SOX · Procure to Pay
P2P-008 — Vendor master additions independently verified
New vendors are validated against supporting documentation and screened for duplicates and sanctions before activation.
Control attributes
- Type
- Business process
- Nature
- Manual
- Frequency
- Ongoing
- Key control
- Yes
- Assertions
- Occurrence, Rights & obligations
- System
- NetSuite
- Owner
- Procurement Controller
- SOX scope
- In scope
- Last tested
- Sep 14, FY26
- Testing status
- In testing
- Samples tested
- 45
- Exceptions
- 2
AI scoping reasoning
Morgan · Audit Manager Agent
In scope — fraud risk relevance
Linked risk
R-08Moderate
Fraudulent journal entries at period end
Manual top-side entries increased at Q2 close but all reviewed and supported.
Evidence
1 requests
EV-2055Received
Vendor master change audit trail
Validating completeness — record count differs from prior extract by 42.
Exceptions
1 identified
EX-114Under AI investigation
Two vendors activated without documented duplicate check.
Root cause: Duplicate check performed but not retained; procedure does not require evidence.
Population impact: Full-population analytic identified 14 potential duplicate vendor pairs.
Review notes
1 on this control
RN-495Open
Morgan (Audit Manager) → Kai (Staff Auditor)
Extend procedures to the 14 potential duplicate vendor pairs identified by analytics.