Preparing IT and professional services audit data

Executive Summary

IT and professional services invoices are hard to audit because the terms that govern them live in prose, not in a structured rate table. A master service agreement sets a rate card, a statement of work narrows it to a project, and a change order moves the goalposts again, often without anyone updating the original file. The invoice cites none of this. It just states a number.

Preparing this category for audit means building the missing structure yourself: one file per engagement, mapping every SOW and change order to its current rate and cap, matched against the vendor and cost center each invoice actually posts to. Without that mapping, an auditor is reading a stack of PDFs with no way to tell a correct invoice from an overrun.

The work is mechanical, not technical. It does not require new software. It requires someone to read the contract documents once, record what they actually say, and hold that record against every invoice going forward. That record is also what a forward control, once put in place, needs to enforce.

1. Which documents actually need to be collected before an audit can start?

An IT and professional services audit needs four document types per vendor: the master service agreement, every statement of work issued under it, every change order or amendment, and the last 12 to 18 months of invoices and timesheets. Missing any one of these breaks the chain between what was agreed and what was billed, and the invoice cannot be checked against anything.

Start with the master service agreement (MSA). It usually sets the base rate card, the markup structure for pass-through expenses, and any not-to-exceed language that applies across all work ordered under it.

Next, pull every statement of work issued under that MSA, not just the current one. A vendor relationship that has run for several years often has SOWs stacked on top of each other, some closed, some still technically open because nobody terminated them on paper.

Then collect every change order, amendment, or rate exception. These are the documents most likely to be missing, because they are frequently approved by email or verbal agreement and never filed alongside the SOW they modify.

Finally, pull invoices and, where the engagement is time and materials, the underlying timesheets or staffing reports for the same period. An invoice with no timesheet behind it cannot be checked against a rate card at all; it can only be checked against itself.

2. How do you organize SOWs and change orders once you have them?

Build one record per active engagement that lists the current billing rate for each role, any cap or not-to-exceed ceiling, the billing period, and the specific change order that last modified the terms. This single-record view is what an invoice gets checked against; the original PDFs stay as backup, not as the working reference.

A folder of PDFs is not a control. Someone has to read each SOW and change order once and translate it into a short record: vendor, engagement name, role and rate, cap if any, effective dates, and which document is currently governing.

Where a change order raises a rate or extends a cap, the record should show the old term and the new one, with the date the change took effect. This matters because an invoice dated before the change order's effective date should still be billing the old rate, and one dated after should reflect the new terms exactly.

Keep this record at the engagement level, not the vendor level. A single vendor often runs several concurrent SOWs with different rates for different roles, and collapsing them into one vendor-level rate card is how a legitimate higher rate on one engagement gets mistaken for an overbilling on another.

3. What invoice fields does this category need that others do not?

Beyond vendor, amount, and date, an IT and professional services invoice needs the role or resource name billed, the rate applied, the hours or units, the SOW or purchase order it bills against, and any expense pass-through with its markup shown separately from the fee. Each of these fields is what lets the invoice be checked against the engagement record rather than accepted on its face.

A freight invoice can be checked with a handful of fields: origin, destination, weight, and accessorial codes. Professional services invoices carry more context because the same dollar figure can be correct or wrong depending on who did the work and under which SOW.

At minimum, extract the resource or role name, the billing rate, hours or units billed, and the SOW or purchase order number the invoice references. Where the vendor bundles multiple resources on one line, ask for a supporting detail sheet; a lump-sum professional services line cannot be checked against a rate card at all.

Expense pass-throughs, travel, software licenses purchased on the client's behalf, subcontractor fees, need their own line with the markup shown. A contract that caps markup at a stated percentage cannot be enforced against an invoice that folds the markup into a single number.

4. How do you handle staff augmentation and time-and-materials work differently from fixed-fee SOWs?

Time-and-materials and staff augmentation engagements need timesheets or staffing reports as supporting evidence for every invoice; fixed-fee SOWs need milestone or deliverable acceptance records instead. Preparing the wrong evidence type for the wrong engagement means the invoice cannot be checked against what the contract actually requires, and the review stalls on a document that was never going to exist.

These two contract types fail differently, so they need different preparation.

For time-and-materials and staff augmentation, the invoice should tie to a timesheet or a staffing report naming the individual, their role, and the hours worked in the period. Without that document, an auditor is checking the invoice's math against itself, not against evidence of work performed.

For fixed-fee SOWs, hours are not the control point. What matters is whether the invoice corresponds to a milestone that was actually accepted, and whether the accepted deliverable matches what the SOW defines as billable at that stage. Collect the acceptance sign-off, not a timesheet, for these engagements.

