What documents do you need to audit contract labor?

Executive Summary

A contract labor audit rests on matching five documents against each other: the master service agreement, the current rate card, the approved timesheet, the purchase order or requisition, and the invoice. Each one answers a different question. The MSA sets the rules.

The rate card sets the price. The timesheet proves the hours. The requisition proves the role was authorized.

The invoice is the only one that has to reconcile against all four of the others.

The mechanism behind most findings is not fraud. It is that these documents live in different systems and get updated at different times, with nobody assigned to keep them in sync. A bill rate negotiated last quarter can still sit on the invoice template this quarter.

A worker approved for a junior role can get billed at a senior rate because nobody checked the requisition against the timesheet before it was signed.

Getting these documents into one place before starting the review is what separates a real audit from a spot check. Missing even one of them turns the exercise into checking arithmetic on a document that may already be wrong.

1. What is the master service agreement used for?

The master service agreement is the reference document every other check runs against. It defines bill rate structures, markup formulas, overtime and holiday multipliers, conversion fees, minimum engagement lengths, and notice periods. Without it, an auditor has no basis for calling any invoice line wrong.

It is the single document that makes every other comparison possible, so it is the first one to collect, not the last.

The MSA rarely states a flat dollar rate. It states a formula: a pay rate plus a markup percentage, or a bill rate band by job category and experience level. That formula is what the rate card and the invoice both have to satisfy.

MSAs also carry clauses that never appear on an invoice line but change what should be billed: a cap on markup increases, a requirement to re-bid rates annually, or a clause voiding overtime billing for exempt roles. An auditor who has not read the MSA will not know these clauses exist, let alone check for them.

When the MSA cannot be located, the audit has to fall back on whatever rate card or invoice history exists, which is a weaker basis and should be labeled as such in the findings rather than treated as equivalent.

2. What does the rate card need to show?

The rate card is the negotiated price list: a bill rate for each job title, level, and sometimes location, current as of a stated date. An audit needs the version in effect for the invoice period being reviewed, not the most recent one on file. Vendors update rate cards; if the version used for comparison postdates the invoice, every line will look wrong when it may not be.

Rate cards go stale in a specific way: procurement negotiates a change, the vendor's internal systems get updated, and the version stored in the client's contract file does not. An auditor comparing an invoice to an outdated rate card will find drift that is not real drift, and comparing it to a card that is too new hides drift that is real.

Date-stamping the rate card and confirming which version governs the invoice period is a mechanical step, but it is the one most often skipped because it feels like paperwork rather than analysis.

See rate card enforcement: why approved timesheets still produce wrong invoices for how a correct rate card and a correctly approved timesheet can still combine into a wrong invoice.

3. Why do timesheets matter more than the invoice total?

The timesheet is the only document that proves hours were actually worked and approved by a named supervisor. The invoice total is a summary; the timesheet is the underlying record. An audit needs the timesheet detail, not just the approval stamp, because approval workflows can pass a timesheet through without anyone checking the hours against the role, the shift, or the rate applied to them.

A supervisor approving a timesheet is usually confirming that a worker showed up, not confirming that the bill rate applied to those hours matches the requisitioned role. Those are two different checks, and only one of them happens by default in most approval workflows.

Timesheets also carry the detail an invoice summary strips out: start and end times, shift differentials, overtime flags. An invoice line that reads "160 hours, standard rate" can be hiding hours that should have been billed at an overtime or shift-differential rate, or the reverse.

Without the timesheet detail, an auditor is checking whether the invoice matches itself, which it almost always will.

4. What does the requisition or purchase order confirm?

The requisition or purchase order is the record of what was actually authorized: the role, the level, the start date, the approved rate, and often an end date or budget cap. It is the document that lets an auditor tell the difference between a worker who is on contract and one who is being billed without a current authorization on file.

Staffing engagements extend past their original end date more often than the paperwork does. A requisition approved for a six-month engagement can still be generating invoice lines eight months later with no updated authorization behind it.

The requisition is also where role and level get set. If the timesheet shows a worker performing senior-level tasks but the requisition authorized a junior role, that is a mismatch the invoice alone will never surface, because the invoice simply reflects whatever rate the vendor's system applied.

For the pattern where billing continues without a matching authorization at all, see off-contract resources: people billed outside the agreement.

