Skip to content
EMPOBase
en

What a procurement audit trail must show

By the EMPOBase team · · 4 min read

Short answer

A procurement audit trail must let a stranger follow one purchase from need to payment without asking you questions. It shows the request, the budget line, the competition, the approvals with names and dates, the order, the proof of delivery, the invoice, the payment and any exception. Every document links to the next, and every decision names the person who made it.

Key points

  • The test is simple: can a stranger follow one purchase from request to payment using the file alone?
  • Each decision needs a name, a role, a date and, for exceptions, a reason.
  • Documents must link by a shared reference, such as the purchase order number.
  • Gaps and exceptions are not fatal if they are explained in writing at the time.

What is an audit trail?

An audit trail is the chain of records that shows how a purchase happened. It answers four questions: what was bought, why, who decided and was the money well spent. A donor reviewer or external auditor will pick a purchase, often at random, and ask to see the chain.

If the chain is complete, the review is short. If links are missing, the reviewer widens the sample, and the cost of the audit grows.

What should the trail show, step by step?

Follow one purchase in order. For each step, the table shows the record and what it proves.

StepRecordWhat it proves
NeedPurchase request with project and budget lineSomeone with authority wanted it, for a funded reason
BudgetBudget check or commitmentMoney was available on that line
CompetitionQuotations or tender documents, evaluationThe price was tested against the market
DecisionAward note and approvalsThe right people agreed, within their limits
OrderPurchase order to the chosen supplierThe terms were agreed before delivery
DeliveryDelivery note or goods received noteGoods or services actually arrived
InvoiceSupplier invoice matched to order and deliveryYou pay for what you ordered and received
PaymentPayment approval and proof of paymentThe right amount went to the right supplier

Our article on the NGO procurement process, step by step explains each of these stages, and what a three-way match is shows how to link order, delivery and invoice.

Which details turn a record into evidence?

A scanned page alone is weak evidence. These details make it strong.

  1. A name and a role. “Approved” means little. “Approved by the head of operations” is useful.
  2. A date and time. Dates show that approval came before ordering, not after.
  3. A shared reference. Request, order, receipt and invoice carry the same number or can be linked to it.
  4. The amount and currency. Matching figures across documents shows they belong together.
  5. The reason for any exception. A one-line note beats a gap.

What does an auditor look for first?

Auditors work from patterns of risk. These checks are common.

  • Order of dates. Was the purchase order issued before the invoice and before delivery?
  • Authority. Did the approver have the limit to approve this amount?
  • Independence. Was the requester also the approver? Did one person approve several steps?
  • Competition. Were enough quotations or bids collected, and were they genuinely independent?
  • Splitting. Are there several small orders to one supplier that together would need a higher level?
  • Delivery. Is there proof that goods arrived, in the stated quantity?
  • Payment. Does the amount paid match the invoice and the order?

Our article on approval limits for NGO procurement shows how to set the rules that these tests check.

How to build the trail as you go

It is far easier to keep a file as you work than to rebuild it before an audit.

  1. Open the file at the request. Give it a reference that every later document will carry.
  2. Add each document the day it is created. Do not wait for the end.
  3. Record decisions in the same place. If someone approves by phone, they confirm in writing the same day.
  4. Note exceptions immediately. Write what happened, why, and who agreed.
  5. Close the file at payment. A short checklist confirms all documents are present.
  6. Store it so it can be found. Use a consistent reference and place, not personal folders.

What are common gaps?

  • Approvals dated after the order.
  • Quotations without dates or supplier details.
  • Delivery notes with no signature or no quantity.
  • Invoices that differ from the order, with no note.
  • Payments that cannot be linked to an invoice.
  • Documents created after the fact and dated as if they were earlier. Never do this; it turns a gap into a credibility problem.

Where a gap exists, write a dated note that explains it. An honest note is a finding you can manage. A hidden gap, once discovered, is much worse.

Where EMPOBase fits

EMPOBase Procurement keeps the request, the order, the goods received note and the approvals together against the same project and budget line. Review decisions record who acted, when and any note, the requester cannot approve their own request, and one person cannot approve two steps of the same request. Approved requests post to the ledger exactly once, so the entry traces back to the request. EMPOBase has no settlement record and no proof-of-payment record, and it does not make bank transfers, so keep your bank evidence in your own payment file. See the procure-to-pay workflow.

Questions people ask

How long should procurement records be kept?

It depends on your donor agreements and local law. Many require several years after the grant closes. Check each agreement and keep the longest period that applies.

Are emails enough as evidence?

They can be, but they are hard to find and easy to lose. Save the key emails into the purchase file, and avoid making approvals only by chat or phone.

Can we reconstruct a missing document later?

You can ask the supplier for a copy of their own documents. Do not create backdated documents of your own. Write a dated note that explains what is missing and why.