# What to ask procurement before an external audit

> A pre-audit checklist for procurement: contracts, rate cards, PO files, and vendor master data to pull before an outside team arrives. Read the full guide.

Source: https://valuexpa.com/insights/what-to-ask-procurement-before-an-external-audit
Publisher: ValueXPA (https://valuexpa.com)
Updated: 2026-09-06

---

Margin drift is the gap between what a vendor contract says and what the invoice actually charges. An external audit finds that gap fastest when procurement has already assembled the records it depends on, and finds it slowest, or not at all, when the auditor spends the first two weeks chasing down contracts nobody can locate.

This guide is a checklist, not a diagnosis. It is what to ask procurement to pull, confirm, and flag before an outside team opens a single invoice, so the engagement spends its time finding drift instead of finding documents.

## Executive Summary

An external audit runs on records procurement holds: signed contracts, current rate cards, the vendor master file, and the purchase order history that ties invoices to approved terms. When those records are incomplete, undated, or scattered across email threads and shared drives, the audit's early weeks go to reconstruction instead of testing. The fix is not a bigger audit team. It is a short internal pass, run by procurement before the audit starts, that surfaces which contracts are missing, which rate cards are stale, and which vendors have no file at all.

The mechanism is simple: an auditor can only test an invoice against the terms it can find. A missing amendment, an unsigned renewal, or a rate card that was updated by email and never filed all produce the same result, a finding the auditor cannot substantiate and therefore cannot report. Procurement is the only function that knows where those gaps are before anyone starts looking.

What changes the outcome is turning that internal knowledge into a checklist procurement runs against every active vendor: contract status, rate card currency, PO-to-invoice linkage, and who owns each vendor relationship. Running it before the audit starts converts unknown gaps into a known list, and a known list is something an audit can work around instead of getting stuck on.

## 1. What should you check before an external audit?

**Before an external audit starts, confirm four things with procurement: every active vendor has a signed, current contract on file; rate cards match the latest signed terms, not an older or verbal update; purchase orders reference the correct contract number; and one named person owns each vendor relationship and can answer questions during the engagement. Gaps in any of these four slow the audit down before it reaches a single invoice.**

Each of the four checks maps to a different failure mode. A missing signed contract means the auditor has no reference document to test against, so any invoice for that vendor gets set aside rather than tested. A stale rate card means the auditor tests against terms that were superseded, which produces a finding that turns out to be wrong once the correct version surfaces.

A PO that does not reference the governing contract number breaks the chain an auditor needs to connect an invoice back to its terms; without it, matching becomes manual and slow. And a vendor with no named internal owner means questions about intent, side agreements, or verbal exceptions go unanswered, because nobody in the building remembers making them.

Running these four checks is a procurement task, not an audit task. It takes days, not weeks, because procurement already knows where its own files are thin. Doing it before the audit starts means the audit's first week is spent testing invoices instead of tracking down which contracts exist.

## 2. Which contracts and amendments does procurement need to produce?

**Procurement needs to produce the base contract, every signed amendment, and any side letter or email confirmation that changed a rate, term, or scope, for every vendor the audit will cover. A contract without its amendments looks complete but tests against outdated terms, which is worse than an admitted gap because it produces a finding that later has to be retracted.**

The base agreement is rarely the problem. Amendments are, because they are frequently negotiated by a category manager, confirmed by email, and never routed back into the contract file. A rate reduction agreed months earlier and never filed means the audit tests the invoice against the original, higher rate and reports overbilling that is not real.

Ask procurement to produce, per vendor: the base contract, a dated list of every amendment, and copies of any email or letter that changed pricing, volume tiers, or service scope even if it was never formalized into a signed amendment. Flag anything verbal or undocumented as its own category rather than omitting it, because the auditor needs to know a gap exists even when it cannot be closed before the engagement starts.

### A. Base contract and renewal status

Confirm the contract is still active, has not lapsed into a month-to-month or auto-renewal state with different terms, and matches the vendor name currently used on invoices. Vendor name changes after a merger or rebrand are a common source of mismatched files.

