What external auditors actually require for electronic payment approvals
Ask an audit senior what they would prefer to receive for payment approval testing and they will describe something no client can currently produce. Ask what they accept and they will describe a folder of screenshots.
What will an external auditor accept as evidence of payment approval?
Evidence of operating effectiveness, not evidence that a control exists. Under PCAOB AS 2201 the auditor tests whether the control operated throughout the period, at sufficient frequency, by someone with the right authority. A chat screenshot evidences none of those things.
- AS 2201 requires the auditor to obtain evidence about the effective operation of controls, and evidence obtained directly by the auditor is more reliable than evidence provided by the entity.
- A screenshot is entity-produced, mutable and inspected rather than re-performed. Everyone in the process understands this.
- Signed approval receipts let an auditor verify independently, using open-source tooling, without access to the client's financial systems.
Part of Payment release authorization
What the standard asks for
PCAOB AS 2201 requires the auditor to test the design and operating effectiveness of controls over financial reporting. Testing operating effectiveness involves determining whether the control operated as designed, whether the person performing it possesses the necessary authority and competence, and obtaining evidence about how the control operated at relevant times during the period.
The standard also addresses evidence quality. Evidence obtained directly by the auditor is generally more reliable than evidence obtained indirectly. Re-performance — the auditor independently executing the control or the procedure — provides more persuasive evidence than inquiry combined with observation.
What payment approval testing looks like in practice
Walk through a typical test of a payment release control:
- The auditor selects a sample of payments from the period.
- They request evidence that the approval control operated for each.
- The client extracts approval records from the ERP and, frequently, supplements with screenshots because the extract does not show what the approver saw.
- The auditor inspects the evidence and concludes.
- The workpaper records inspection of client-provided documentation.
Step three is where the quality problem sits, and step five is where it is recorded honestly. Nobody in that sequence is doing anything improper; they are working with the artefacts that exist.
Why a screenshot is weak evidence
| Property | Screenshot | Signed approval receipt |
|---|---|---|
| Produced by | The entity being audited | The approver's own credential |
| Mutable after the fact | Yes, trivially | No — alteration invalidates the signature |
| Shows what the approver saw | Only what was captured | The rendered content is part of the signed object |
| Verifiable by the auditor | No | Yes, offline against a published key |
| Requires system access to verify | n/a | No |
| Evidence type | Inspection | Verification, approaching re-performance |
The fourth and fifth rows are the ones that change the audit. An auditor who can verify without system access avoids the provisioning, scoping and data protection negotiations that direct access entails.
What a receipt supplies for each element of the test
AS 2201's elements map cleanly onto the fields of a payment approval receipt.
| Testing element | Evidence in the receipt |
|---|---|
| The control operated | A signature exists for this payment |
| It operated at the relevant time | Timestamp inside the signed statement |
| The performer had authority | Credential bound to a named approver; delegation reference where applicable |
| What was approved | The rendered material terms, hashed into the signature |
| Consistency of operation | The population of receipts across the period, countable |
That last row enables something sampling cannot: the auditor can determine coverage across the whole population rather than inferring it from a sample, because verification is cheap enough to run on everything.
Running a pilot with your audit team
- Instrument payment approvals above your materiality-relevant threshold for one quarter, alongside the existing evidence process.
- At the interim walkthrough, provide both packages for the same sample.
- Ask directly: does this change your testing approach, your sample size, or your reliance?
- If the answer is no, the benefit is internal assurance only — real, but a different business case. If yes, you have a cost reduction to quantify.
The professional judgement boundary
Whether a given firm treats verification of a cryptographic receipt as re-performance, or as inspection of more reliable evidence, is a methodology question for that firm. It is not something a client or a vendor can assert on their behalf.
What can be said without overreach is that the evidence is independently verifiable and not produced by the entity under audit, which are the two properties the standard identifies as increasing reliability.
Why sampling exists, and what removes it
An auditor cannot review five hundred releases by hand, so they sample and extrapolate. That is accepted practice and it is a workaround for an evidence format requiring human reading. It carries a known blind spot: control failures outside the sample are invisible, and everyone involved prices that in.
| Form | Integrity | Attribution | Re-performable |
|---|---|---|---|
| Chat screenshot | None | An account name | No |
| Ticket export | Application state | An account | No |
| System report | Application state | An account | Partly |
| Signed receipt | Verifiable | A credential | Yes |
Objections and honest limits
“Our auditor accepts screenshots today.” Many do, because the alternative has not been available. That is a statement about supply rather than about the evidence's quality, and it changes as soon as a peer supplies something better.
“Full-population testing sounds expensive.” It is a command. The cost is in producing evidence designed to be checked; once it exists, testing 500 releases is faster than testing 40.
Producing evidence an auditor can test
- Generate it as part of the control. Not as a reporting step afterwards — evidence assembled later can be assembled selectively.
- Bind it to the artefact. The commit, the payment payload, the exact object that executed.
- Make it attributable to a person. A credential, with the authenticator's verification state.
- Make it re-performable without you. A published key and a verification procedure the auditor can run.
Terms used here
- Operating effectiveness
- Whether a control actually functioned throughout the period, as distinct from whether it was well designed.
- Re-performance
- The auditor independently executing the control or its verification. The strongest evidence class, and rarely available for human approvals.
- Population testing
- Testing every instance rather than a sample, which becomes practical once verification is mechanical.
Frequently asked questions
Will our auditor accept receipts as evidence? That is their professional judgement under their firm's methodology. The receipt has properties the standard associates with more reliable evidence; acceptance remains theirs to determine.
Does this remove the need for screenshots? Run both for a cycle and let the audit team's feedback decide. Removing the existing process before that feedback would be premature.
What about controls other than payment approval? The same mapping works for access provisioning, change approval and certification. Payment approval is a good first pilot because the population is well defined.
Does the auditor need our systems? No. Verification uses published keys and open-source tooling, which is much of the practical appeal.
Why are screenshots weak? They are images of mutable records, show an account rather than a verified person, and cannot be re-performed.
Does this eliminate sampling? For the controls it covers, yes. The full population can be verified in seconds, and the auditor's attention moves to exceptions.
What is the auditor actually testing? Whether the control operated throughout the period, at sufficient frequency, by someone with authority — not whether a control exists.
Where this fits in Manav
Manav produces the receipt as a by-product of the approval itself, bound to the payment payload and the approver's credential. An auditor verifies the whole population against a published key without touching your systems.