Recovery Audit Guide (2026): Duplicate Payments, Contract Overpayments, Unclaimed Rebates and How to Recover Them

TL;DR

• A recovery audit is a review of past supplier payments to find money paid that should not have been, and to claim it back. The usual finds are duplicate payments, invoices paid above the contract price, rebates and credits never claimed, and missed discounts.
• Most recovery audit firms work on contingency. apexanalytix puts typical fees at 20 to 30 percent of what is recovered, and Xelix cites 10 to 40 percent.
• You can run a first pass in house with the payment file, the vendor master and your contracts. The hard part is the money agreed outside the ERP: a price cut confirmed by email, a rebate agreed in a meeting, a credit promised in chat.
• Sentra joins what the ERP paid with what people agreed in email, chat and meetings, and raises each gap to its owner with the evidence. A named person approves before anything goes out.

What a recovery audit is

A recovery audit, also called an accounts payable recovery audit or profit recovery audit, is a review of a company's past payments to suppliers to find overpayments and recover them. Auditors compare invoices against purchase orders, receipts, contracts, credit notes and payment records, then file claims with suppliers for anything paid in error. PRGX and Xelix describe the same process.

A recovery audit differs from an internal audit or a financial statement audit. Those test whether controls work and whether the accounts are fairly stated. A recovery audit has one aim: get cash back. A good one also finds the root cause of each error so it stops recurring.

The term overlaps with an accounts payable audit, which more broadly tests AP controls such as approvals, vendor setup and segregation of duties. Many companies run both: the controls review to prevent errors, the recovery audit to collect the ones that got through.

What a recovery audit finds

Duplicate payments

A duplicate payment is the same supplier invoice paid more than once. Most AP systems block an exact duplicate: same supplier, same invoice number, same amount. Real duplicates are rarely exact.

Common causes of a duplicate invoice getting through:

• Invoice number formats. INV-10442, INV10442 and 10442 look different to an ERP and identical to a person.
• Duplicate vendor records. The same supplier set up twice, often after an address or bank change, so the duplicate check runs against the wrong record.
• Two channels. A PDF arrives by email and a copy by post or a supplier portal. Both are keyed.
• Statements and reminders paid as invoices. A supplier reminder is processed as a new bill.
• Manual and urgent payments. A wire is sent outside the payment run to calm an angry supplier, then the invoice is paid again in the normal run.

To test, normalize invoice numbers (strip spaces, dashes, prefixes and leading zeros), then match on supplier group, amount and a date window. Review every hit by hand.

Paid above the contract price

Overpayment against contract usually comes from a gap between what was agreed and what the ERP knows. The contract or a later email sets a price, and the purchase order or price record carries an older one. The invoice matches the PO, so three-way match passes, and the overpayment is invisible to AP.

The same gap causes the most common unrecovered loss: a supplier's price cut never applied. A supplier agrees by email to reduce a price from the first of the month. Nobody updates the price record. Every invoice after that date is paid at the old price, and each one matches its PO perfectly. Our guide to contract compliance covers how agreed terms fail to reach the systems that apply them, and our guide to maverick spending covers purchases made off contract altogether.

Vendor rebates and rebate management

A vendor rebate is money a supplier pays back after a purchase, usually once spend or volume passes an agreed threshold over a period. Unlike a discount, a rebate is not on the invoice. Someone has to track spend against the threshold, work out what is owed and claim it.

That is why rebate management is a frequent source of recovery. Typical failures:

• The rebate lives only in an email or meeting. A salesperson agreed 2% back above $5 million of annual spend during a renewal call. It never made it into the contract file or the ERP.
• Spend is split across entities. Three subsidiaries buy from the same supplier. Together they pass the threshold, separately none does.
• Nobody owns the claim. Procurement negotiated it, AP pays the invoices, and neither tracks the rebate.
• The claim window closes. Many rebate terms require a claim within a set period after year end.

A rebate tracker needs, for each agreement: supplier, entities covered, period, threshold, rate, whether the rate applies to all spend or only spend above the threshold, claim deadline, owner and source document.

How recovery audit firms work and charge

Most companies outsource recovery audits to a specialist firm. The process is broadly the same across providers, as Xelix sets out.

1. Data collection. You provide AP transactions, payment files, the vendor master, purchase orders, contracts, credit notes and supplier statements.

2. Analysis. The firm runs duplicate, pricing, credit and discount tests across the lookback period. apexanalytix notes that some audits go back three years or more.

3. Validation. You confirm each finding before any supplier is contacted.

4. Claims. The firm or your team contacts suppliers to recover each amount by refund, credit or offset against future invoices.