### B. Amendments and side letters

List every amendment with its effective date and confirm each is signed, not just referenced in an email chain. An amendment discussed but never executed does not change the governing rate, and the audit needs to know which category it falls into.

## 3. How current does the rate card need to be?

**The rate card procurement hands to the audit needs to match the most recent signed terms, dated, and attributed to the document that authorizes it, not to a spreadsheet someone updated from memory. An undated or unattributed rate card cannot be used to test an invoice, because the auditor cannot show which version governed the invoice date in question.**

Rate cards drift from contracts in a specific way: a category manager negotiates a new rate, updates the internal spreadsheet, and the change never gets attached to a signed amendment. The spreadsheet is accurate. It is also unusable as audit evidence, because nothing ties it back to an executed document.

Ask procurement to reconcile the working rate card against the contract file for every vendor before the audit starts, and to flag any rate that exists in the spreadsheet but not in a signed document. That flag is useful information on its own. It tells the audit team where verbal or informal pricing changes have taken hold, which is itself a control gap worth reporting alongside any dollar finding.

## 4. Why does PO-to-contract linkage matter for the audit?

**Purchase order linkage matters because it is how an auditor connects an invoice to the contract that should govern it. When a PO carries no contract reference, or references the wrong one, the auditor has to match invoices to terms manually, vendor by vendor, which is the single biggest driver of a longer engagement timeline.**

Three-way matching checks the invoice against the PO and the receipt. It does not test whether the PO itself points to the correct, current contract. A PO can pass three-way matching cleanly and still authorize a rate that the contract superseded months earlier.

Ask procurement to sample a set of recent POs per major vendor and confirm each carries a contract or agreement number, and that the number matches an active, signed document. Where the PO system has no field for this, ask how the linkage is tracked instead, whether that is a shared spreadsheet, a category manager's memory, or nothing at all. Naming the actual mechanism, even an informal one, gives the audit team a starting point instead of a blank.

## 5. Who should own each vendor relationship during the audit?

**Each vendor needs one named internal owner, someone who negotiated or currently manages the relationship, who can answer questions about intent, exceptions, and undocumented agreements while the audit is underway. Without a named owner, questions sit unanswered and the audit either stalls or has to assume the worst interpretation of an ambiguous invoice.**

Vendor ownership fragments over time, especially after a reorganization, an acquisition, or simple staff turnover. A vendor's original point of contact may have left, and the person who inherited the relationship may only know it from the current invoice, not from the negotiation history behind it.

Build a one-page list before the audit starts: vendor name, current owner, and a backup contact if the owner is unavailable during the engagement window. This list does double duty. It speeds up every question the audit team has, and it is itself a piece of evidence about control strength, because a vendor with no identifiable owner is a vendor whose contract terms nobody is actively enforcing between audits.

- **Vendor name and owner:** The person who negotiates or manages the relationship today, not the original signer if that person has left.

- **Backup contact:** Someone who can answer basic questions if the primary owner is unavailable during the engagement.

- **Last renegotiation date:** When the relationship's terms were last actively reviewed, as distinct from when the contract auto-renewed.

- **Known exceptions:** Any verbal or informal arrangement the owner is aware of that differs from the written contract.

## 6. What should procurement flag before the audit starts, rather than wait to be asked?

**Procurement should proactively flag any vendor with an expired or unsigned contract, any rate card discrepancy it already knows about, any vendor consolidation from a past acquisition that never fully merged contract files, and any category where spend has grown without a corresponding contract review. Volunteering these up front is faster than an auditor finding them independently, and it shapes where the engagement spends its time.**

An audit team without guidance tests broadly across every vendor and category, which is thorough but slow. A procurement team that already knows where its own gaps sit can direct that effort toward the areas most likely to contain real drift, without pre-deciding the outcome.

This matters especially after a [vendor contract consolidation](/guides/post-acquisition-vendor-contract-consolidation), where vendor files from an acquired entity often sit unreconciled against the parent company's contract terms for months or years. It is also relevant wherever spend in a category has grown faster than the team managing it, since a rate negotiated for a smaller volume may never have been revisited once volume tiers were crossed.

