The backdated approval a document timestamp caught

This is a composite, illustrative scenario built from how document-authenticity red flags typically surface in evidence review, not an account of a named client. A capex approval memo was dated the 28th of a month, but the electronic file it was stored as carried creation metadata showing it had been generated six days later, on the 4th of the following month. That contradiction meant the printed date on the document could not be literally true, which raised the approval itself as the actual question rather than the memo's formatting. The resolution was not a restatement — the expenditure was genuine and properly incurred — but it was a real control-override finding that changed how the audit treated every other approval from the same approver for the rest of the engagement.

How it came up

It wasn't found by reading the memo. It was found because the evidence-management step on this engagement checked file metadata as a matter of course on a sample of supporting documents, the same way a vouching step checks an invoice against a ledger entry. The memo's own printed date read the 28th. Its file properties — created, not modified — read the 4th of the next month.

What was checked before anyone was accused of anything

1. 01Checked whether the document had simply been re-savedAsked IT for the file's full version history on the shared drive. No earlier version existed — this was the only copy, and its creation date was the 4th, not a re-save of something older.
2. 02Checked the capex spend date against the approvalThe purchase order to the vendor was dated the 2nd, two days before the approval memo was created and twenty-six days before the memo's own printed date. The spend had happened before the approval existed in any form.
3. 03Checked who had authority to approve at that valueThe signatory did have authority at that spend level. This was not someone approving beyond their limit — it was someone approving after the fact and dating the document to make it look otherwise.
4. 04Raised it to the engagement partner before going back to the clientA finding that implies a control was deliberately circumvented, rather than simply missed, is a partner-level decision on how to approach the client, not a senior's call to make alone.

What the client said, and what settled it

The explanation was operational, not concealment: the purchase had been verbally approved and actioned under time pressure, and the written memo was produced and backdated afterward to make the paper trail look compliant with the company's own policy, which required written approval before spend. The spend itself was legitimate, properly recorded, and not disputed. The problem was that the company's stated control — written approval before commitment — had been overridden and then papered over rather than disclosed as an exception at the time.

What went into the file

• The original metadata contradiction, with the file properties captured as evidence, not just described.
• The purchase order date, establishing the spend preceded the approval's existence in any form.
• The extended check across this approver's other documents, and its result — two more instances of the same pattern, both for lower-value items.
• The distinction, stated explicitly, between a financial misstatement (none) and a control failure (real, and deliberate).
• The matter escalated per the firm's policy on suspected irregularities, not closed as a documentation tidy-up.

The audit opinion was unaffected — nothing here misstated the financial statements. What changed was the internal controls commentary to those charged with governance, which now named a specific, evidenced control-override pattern rather than a general observation about documentation discipline. That distinction is the entire reason the metadata check happened in the first place: a reviewer reading only the memo would have seen a normally dated approval and moved on.