A. Requisition vs. purchase order

Some organizations use a requisition as an internal approval and a separate purchase order as the vendor-facing authorization. Where both exist, an audit needs both, because a requisition can be approved internally and never converted into a PO the vendor actually received, leaving billing running against an informal agreement.

5. How do you handle credit memos and adjustment history?

Credit memo and adjustment history shows whether previously identified errors were actually corrected or only acknowledged. An invoice audit that stops at the current billing period will miss a rate error the vendor agreed to fix three invoices ago but never applied. Collecting this history turns single-invoice checking into a check on whether corrections stick.

A vendor can issue a credit memo for one invoice and quietly let the same error recur on the next one, particularly when the correction was manual and the underlying rate table in the vendor's billing system was never updated.

Without adjustment history, an auditor reviewing only the current invoice has no way to know an error is a repeat rather than a first occurrence, which changes how it should be reported and how urgently it needs a system-level fix rather than a one-time credit.

This history is usually the easiest of the five documents to gather, since it typically lives in the same AP system as the invoices themselves, but it is the one most often left out because the audit request only asks for the current period.

6. What happens when one of these documents is missing?

A missing document does not stop an audit; it changes what the audit can conclude. Without an MSA, rate checks default to invoice history as a weaker baseline. Without a current requisition, authorization cannot be confirmed at all. The finding should state which documents were unavailable and how that limits the conclusion, rather than presenting a partial check as a complete one.

Treating a missing document as a blocker stalls the audit indefinitely, since staffing vendors and internal procurement records are rarely perfectly filed. Treating it as irrelevant produces a finding that looks precise but rests on an assumption nobody stated.

The workable middle path is to note the gap explicitly: "rate card version could not be confirmed for this period; comparison uses the most recent version on file, dated [x]." That single sentence is the difference between a defensible finding and one that unravels the first time someone asks where the number came from.

What may look like invoice-level drift can also be an industry-wide cost shift rather than a vendor error. The Bureau of Labor Statistics Producer Price Index for employment services stood at 175.559 in July 2026, up 5.3% year over year (BLS PPI series PCU5613--5613--, read 2026-09-04), so a rising bill rate is not automatically a contract violation without checking it against the MSA's rate change clause first.

For the wider pattern this sits inside, start with the margin drift guide. See also accessorial charge audit: the surcharges nobody validates and rate card enforcement: why approved timesheets still produce wrong invoices.

7. Frequently Asked Questions (People Also Ask)

Do we need the vendor's internal timesheet system or just the exported hours?

The exported hours are usually enough for a first pass, but if a line looks wrong, going back to the source system matters, since exports sometimes strip shift or overtime flags that explain the discrepancy. Ask the vendor for raw timesheet detail, not just a summary total, for any line under dispute.

What if the MSA has been amended multiple times?

Collect the amendments along with the base agreement and confirm which version was in effect for the invoice period. Amendments often change rate structures or markup caps without replacing the original document, so the current terms can be spread across several files rather than one.

Can we audit contract labor invoices without a purchase order system?

Yes, but authorization has to be confirmed some other way, usually a signed requisition or an email approval chain. Without either, the audit can still check rate and hour accuracy against the MSA and timesheet, but it cannot confirm the engagement itself was authorized.

How far back should adjustment history go?

Far enough to cover at least one full rate card cycle, so a recurring error has a chance to show up more than once. For most staffing agreements that means 12 to 18 months, which is also the window across ValueXPA diagnostics for identifying leakage already embedded in historical spend.

Who should own gathering these documents before an audit starts?

Whoever owns the vendor relationship, usually procurement or AP, should assemble the MSA, rate card, and PO records, while the operational manager who approves timesheets supplies the hours detail. Splitting the collection this way is faster than routing every request through one person.

What if the rate card and the MSA disagree with each other?

The MSA governs unless it explicitly delegates rate-setting to a separate rate card document, which many agreements do. Read the MSA's rate clause first to see whether it references the rate card as binding or only as a working reference, since that changes which document wins a dispute.

Does this document list change for master service agreements with multiple staffing suppliers?

The document types stay the same, but each supplier needs its own set, since rate cards and requisitions are supplier-specific even under one umbrella MSA. Comparing one supplier's invoice against another supplier's rate card is a common and avoidable error.

Is a signed timesheet enough proof the billed role was correct?

A signature confirms hours were worked, not that the billed role and rate match what was requisitioned. Those need to be checked against the requisition separately, since the approval workflow for hours and the approval for role and rate are often two different steps handled by two different people.