A short written list, handed to the audit team on day one, of every known gap procurement is already aware of costs little to produce and materially shortens the time it takes the engagement to reach its first substantiated finding.

For the wider pattern this sits inside, start with the [margin drift](/guides/cfo-agenda-mid-market-manufacturing) guide. See also [the six categories drift hides in](/guides/indirect-spend-audit-categories) and [margin drift vs. legitimate price increases: how to tell them apart](/guides/margin-drift-vs-legitimate-price-increases-how-to-tell-them).

## 7. Frequently Asked Questions (People Also Ask)

### How far in advance should procurement start this checklist?

Two to three weeks before the audit begins, so gaps found in the first pass can be partly closed and the rest documented rather than discovered mid-engagement. Waiting until the audit starts to run this check means the audit absorbs the delay instead of procurement.

### What if a vendor genuinely has no signed contract on file?

Flag it rather than search for one that does not exist. An auditor treats an unwritten arrangement differently from a missing document, and knowing upfront that no contract exists lets the engagement move directly to testing invoices against actual purchase order history and vendor-confirmed pricing.

### Does this checklist apply the same way to every vendor category?

The four checks, contract status, rate card currency, PO linkage, named ownership, apply the same way across freight, MRO, contract labor, and professional services. Where gaps concentrate differs by category, which procurement will already know from its own experience with each one.

### Should procurement fix the gaps it finds before the audit starts?

Fix what can be fixed quickly, such as filing a signed amendment that already exists but was never routed to the contract file. Do not delay the audit trying to renegotiate or resolve every gap; document what cannot be closed in time and hand that list to the audit team.

### Who inside the company should run this checklist, procurement or finance?

Procurement, because it holds the vendor relationships and contract files. Finance or AP can support by pulling PO and payment history, but procurement is the only function that knows where a contract was negotiated informally or never fully filed.

### What happens if this preparation is skipped entirely?

The audit team spends its early time locating documents instead of testing them, which lengthens the engagement and can produce findings that later need correction once a missing amendment or updated rate card surfaces.

### Does a clean ERP system mean procurement can skip this checklist?

No. An ERP records what was entered, not whether the terms behind it are current or signed. A PO can be clean in the system and still reference a superseded rate if nobody updated the underlying contract file.

### Is this checklist specific to a full audit, or useful for a smaller review too?

It applies at any scale. Even a narrow review of one vendor category benefits from confirming the contract is signed, the rate card is current, and someone can answer questions about it before the review begins.

### What is the single most common gap procurement finds when it runs this check?

A rate change agreed by email or verbally, updated in an internal spreadsheet, but never attached to a signed amendment in the contract file. This produces a mismatch between what the team believes the rate is and what the signed document says.

### Is contract complexity quietly draining your operating margin?

A small systematic drift between your negotiated contracts and your actual vendor billing compounds quietly across a year of invoices. Stop guessing at your exposure and run a targeted audit.

**[Take the Free Screener → https://valuexpa.com/margin-drift-screener](https://valuexpa.com/margin-drift-screener)**

## Executive Summary

An external audit runs on records procurement holds: signed contracts, current rate cards, the vendor master file, and the purchase order history that ties invoices to approved terms. When those records are incomplete, undated, or scattered across email threads and shared drives, the audit's early weeks go to reconstruction instead of testing. The fix is not a bigger audit team. It is a short internal pass, run by procurement before the audit starts, that surfaces which contracts are missing, which rate cards are stale, and which vendors have no file at all. The mechanism is simple: an auditor can only test an invoice against the terms it can find. A missing amendment, an unsigned renewal, or a rate card that was updated by email and never filed all produce the same result, a finding the auditor cannot substantiate and therefore cannot report. Procurement is the only function that knows where those gaps are before anyone starts looking. What changes the outcome is turning that internal knowledge into a checklist procurement runs against every active vendor: contract status, rate card currency, PO-to-invoice linkage, and who owns each vendor relationship. Running it before the audit starts converts unknown gaps into a known list, and a known list is something an audit can work around instead of getting stuck on.

