we think we're being overbilled" hears an opinion. A CFO who sees three invoices where the rate on the page does not match the rate in the contract sees a fact, and facts do not need to be argued with. The process description closes the loop: it explains why AP did not catch this. Three-way matching checks the invoice against the purchase order and the receipt. It does not check the invoice against the rate card, the volume tier, or a surcharge's expiration date. That is a description of what the control does, not a criticism of the AP team. ## 2. How does a Controller separate a pricing problem from a compliance problem? A pricing problem is a rate that was negotiated up. A compliance problem is a rate that was negotiated correctly but billed incorrectly. The distinction decides who owns the fix: pricing changes belong to procurement and category managers, while compliance drift belongs to the invoice-to-contract matching that AP does not currently perform. A Controller who conflates the two will get the wrong owner assigned and the case will stall. This separation is what makes the case actionable instead of political. If the Controller frames rising service costs as a negotiation failure, the response is a renegotiation project owned by procurement, months long, with no guarantee the new rate will be honored either. If the Controller frames it as a compliance gap, the response is narrower: check whether the rates already agreed to are the rates already being billed. That is a checkable, bounded question, not a renegotiation. Both problems can exist at once. But naming them separately lets the Controller ask for the smaller, faster thing first: confirm compliance before opening a pricing conversation that may not be necessary. ### A. Pricing drift The contract itself no longer reflects market terms or the volume the company now runs. Fixing this requires a renegotiation, owned by procurement or category management, and it takes as long as any vendor negotiation takes. ### B. Compliance drift The contract terms are fine, but the invoice does not follow them: a rate card that reverted to list price, a surcharge that outlived its trigger condition, a volume tier that was never applied. This is a matching problem, not a negotiation problem, and it is what a spend audit is built to find. ## 3. Who signs off on a spend audit at a $50M+ manufacturer? At a manufacturer above $50M in revenue, sign-off usually sits with the CFO, because a spend audit touches vendor relationships and AP process outside the Controller's direct authority. The Controller's job is not to seek approval for an investigation. It is to bring the CFO a decision that is already scoped: a defined set of categories, a fixed engagement window, and a cost the CFO can compare against the size of the residual already shown. A CFO evaluating this request is weighing two things: whether the finding is real, and whether the process of finding it will disrupt AP, procurement, or vendor relationships during it. The Controller's evidence package answers the first question. The scope answers the second. Scope should name the categories in question, freight, contract labor, MRO, IT and professional services, rather than propose a blanket review of everything the company buys. A named scope is easier to approve because it is easier to say no to later if it does not deliver. The Controller should also be honest about what they cannot answer: how much will actually be recovered, and how long it will take internal AP staff to do this work themselves without disrupting close. Those are legitimate open questions, not weaknesses in the case. ## 4. What belongs in the business case document? A one-page business case for a spend audit needs four sections: the symptom (the margin bridge residual), the mechanism (what AP checks today and what it structurally cannot check), the ask (a fixed-scope diagnostic against named categories, delivered on a stated timeline), and the alternative (what happens if nothing changes, stated plainly rather than dramatically). A CFO should be able to read it in five minutes and know what decision is being requested. Keep the symptom section to the bridge and nothing else. Resist the urge to attach every invoice anomaly the Controller has ever noticed; three clear examples carry more weight than twenty scattered ones. The mechanism section is where the Controller earns credibility. Stating plainly that three-way matching does not test a rate card or a surcharge condition shows the CFO this is a structural gap, not a staffing failure, which changes the conversation from blame to process. The ask should specify categories and a delivery window rather than an open-ended engagement. The alternative section should avoid urgency language and simply state the mechanical fact: unexamined vendor terms do not self-correct, and the residual in the bridge will recur next quarter under the same conditions that produced it this quarter. ## 5. How does a Controller quantify the size of the opportunity before the audit runs? Before an audit runs, a Controller cannot cite a specific recovery figure. What can be quantified is the exposure: total service vendor spend across the categories in question, multiplied by the share the Controller believes is under-monitored today. That calculation gives the CFO a ceiling to reason against, framed explicitly as a scoping estimate rather than a finding, because no finding exists yet. The honest way to present this is algebraic, not numeric. Take total annual spend in freight, contract labor, MRO, and IT and professional services combined. That figure alone, compared against total operating cost, is usually enough to justify a scoped look, without needing to guess at a recovery rate. Resist the temptation to attach a percentage estimate that sounds precise but is not sourced to anything the company has measured. A CFO who later finds that number was invented will discount everything else in the case. What can be cited is the delivery structure: a fixed-scope engagement produces a prioritized recovery and prevention roadmap in 2 to 4 weeks, across ValueXPA diagnostics. That is a claim about the process, not a promise about the number it will produce, and it is the honest way to give the CFO a timeline to plan around. ## 6. What should a Controller do if the CFO says no? A no is usually a timing or evidence objection, not a permanent rejection. The Controller's response is to keep building the margin bridge every close cycle so the residual either resolves on its own, which answers the question, or persists and compounds, which strengthens the case each quarter. Reopening the request with a bigger, more specific residual and a tighter invoice sample is more effective than repeating the same ask. A CFO declining the first ask is often declining the scope or the timing, not the premise. Post-acquisition integration, a system migration, or a tight quarter close can all be legitimate reasons to wait, and the Controller should ask directly which of those it is rather than assuming the case itself was rejected. In the interim, the bridge itself is free to maintain. Each month it is rebuilt, the residual either shrinks, which means the original concern was noise, or it persists, which means the case gets stronger without any new work beyond what close already requires. When the Controller returns, bring the updated bridge and a larger invoice sample rather than reopening the same document. A case that has compounded over two or three quarters is harder to decline a second time, because it is no longer a suspicion. It is a trend line. For the wider pattern this sits inside, start with the [margin drift](/insights/margin-drift-spend-leakage-guide) guide. See also [the six categories drift hides in](/insights/indirect-spend-audit-categories) and [what is margin erosion? causes and prevention for manufacturers](/insights/what-is-margin-erosion-causes-and-prevention-for). ## Common questions ### What is the first document a Controller should prepare? A gross margin bridge that separates price and volume from everything else. If those two factors explain the full movement in margin, there is no case yet. If a residual remains after both are accounted for, that residual is the starting evidence for the rest of the case. ### Does the Controller need CFO approval before pulling invoice samples? No. Reviewing a handful of existing invoices against their contracts is normal AP oversight and does not require sign-off. Approval becomes necessary only when the Controller wants to commission a broader, resourced engagement across categories. ### Can a Controller build this case without new software? Yes. The evidence, a margin bridge, a short invoice sample, and a description of what the current AP process checks, comes from data already available in the ERP and existing contract files. No new system is required to build the case itself. ### How is this different from asking procurement to renegotiate vendor rates? Renegotiation addresses whether the contracted rate is competitive. A spend audit addresses whether the billed rate matches the rate already agreed to. The two are separate problems with separate owners, and a Controller should name which one they are raising. ### What if the margin bridge residual is small? A small residual is still worth documenting, but it changes the ask. Instead of proposing a full diagnostic, the Controller can propose a narrower look at the one or two categories driving the residual, which is an easier approval and still tests the underlying concern. --- ValueXPA runs a fixed-scope Margin Drift Diagnostic that validates every service vendor invoice against contract terms, for $100M+ US industrial manufacturers and distributors. Two to four weeks. The client retains 100% of recoveries. https://valuexpa.com/contact-us