{
 "slug": "pcaob-auditing-standard-2201-external-auditors-actually-require",
 "topic_id": "TOPIC-008",
 "cluster": "B2B Wire, AP & Treasury Payment Release",
 "tier": "Tier B",
 "title": "What external auditors actually require for electronic payment approvals",
 "summary": "Companies submit chat screenshots and ticket exports to evidence payment approval controls. AS 2201 asks for evidence of operating effectiveness, and a screenshot is the weakest form of it that auditors accept because nothing better exists.",
 "lede": "Ask an audit senior what they would prefer to receive for payment approval testing and they will describe something no client can currently produce. Ask what they accept and they will describe a folder of screenshots.",
 "date": "2024-09-28",
 "category": "Compliance",
 "author_id": "tobias-lindqvist-rao",
 "tags": [
  "PCAOB",
  "AS 2201",
  "SOX",
  "audit evidence",
  "payment approval",
  "ITGC"
 ],
 "image_title": "PCAOB AS 2201 Payment Approvals",
 "schema": "Article",
 "key_takeaways": [
  "AS 2201 requires the auditor to obtain evidence about the effective operation of controls, and evidence obtained directly by the auditor is more reliable than evidence provided by the entity.",
  "A screenshot is entity-produced, mutable and inspected rather than re-performed. Everyone in the process understands this.",
  "Signed approval receipts let an auditor verify independently, using open-source tooling, without access to the client's financial systems."
 ],
 "body": [
  {
   "type": "h2",
   "text": "What the standard asks for"
  },
  {
   "type": "diagram",
   "kind": "flow",
   "alt": "What the auditor tests, and where screenshots fail",
   "caption": "Design is the easy half. Operating effectiveness is where the evidence has to carry weight.",
   "nodes": [
    {
     "label": "Control design",
     "note": "usually fine"
    },
    {
     "label": "Did it operate?",
     "note": "needs instances"
    },
    {
     "label": "Throughout the period?",
     "note": "needs population coverage",
     "bad": true
    },
    {
     "label": "By an authorised person?",
     "note": "screenshot shows an account",
     "bad": true
    },
    {
     "label": "Can it be re-performed?",
     "note": "not from an image",
     "bad": true
    }
   ]
  },
  {
   "type": "p",
   "html": "PCAOB AS 2201 requires the auditor to test the design and operating effectiveness of controls over financial reporting. Testing operating effectiveness involves determining whether the control operated as designed, whether the person performing it possesses the necessary authority and competence, and obtaining evidence about how the control operated at relevant times during the period."
  },
  {
   "type": "p",
   "html": "The standard also addresses evidence quality. Evidence obtained directly by the auditor is generally more reliable than evidence obtained indirectly. Re-performance — the auditor independently executing the control or the procedure — provides more persuasive evidence than inquiry combined with observation."
  },
  {
   "type": "h2",
   "text": "What payment approval testing looks like in practice"
  },
  {
   "type": "p",
   "html": "Walk through a typical test of a payment release control:"
  },
  {
   "type": "ol",
   "items": [
    "The auditor selects a sample of payments from the period.",
    "They request evidence that the approval control operated for each.",
    "The client extracts approval records from the ERP and, frequently, supplements with screenshots because the extract does not show what the approver saw.",
    "The auditor inspects the evidence and concludes.",
    "The workpaper records inspection of client-provided documentation."
   ]
  },
  {
   "type": "p",
   "html": "Step three is where the quality problem sits, and step five is where it is recorded honestly. Nobody in that sequence is doing anything improper; they are working with the artefacts that exist."
  },
  {
   "type": "h2",
   "text": "Why a screenshot is weak evidence"
  },
  {
   "type": "table",
   "head": [
    "Property",
    "Screenshot",
    "Signed approval receipt"
   ],
   "rows": [
    [
     "Produced by",
     "The entity being audited",
     "The approver's own credential"
    ],
    [
     "Mutable after the fact",
     "Yes, trivially",
     "No — alteration invalidates the signature"
    ],
    [
     "Shows what the approver saw",
     "Only what was captured",
     "The rendered content is part of the signed object"
    ],
    [
     "Verifiable by the auditor",
     "No",
     "Yes, offline against a published key"
    ],
    [
     "Requires system access to verify",
     "n/a",
     "No"
    ],
    [
     "Evidence type",
     "Inspection",
     "Verification, approaching re-performance"
    ]
   ]
  },
  {
   "type": "p",
   "html": "The fourth and fifth rows are the ones that change the audit. An auditor who can verify without system access avoids the provisioning, scoping and data protection negotiations that direct access entails."
  },
  {
   "type": "h2",
   "text": "What a receipt supplies for each element of the test"
  },
  {
   "type": "p",
   "html": "AS 2201's elements map cleanly onto the fields of a payment approval receipt."
  },
  {
   "type": "table",
   "head": [
    "Testing element",
    "Evidence in the receipt"
   ],
   "rows": [
    [
     "The control operated",
     "A signature exists for this payment"
    ],
    [
     "It operated at the relevant time",
     "Timestamp inside the signed statement"
    ],
    [
     "The performer had authority",
     "Credential bound to a named approver; delegation reference where applicable"
    ],
    [
     "What was approved",
     "The rendered material terms, hashed into the signature"
    ],
    [
     "Consistency of operation",
     "The population of receipts across the period, countable"
    ]
   ]
  },
  {
   "type": "p",
   "html": "That last row enables something sampling cannot: the auditor can determine coverage across the whole population rather than inferring it from a sample, because verification is cheap enough to run on everything."