## 1. What should you check before an external audit?

Before an external audit starts, confirm four things with procurement: every active vendor has a signed, current contract on file; rate cards match the latest signed terms, not an older or verbal update; purchase orders reference the correct contract number; and one named person owns each vendor relationship and can answer questions during the engagement. Gaps in any of these four slow the audit down before it reaches a single invoice. Each of the four checks maps to a different failure mode. A missing signed contract means the auditor has no reference document to test against, so any invoice for that vendor gets set aside rather than tested. A stale rate card means the auditor tests against terms that were superseded, which produces a finding that turns out to be wrong once the correct version surfaces. A PO that does not reference the governing contract number breaks the chain an auditor needs to connect an invoice back to its terms; without it, matching becomes manual and slow. And a vendor with no named internal owner means questions about intent, side agreements, or verbal exceptions go unanswered, because nobody in the building remembers making them. Running these four checks is a procurement task, not an audit task. It takes days, not weeks, because procurement already knows where its own files are thin. Doing it before the audit starts means the audit's first week is spent testing invoices instead of tracking down which contracts exist.

## 2. Which contracts and amendments does procurement need to produce?

Procurement needs to produce the base contract, every signed amendment, and any side letter or email confirmation that changed a rate, term, or scope, for every vendor the audit will cover. A contract without its amendments looks complete but tests against outdated terms, which is worse than an admitted gap because it produces a finding that later has to be retracted. The base agreement is rarely the problem. Amendments are, because they are frequently negotiated by a category manager, confirmed by email, and never routed back into the contract file. A rate reduction agreed months earlier and never filed means the audit tests the invoice against the original, higher rate and reports overbilling that is not real. Ask procurement to produce, per vendor: the base contract, a dated list of every amendment, and copies of any email or letter that changed pricing, volume tiers, or service scope even if it was never formalized into a signed amendment. Flag anything verbal or undocumented as its own category rather than omitting it, because the auditor needs to know a gap exists even when it cannot be closed before the engagement starts. ### A. Base contract and renewal status Confirm the contract is still active, has not lapsed into a month-to-month or auto-renewal state with different terms, and matches the vendor name currently used on invoices. Vendor name changes after a merger or rebrand are a common source of mismatched files. ### B. Amendments and side letters List every amendment with its effective date and confirm each is signed, not just referenced in an email chain. An amendment discussed but never executed does not change the governing rate, and the audit needs to know which category it falls into.

## 3. How current does the rate card need to be?

The rate card procurement hands to the audit needs to match the most recent signed terms, dated, and attributed to the document that authorizes it, not to a spreadsheet someone updated from memory. An undated or unattributed rate card cannot be used to test an invoice, because the auditor cannot show which version governed the invoice date in question. Rate cards drift from contracts in a specific way: a category manager negotiates a new rate, updates the internal spreadsheet, and the change never gets attached to a signed amendment. The spreadsheet is accurate. It is also unusable as audit evidence, because nothing ties it back to an executed document. Ask procurement to reconcile the working rate card against the contract file for every vendor before the audit starts, and to flag any rate that exists in the spreadsheet but not in a signed document. That flag is useful information on its own. It tells the audit team where verbal or informal pricing changes have taken hold, which is itself a control gap worth reporting alongside any dollar finding.

## 4. Why does PO-to-contract linkage matter for the audit?

Purchase order linkage matters because it is how an auditor connects an invoice to the contract that should govern it. When a PO carries no contract reference, or references the wrong one, the auditor has to match invoices to terms manually, vendor by vendor, which is the single biggest driver of a longer engagement timeline. Three-way matching checks the invoice against the PO and the receipt. It does not test whether the PO itself points to the correct, current contract. A PO can pass three-way matching cleanly and still authorize a rate that the contract superseded months earlier. Ask procurement to sample a set of recent POs per major vendor and confirm each carries a contract or agreement number, and that the number matches an active, signed document. Where the PO system has no field for this, ask how the linkage is tracked instead, whether that is a shared spreadsheet, a category manager's memory, or nothing at all. Naming the actual mechanism, even an informal one, gives the audit team a starting point instead of a blank.

