Recovery audit: what it is and why every CFO should have one done as standard

In the United States and the United Kingdom, the recovery audit is a fixed part of the financial control cycle at large organisations; retailers even run one continuously. In the Netherlands the instrument is remarkably little known, while the logic is exactly the same: every organisation with serious invoice volume pays money in error, and that money can be recovered within the limitation period.

What sets a recovery audit apart from existing controls

• The external auditor tests whether the annual accounts give a true and fair view, not whether every payment was owed; a duplicate payment with an invoice behind it falls outside that scope.
• Internal controls (three-way matching, payment run checks) work forward and per transaction; they do not see patterns across years, systems and entities.
• The recovery audit looks back, across the full breadth of three to five years of payment history, with detection algorithms that match on combinations of attributes.

Why it should be a recurring control

Three reasons. First, limitation: claims older than about five years are gone for good, so anyone who never audits lets money evaporate structurally. Second, the dynamics of change: every system migration, acquisition and reorganisation produces a new wave of errors; it is precisely after such projects that an audit is most worthwhile. Third, the process information: the audit provides an objective error measurement of the purchase-to-pay process, including the correction entries and suppliers where things chafe. That is management information no dashboard gives you.

The business model makes the decision easy

Recovery audits almost always work on a no cure, no pay basis: the fee is a percentage of money actually recovered and approved. The business case for the CFO is therefore unusually simple: by definition the proceeds exceed the costs, the internal burden is limited to delivering data and reviewing claims, and the side effect is a reviewed process. The only real cost of a recovery audit is not doing one.

What to look for when choosing an auditor

• Control over supplier contact: you approve every claim before a supplier is approached.
• Data security: encrypted storage within the EU, access restrictions and deletion afterwards.
• Reporting included: recommendations per root cause, not just a list of claims.
• Minimal burden: a professional party asks for about four hours once for data delivery and at most one hour every two weeks after that.