Purchase testing in statutory audit: procedures, samples and exceptions

Purchase testing in statutory audit establishes that recorded purchases occurred, were complete, were recorded at the right amount, in the right period and under the right account. It runs in four stages: agree a complete population from the purchase register to the ledger and the trial balance, stratify it by risk and value, apply procedures that address specific assertions rather than a generic sample of vouchers, and resolve every exception in writing. The work that fails on review usually fails at the first stage, not the third.

What purchase testing is actually establishing

Purchase testing is not a single procedure. It is a set of procedures aimed at different assertions, and confusing them is why so many files contain twenty-five vouched invoices and no conclusion anyone can rely on. Vouching a sample of recorded purchases forward to invoices tests occurrence. It tells you nothing about completeness, because you cannot find an unrecorded purchase by looking through the purchases that were recorded.

Stage one: agree the population before anything else

A sample is only evidence about the population it came from. If the purchase register you sampled does not agree to the purchases in the ledger, and the ledger does not agree to the trial balance you audited, then the sample supports a conclusion about a set of transactions that does not appear in the financial statements.

1. 01Agree the purchase register total to the purchases ledgerTake the register for the full year, total it, and agree it to the purchases figure in the general ledger. Differences here are usually journal entries posted directly to the purchases account, purchases recorded through a different voucher type, or a register run for a different date range. Identify and quantify each, do not net them.
2. 02Agree the ledger to the trial balance and the trial balance to the draft accountsTwo short reconciliations. They take an hour and they are the difference between a population and a spreadsheet.
3. 03Reconcile the opening position to last year's signed accountsOpening trade payables and opening stock both feed the purchases figure. If they do not tie to the prior-year signed financial statements, the scope of the engagement has changed and the partner needs to know on day one.
4. 04Establish what is excluded and say soImport purchases, purchases under reverse charge, branch transfers and job-work movements are frequently recorded outside the main purchase register. State in the working paper which streams the population covers and which it does not, and cover the rest separately rather than silently.

Stage two: a sample basis that survives review

“Judgemental” is not a sample basis. It is the absence of one. A basis has three components a reviewer can check: what the population was, how items were selected, and why that method addresses the risk you identified. Record all three before selecting anything, because reconstructing a rationale afterwards produces a rationale that fits the sample rather than the risk.

A stratified approach works well on purchases in a mid-market client, because value is almost always concentrated. A typical structure covers the population in three layers.

Keep the three layers separate in the working paper. An exception found in the risk-targeted layer says something about that characteristic; an exception in the representative layer says something about the population. Merging them produces an error rate that means nothing, and it is the most common reason an exception schedule cannot be concluded on.

Stage three: the procedures

For each selected item, the core test is a three-way match: the purchase order, the evidence of receipt, and the supplier invoice, agreed to each other and to the ledger posting. In practice the second leg is the one that varies most by client, and the decision about what you will accept as evidence of receipt has to be made in advance.

1. 01Agree the invoice to the ledger postingAmount, date, vendor and account. The most common innocent difference is the tax component posted separately to an input credit account. Recompute before treating it as an exception.
2. 02Agree the invoice to evidence of receiptA goods receipt note where one exists. Where the client does not raise GRNs, a signed delivery challan, a gate inward entry, a store inward register or a stock ledger movement. For services, evidence of performance: a certified work completion note, a timesheet, a milestone certificate.
3. 03Agree the invoice to the order or contractRate, quantity and terms. Where no order exists, establish who approved the purchase and on what authority, and check that against the client's own delegation of authority.
4. 04Check authorisation against the client's stated thresholdA purchase above a threshold with no approval at the required level is a control override. That is a different and more serious finding than a missing document, and it should never be recorded as a paperwork gap.
5. 05Check the tax treatmentGSTIN on the invoice, place of supply, rate applied and whether the credit is one blocked under section 17(5) of the CGST Act. Purchase testing and input credit work overlap here, and doing them in isolation duplicates effort.
6. 06Confirm the periodWhere the item falls near the year end, apply the cut-off test rather than the routine one.

Where purchase sections most often fail on review

A short checklist for the section

• Population agreed to the ledger, the ledger to the trial balance, the trial balance to the draft accounts, all evidenced.
• Streams excluded from the population identified, and covered by a separate procedure.
• Sample basis recorded before selection, with the three layers kept apart.
• At least one test in each direction, so completeness is addressed and not assumed.
• Evidence-of-receipt policy agreed with the client and recorded, where GRNs are not raised.
• Authorisation tested against the client's own threshold, not against a threshold you assumed.
• Cut-off tested separately either side of the year end.
• Related-party purchases identified by PAN and directorship, not by vendor name.
• Every exception resolved in writing, with the dismissed ones recorded too.
• A conclusion written by a named person that states what the work showed, not that work was done.

What this means for how the work is staffed

Almost everything above divides cleanly into two kinds of work. Agreeing a register to a ledger, matching an invoice to a receipt note, recomputing quantity times rate, flagging values just below a threshold and finding the same invoice number twice are mechanical. They are also where most of the hours go, and they are the parts a firm cannot afford to do across the whole population by hand, which is why sampling exists in the first place.

Deciding whether a missing goods receipt note matters at this client, whether a pattern of round-sum payments to one vendor is an arrangement or a coincidence, and whether the aggregate of the uncorrected differences is material: none of that is mechanical, and none of it should be delegated to software.

Testing the full population changes the sampling question rather than removing it. When every transaction has been matched, the sample is no longer the basis for the conclusion on accuracy; it becomes a check on the matching itself. That is a smaller sample with a different purpose, and the working paper needs to say so explicitly instead of carrying forward last year's basis.