5. Root cause report. The firm reports why the errors happened and what to change.

Fees. Contingency is the dominant model: you pay a share of what is recovered and nothing if nothing is found. apexanalytix puts the usual range at 20 to 30 percent of recovered overpayments. Xelix says commissions usually run from 10 to 40 percent, and that some firms charge a fixed fee plus commission. Both are vendors in this market, so treat the ranges as indicative. apexanalytix also gives a conservative recovery rate of about 0.1 percent of total spend.

Points to settle in the contract. Agree what counts as a recovery (cash only, or also credits and future price corrections), whether the fee applies to errors your own team already found, the lookback period, who contacts suppliers and how, and how data is handled and returned.

Recovery also gets harder with time. Xelix notes it is unlikely that every overpayment will be recovered, especially when much time has passed since payment.

Worked example

The assumptions are illustrative. A company spends $400 million a year with suppliers and audits a three-year lookback, so $1.2 billion of spend. At apexanalytix's conservative 0.1 percent, a firm would find about $1.2 million. At a 25 percent fee, the firm keeps $300,000 and the company nets $900,000.

Now look at four findings from a single supplier review, and where the evidence for each sat.

Only the first finding is visible to a test that reads the ERP alone. The second needs the contract. The last two, which make up almost two thirds of the total, need the conversations.

How to run a recovery audit in house

You can run a first pass with a spreadsheet or a data tool before calling in a firm, or between firm audits.

1. Pull the data. Two to three years of paid invoices with line detail, the payment file, the vendor master, open and applied credits, and supplier statements for your top suppliers.

2. Clean the vendor master. Group duplicate supplier records by tax ID, bank account and address.

3. Run duplicate tests. Normalize invoice numbers, then match on supplier group, amount and date window.

4. Test prices against contracts. For your top 50 suppliers by spend, compare invoiced unit prices with the price in force on each invoice date.

5. Collect agreed changes. Ask buyers and category managers for price changes, rebates and credits agreed in the period, and where each was agreed. Search email for the supplier names alongside words like rebate, credit, price reduction and new pricing.

6. Reconcile supplier statements. Look for credits on the supplier's statement that never reached your ledger.

7. Check rebate thresholds. Total spend by supplier across all entities and compare with every rebate agreement.

8. Validate and claim. Confirm each finding with the buyer who owns the supplier, then claim by credit or refund.

9. Fix the cause. For each finding, record why it happened and change the control, the price record or the process. A root cause analysis template keeps this consistent.

Recovery audit checklist

• Vendor master reviewed for duplicate suppliers and bank details
• Duplicate payment test run with normalized invoice numbers
• Manual and urgent payments matched against normal payment runs
• Invoice prices tested against contract prices for top suppliers
• Agreed price changes collected from buyers and email, with effective dates
• Rebate agreements listed with thresholds, rates, deadlines and owners
• Spend totaled by supplier across all entities
• Supplier statements reconciled for unapplied credits
• Discount terms compared with payment dates
• Freight, fee and tax lines tested against contract terms
• Each finding validated with its owner before any claim
• Root cause recorded and control changed for each finding

Common mistakes

• Testing only exact duplicates. The ERP already blocks those. The losses are in near matches.
• Testing prices against the PO, not the contract. If the PO carries the wrong price, a three-way match passes the overpayment.
• Leaving agreements made by email out of scope. Rebates and price cuts agreed in conversation are often the largest finds.
• Contacting suppliers before validating. A wrong claim damages a relationship and slows the right ones.
• Recovering without fixing. If the price record is not corrected, the same overpayment recurs next month.

How Sentra catches this automatically

Sentra understands how a company really runs, and acts on it before anyone asks. It reads email, chat, meetings and documents alongside ERP, CRM, HRIS and BI data, and works out what is true now and why. For recovery, that means checking what the ERP paid against what people actually agreed, while the error is still new.

• The same invoice paid twice, or paid above contract price. Sentra links each payment to the invoice, the purchase order and the contract in force, and raises a second payment or a price above the agreed rate to the AP owner with the documents side by side.
• A rebate agreed by email and never claimed. Sentra records the rebate terms from the email or meeting where they were agreed, tracks spend against the threshold across entities, and tells the owner when the rebate is earned and when the claim window closes.
• A supplier's price cut never applied. Sentra knows when the new price became true and that the old price stopped being true on that date. When an invoice arrives at the old price, it raises the gap to the buyer and AP with the supplier's own email as evidence.

Each finding goes to the person who can act on it, with the evidence and its source. A named person approves anything Sentra raises before it reaches anyone else, including any message to a supplier. Every answer respects the permissions of the system it came from. Sentra replaces none of the company's systems, and it does not replace a recovery audit firm: it catches errors as they happen, so fewer are left to recover later. Sentra holds SOC 2 Type II and ISO 27001 certifications and runs in the cloud, in an isolated VPC or air-gapped on premises.

To see what Sentra would recover from your own supplier payments, book a demo.

FAQ