Purchase Audit Checklist: Procurement Audit for Factories
Last updated: 16 October 2026
Quick Answer: A purchase audit checklist lists the controls an auditor tests on each purchase, from the stores indent to the bank payment. For a manufacturer it covers nine stages: vendor master, indent, RFQ and comparative statement, purchase order, GRN and quality inspection, invoice matching, GST input tax credit, MSME supplier dues and payment release.
An MD or audit committee wants to know whether purchase policy approvals hold on real orders. This purchase audit checklist answers that with 30 numbered checks in nine stage tables, each with its evidence and red flag. It doubles as the internal audit checklist for the purchase department.
What Does a Purchase Audit Cover in a Manufacturing Company?
Every purchase from indent to bank payment, tested on three questions: was it needed, was it bought under the rules, and was it received and paid for as ordered. The nine stages:
- Vendor master: who the company may pay at all.
- Indent: who asked, against which budget or reorder level.
- RFQ and comparative statement: how the vendor and the rate were chosen.
- Purchase order: who approved it, within which limit.
- GRN and quality inspection: what arrived and what passed.
- Invoice matching: whether the bill agrees with the order and the receipt.
- GST input tax credit: whether the credit taken on the bill is allowable.
- MSME supplier dues: whether micro and small suppliers are paid in time.
- Payment release: who releases the money, and to which account.
Is a Procurement Audit Different From a Purchase Audit?
In many Indian plants the two names describe the same indent-to-pay review. Where a line is drawn, a purchase audit tests individual transactions, while a procurement audit also weighs sourcing strategy, rate contracts and vendor performance. The IIA's public-sector procurement practice guide works through the procurement cycle phase by phase with the risks and controls in each.
How Is a Procurement Audit Run From Indent to Payment?
- Scope: fix the plants, the period and the spend categories (raw material, job work, capital items, services).
- Data extraction: a full year of ERP transactions and vendor master changes.
- Walkthrough: follow two or three live purchases with stores, purchase, quality and accounts.
- Testing: run the checklist on a sample and exception reports on the whole population. Illustratively, test every high-value order, first payment to a new vendor and bank-detail change, plus 25 to 40 routine orders per plant.
- Reporting: rate each finding high, medium or low, with root cause, owner and closing date.
- Follow-up: retest the corrected controls in the next cycle.
Purchase Audit Checklist: 30 Checks From Indent to Payment
These rows are illustrative: mark each Yes, No or Not applicable against the sample, and add rows for job work, scrap or imports where your textile or engineering units need them.
Vendor Master Audit Checklist and Related-Party Vendors
| No. | Check | Evidence | Red flag |
|---|---|---|---|
| 1 | Vendors are created outside purchase, from GSTIN, PAN and a bank letter | Creation form, change log | Vendor created and paid in the same week |
| 2 | No PAN, GSTIN or bank account repeats across vendor codes | Duplicate report on the master | One supplier under two codes |
| 3 | No vendor bank account matches an employee account | Vendor master matched to payroll master | Shared account or address |
| 4 | Related-party purchases carry the required approval | Related-party register, Board minutes | Director-linked firm, no approval on file |
| 5 | Micro and small suppliers carry their Udyam number and an MSE flag | Udyam certificate, vendor flag | Registered supplier without the flag |
Under section 2(76) of the Companies Act, 2013, a firm in which a director or a director's relative is a partner is a related party. Section 188 makes Board consent a condition for a related-party contract to buy goods or services, unless the deal is in the ordinary course of business and at arm's length. Above prescribed limits, a shareholders' resolution is also needed, and any audit committee must approve related-party transactions (section 177(4)(iv)).
Indent and Budget
| No. | Check | Evidence | Red flag |
|---|---|---|---|
| 6 | Each indent is raised against a budget line or reorder level | Indent register, budget report | Indent raised while stock is above reorder level |
| 7 | Indented quantity fits recent consumption | Consumption report, stock ledger | Indents running at twice monthly use |
| 8 | Urgent indents are justified in writing and reviewed later | Emergency purchase log | Urgent indents clustered on one buyer |
RFQ and Comparative Statement
| No. | Check | Evidence | Red flag |
|---|---|---|---|
| 9 | More than one quotation is obtained above the policy value | RFQ file, quotations | The same vendor narrowly lowest every time |
| 10 | Someone outside purchase approves the comparative statement | Signed comparative statement | Statement dated after the purchase order |
| 11 | The lowest acceptable quote wins, or the file records why not | Approval note | Higher quote chosen with no reason |
| 12 | Rate contracts are renewed through a fresh enquiry | Rate contract register | Expired contract rates still in use |
Purchase Order
| No. | Check | Evidence | Red flag |
|---|---|---|---|
| 13 | The ERP blocks any order above the approver's delegated limit | Approval log, delegation of authority | Several orders just under one limit |
| 14 | Order rate, quantity and terms agree with the approved statement | Purchase order, comparative statement | Order rate above the approved rate |
| 15 | Amendments are approved at the original level | Amendment history | Rate raised after approval |
| 16 | The order predates the supplier's invoice | Order and invoice dates | Order raised to regularise a bill |
GRN and Quality Inspection
| No. | Check | Evidence | Red flag |
|---|---|---|---|
| 17 | A GRN is raised only for goods logged at the gate and counted | Gate register, GRN | GRN dated before the gate entry |
| 18 | Quality accepts the lot before the bill is booked | Inspection report | Bill booked on rejected material |
| 19 | Rejections and short receipts are returned or debited | Rejection note, debit note | Rejected lots in stores with no debit note |
Quantities received are counted again under the inventory audit procedure, where a GRN posted without goods shows up as a stock shortage.