## 5. Who should own each vendor relationship during the audit?

Each vendor needs one named internal owner, someone who negotiated or currently manages the relationship, who can answer questions about intent, exceptions, and undocumented agreements while the audit is underway. Without a named owner, questions sit unanswered and the audit either stalls or has to assume the worst interpretation of an ambiguous invoice. Vendor ownership fragments over time, especially after a reorganization, an acquisition, or simple staff turnover. A vendor's original point of contact may have left, and the person who inherited the relationship may only know it from the current invoice, not from the negotiation history behind it. Build a one-page list before the audit starts: vendor name, current owner, and a backup contact if the owner is unavailable during the engagement window. This list does double duty. It speeds up every question the audit team has, and it is itself a piece of evidence about control strength, because a vendor with no identifiable owner is a vendor whose contract terms nobody is actively enforcing between audits. - Vendor name and owner: The person who negotiates or manages the relationship today, not the original signer if that person has left. - Backup contact: Someone who can answer basic questions if the primary owner is unavailable during the engagement. - Last renegotiation date: When the relationship's terms were last actively reviewed, as distinct from when the contract auto-renewed. - Known exceptions: Any verbal or informal arrangement the owner is aware of that differs from the written contract.

## 6. What should procurement flag before the audit starts, rather than wait to be asked?

Procurement should proactively flag any vendor with an expired or unsigned contract, any rate card discrepancy it already knows about, any vendor consolidation from a past acquisition that never fully merged contract files, and any category where spend has grown without a corresponding contract review. Volunteering these up front is faster than an auditor finding them independently, and it shapes where the engagement spends its time. An audit team without guidance tests broadly across every vendor and category, which is thorough but slow. A procurement team that already knows where its own gaps sit can direct that effort toward the areas most likely to contain real drift, without pre-deciding the outcome. This matters especially after a [vendor contract consolidation](/guides/post-acquisition-vendor-contract-consolidation), where vendor files from an acquired entity often sit unreconciled against the parent company's contract terms for months or years. It is also relevant wherever spend in a category has grown faster than the team managing it, since a rate negotiated for a smaller volume may never have been revisited once volume tiers were crossed. A short written list, handed to the audit team on day one, of every known gap procurement is already aware of costs little to produce and materially shortens the time it takes the engagement to reach its first substantiated finding. For the wider pattern this sits inside, start with the [margin drift](/guides/cfo-agenda-mid-market-manufacturing) guide. See also [the six categories drift hides in](/guides/indirect-spend-audit-categories) and [margin drift vs. legitimate price increases: how to tell them apart](/guides/margin-drift-vs-legitimate-price-increases-how-to-tell-them).

## Common questions

### How far in advance should procurement start this checklist?

Two to three weeks before the audit begins, so gaps found in the first pass can be partly closed and the rest documented rather than discovered mid-engagement. Waiting until the audit starts to run this check means the audit absorbs the delay instead of procurement.

### What if a vendor genuinely has no signed contract on file?

Flag it rather than search for one that does not exist. An auditor treats an unwritten arrangement differently from a missing document, and knowing upfront that no contract exists lets the engagement move directly to testing invoices against actual purchase order history and vendor-confirmed pricing.

### Does this checklist apply the same way to every vendor category?

The four checks, contract status, rate card currency, PO linkage, named ownership, apply the same way across freight, MRO, contract labor, and professional services. Where gaps concentrate differs by category, which procurement will already know from its own experience with each one.

### Should procurement fix the gaps it finds before the audit starts?

Fix what can be fixed quickly, such as filing a signed amendment that already exists but was never routed to the contract file. Do not delay the audit trying to renegotiate or resolve every gap; document what cannot be closed in time and hand that list to the audit team.

### Who inside the company should run this checklist, procurement or finance?

Procurement, because it holds the vendor relationships and contract files. Finance or AP can support by pulling PO and payment history, but procurement is the only function that knows where a contract was negotiated informally or never fully filed.

---

ValueXPA runs a fixed-scope Margin Drift Diagnostic that validates every service vendor invoice against contract terms, for $100M+ US industrial manufacturers and distributors. Two to four weeks. The client retains 100% of recoveries. https://valuexpa.com/contact-us