A preparation error worth watching for is requesting timesheets for a fixed-fee engagement and getting none, then treating the absence as a red flag. It means the wrong evidence type was requested for that contract structure, and the SOW's milestone schedule should have been pulled instead.

5. What role does the vendor master play in preparing this data?

Check the vendor master for duplicate vendor records before mapping SOWs to invoices, because a single IT services vendor billed under two vendor IDs will show two partial rate histories instead of one complete one, making legitimate rate progression look like inconsistent billing. This check belongs before contract mapping starts, not after questions about billing patterns already surface.

IT and professional services vendors are among the most likely to appear under more than one vendor record: a parent entity, a regional subsidiary, an acquired company still invoicing under its old name. Each variant may have its own vendor ID in the ERP.

Before mapping contracts to invoices, pull every vendor record that could plausibly be the same counterparty and confirm which SOWs and change orders belong to which. Missing this step splits one vendor's billing history across two records, and neither one alone shows the full pattern.

This check also surfaces engagements where the same individual consultant is billed through two different reseller or staffing vendors on overlapping dates, a pattern that only becomes visible once the vendor master is consolidated. See vendor master hygiene and the duplicate vendor problem for how to run that check.

6. What should the final data package look like before an auditor opens it?

The finished package is one folder per vendor containing the MSA, the current engagement record built from SOWs and change orders, invoices with role, rate, and hours extracted, and matched timesheets or acceptance records for the audit period, typically 12 to 18 months. Organized this way, the invoice can be checked line by line without a single contract PDF reopened.

By the time preparation is done, an auditor should never need to open a raw contract PDF to check a single invoice line. The engagement record built earlier carries the current rate and cap; the invoice extract carries what was billed; the timesheet or acceptance record carries the evidence.

Organize by vendor first, then by engagement, then by invoice period. Include a short note on any engagement where the governing document is ambiguous, for example where a change order's effective date is unclear or a rate exception was approved verbally and only documented later.

Worked example, using the 1% to 3% band: take your annual IT and professional services spend, multiply by the share running as time-and-materials rather than fixed-fee, and that product is the base against which a rate-card control has something to find. The exact recovery depends on your own contract terms and billing history, not a general figure.

This package is also the input a forward control needs. Once the engagement records exist, checking a new invoice against them is the same comparison, run before payment instead of after. See continuous enforcement vs. periodic audit: choosing a cadence for how that shift works.

For the wider pattern this sits inside, start with the margin drift guide. See also n-way invoice matching explained and price file governance: why annual uploads create twelve months of drift.

7. Frequently Asked Questions (People Also Ask)

How far back should we pull invoices and timesheets for this category?

12 to 18 months is the typical review window, since it is long enough to catch a rate exception that was never applied consistently and short enough to keep the reconciliation manageable. Pull the SOWs and change orders covering that full window, not just the ones currently active, so the invoice history lines up with the terms that governed it at the time.

What if a change order was only approved by email, not a signed document?

Treat the email as the governing document until a formal amendment replaces it. Record its date and terms in the engagement record the same way you would a signed change order, and note in the package that the authorization is an email rather than a signed instrument, so the auditor knows what kind of evidence it is.

Can this preparation work be done inside the ERP alone, without pulling contracts into a separate file?

No. An ERP holds the invoice and the purchase order, not the SOW language or the change order history. The engagement record described here has to be built outside the ERP, from the actual contract documents, then held alongside the ERP data during the review.

What happens if a vendor refuses to provide timesheets for a time-and-materials engagement?

Without timesheets, a time-and-materials invoice cannot be checked against evidence of work performed, only against its own stated total. Flag the engagement as unverifiable for that period and treat future invoices as conditional on timesheet delivery going forward.

Does this same preparation process apply to staffing agency invoices?

Yes. Staffing agency invoices are a form of time-and-materials billing, so they need the same rate, role, and hours fields, and the same timesheet-level evidence. The vendor master check matters even more here, since staffing agencies frequently place the same individual through more than one legal entity.

Who inside the company should own building the engagement record?

Whoever manages the vendor relationship, usually someone in IT or procurement, is best positioned to read the SOWs and change orders correctly, since they understand the scope. AP can then hold and apply the resulting record against invoices as they arrive.

What if two SOWs for the same vendor cover overlapping dates?

Overlapping SOWs are common when a new statement of work is issued before an old one is formally closed. Record both in the engagement file with their own rates and caps, and confirm with the business owner which SOW a given invoice period should actually bill against before flagging a discrepancy.

Is this preparation work different for a fixed-price retainer versus a project SOW?

A retainer is closer to a fixed-fee structure: the control point is whether the retainer's defined scope was delivered in the period, not hours worked. Collect the retainer's scope definition and any monthly deliverable confirmation the same way you would collect milestone acceptance for a project SOW.