Three-Way and Five-Way Match
| No. | Check | Evidence | Red flag |
|---|---|---|---|
| 20 | Bills are booked only when order, GRN and invoice agree | Match exception report | Bills booked on manual override |
| 21 | Finance, not purchase, sets and reviews match tolerances | Tolerance settings, change log | Tolerance widened at month-end |
| 22 | The ERP rejects a repeated supplier invoice number | Duplicate invoice report | One invoice booked under two codes |
A three-way match compares order, GRN and invoice; a five-way match adds the indent and quality report.
GST Input Tax Credit on Purchase Bills
| No. | Check | Evidence | Red flag |
|---|---|---|---|
| 23 | Credit is taken only when every legal condition is met | Purchase register, credit ledger, IRN on e-invoices | Credit on goods not received, or on a bill missing a required IRN |
| 24 | The purchase register is reconciled with GSTR-2B every month | Reconciliation file | Credit on invoices missing from GSTR-2B |
| 25 | Bills approaching 180 days unpaid are tracked | Payables ageing | Old unpaid bills with credit retained |
Section 16(2) of the CGST Act, 2017 allows the credit only when all its conditions are met: a tax invoice, the supplier's reporting of it, no restriction on that credit under section 38, receipt of the goods or services, tax paid to the Government and the buyer's own return. If the supplier is unpaid 180 days after the invoice date (reverse-charge supplies excepted), an amount equal to the credit is paid with interest, then reclaimed on payment. Under section 16(4), credit on an invoice or debit note cannot be taken after 30 November following the end of the financial year it relates to, or after the annual return is filed, if that is earlier.
MSME Supplier Dues
| No. | Check | Evidence | Red flag |
|---|---|---|---|
| 26 | Micro and small suppliers are paid within 45 days on written terms, 15 days otherwise | Purchase orders, supplier agreements | 60 or 90 day terms, or no written terms and paid after day 15 |
| 27 | Their overdue bills and interest are worked out monthly | MSE ageing report | Interest due but not provided |
Section 15 of the Micro, Small and Medium Enterprises Development Act, 2006 caps terms agreed in writing at 45 days from acceptance or deemed acceptance; with no written terms, payment is due within 15 days. Section 16 adds compound interest with monthly rests at three times the Reserve Bank's notified bank rate, and section 37 of the Income-tax Act, 2025 defers the deduction for a late amount to the tax year it is paid.
Payment Release
| No. | Check | Evidence | Red flag |
|---|---|---|---|
| 28 | Money goes out only against a matched, approved bill, net of any TDS due | Bank file, vouchers | Advances never adjusted against bills |
| 29 | The paying account matches the vendor master | Bank file, master | Bank details changed before a large payment |
| 30 | The person releasing payment cannot create or edit vendors | ERP user access list | One user holds both rights |
What Belongs on a Procurement Audit Checklist Beyond Single Purchases?
A wider procurement audit checklist adds year-level questions: are rate contracts benchmarked before renewal, are key vendors rated on quality and delivery, and are the purchase policy and delegation of authority current? Other plant processes sit in the internal audit checklist for manufacturing.
Which Red Flags Should a Purchase Audit Checklist Test With ERP Data?
Five patterns, each tested on a full year of data.
| Pattern | Data test |
|---|---|
| Split orders kept under an approval limit | Group orders by vendor, item and week |
| Single-source buying in a category | Spend share per vendor against the RFQ log |
| Rate creep on unchanged terms | Rate per item code, quarter by quarter |
| Duplicate vendors | Match PAN, GSTIN, bank account and address across codes |
| Emergency buying that skips quotations | Urgent orders per buyer, with rates against routine orders |
Who Should Carry Out a Purchase Audit?
A reviewer independent of buying, receiving and paying should run the purchase audit checklist:
- An in-house internal audit team reporting to the audit committee.
- An outside internal audit firm.
- A purchase or finance self-review, useful monitoring but not independent.
Section 144(b) of the Companies Act, 2013 bars the statutory auditor from a company's internal audit.
Astral Business Consulting LLP, a Coimbatore-based management consulting and audit firm, covers the purchase cycle in its indent-to-pay internal audit for manufacturers, a COSO-based process audit drawing on more than 1,500 process risks and controls. The Payment Assurance stream of its Continuous Assurance Service aims to reduce duplicate payments and payments outside defined internal policy.
Want Your Purchase Cycle Tested Before the Year-End Close?
Speak to the Integrated Audit division of Astral Business Consulting LLP about running this purchase audit checklist across your plants.