  },
  {
   "type": "h2",
   "text": "Running a pilot with your audit team"
  },
  {
   "type": "ol",
   "items": [
    "Instrument payment approvals above your materiality-relevant threshold for one quarter, alongside the existing evidence process.",
    "At the interim walkthrough, provide both packages for the same sample.",
    "Ask directly: does this change your testing approach, your sample size, or your reliance?",
    "If the answer is no, the benefit is internal assurance only — real, but a different business case. If yes, you have a cost reduction to quantify."
   ]
  },
  {
   "type": "h2",
   "text": "The professional judgement boundary"
  },
  {
   "type": "p",
   "html": "Whether a given firm treats verification of a cryptographic receipt as re-performance, or as inspection of more reliable evidence, is a methodology question for that firm. It is not something a client or a vendor can assert on their behalf."
  },
  {
   "type": "p",
   "html": "What can be said without overreach is that the evidence is independently verifiable and not produced by the entity under audit, which are the two properties the standard identifies as increasing reliability."
  },
  {
   "type": "h2",
   "text": "Why sampling exists, and what removes it"
  },
  {
   "type": "p",
   "html": "An auditor cannot review five hundred releases by hand, so they sample and extrapolate. That is accepted practice and it is a workaround for an evidence format requiring human reading. It carries a known blind spot: control failures outside the sample are invisible, and everyone involved prices that in."
  },
  {
   "type": "table",
   "caption": "Evidence quality, by form",
   "head": [
    "Form",
    "Integrity",
    "Attribution",
    "Re-performable"
   ],
   "rows": [
    [
     "Chat screenshot",
     "None",
     "An account name",
     "No"
    ],
    [
     "Ticket export",
     "Application state",
     "An account",
     "No"
    ],
    [
     "System report",
     "Application state",
     "An account",
     "Partly"
    ],
    [
     "<strong style=\"font-weight:600\">Signed receipt</strong>",
     "<strong style=\"font-weight:600\">Verifiable</strong>",
     "<strong style=\"font-weight:600\">A credential</strong>",
     "<strong style=\"font-weight:600\">Yes</strong>"
    ]
   ]
  },
  {
   "type": "h2",
   "text": "Objections and honest limits"
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Our auditor accepts screenshots today.”</strong> Many do, because the alternative has not been available. That is a statement about supply rather than about the evidence's quality, and it changes as soon as a peer supplies something better."
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Full-population testing sounds expensive.”</strong> It is a command. The cost is in producing evidence designed to be checked; once it exists, testing 500 releases is faster than testing 40."
  }
 ],
 "faq": [
  {
   "q": "Will our auditor accept receipts as evidence?",
   "a": "That is their professional judgement under their firm's methodology. The receipt has properties the standard associates with more reliable evidence; acceptance remains theirs to determine."
  },
  {
   "q": "Does this remove the need for screenshots?",
   "a": "Run both for a cycle and let the audit team's feedback decide. Removing the existing process before that feedback would be premature."
  },
  {
   "q": "What about controls other than payment approval?",
   "a": "The same mapping works for access provisioning, change approval and certification. Payment approval is a good first pilot because the population is well defined."
  },
  {
   "q": "Does the auditor need our systems?",
   "a": "No. Verification uses published keys and open-source tooling, which is much of the practical appeal."
  },
  {
   "q": "Why are screenshots weak?",
   "a": "They are images of mutable records, show an account rather than a verified person, and cannot be re-performed."
  },
  {
   "q": "Does this eliminate sampling?",
   "a": "For the controls it covers, yes. The full population can be verified in seconds, and the auditor's attention moves to exceptions."
  },
  {
   "q": "What is the auditor actually testing?",
   "a": "Whether the control operated throughout the period, at sufficient frequency, by someone with authority — not whether a control exists."
  }
 ],
 "sources": [
  {
   "t": "PCAOB AS 2201 — An Audit of Internal Control Over Financial Reporting",
   "u": "https://pcaobus.org/oversight/standards/auditing-standards/details/AS2201"
  },
  {
   "t": "PCAOB auditing standards",
   "u": "https://pcaobus.org/oversight/standards/auditing-standards"
  },
  {
   "t": "NIST — digital forensics and evidence handling resources",
   "u": "https://www.nist.gov/digital-evidence"
  },
  {
   "t": "RFC 8785 — JSON Canonicalization Scheme",
   "u": "https://www.rfc-editor.org/rfc/rfc8785"
  },
  {
   "t": "AICPA Trust Services Criteria (SOC 2)",
   "u": "https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022"
  }
 ],
 "related": [
  {
   "slug": "re-performable-evidence",
   "title": "Replacing the screenshot",
   "category": "Compliance"
  },
  {
   "slug": "erp-dual-authorization-flaw-sox-controls",
   "title": "The four-eyes illusion",
   "category": "Developer"
  },
  {
   "slug": "certification-evidence-standard",
   "title": "The rubber stamp is the product",
   "category": "Developer"
  }
 ],
 "image": "https://cdn.twc.sh/images/igcache/PCAOB%20AS%202201%20Payment%20Approvals/1200_630/blog.jpg",
 "wordcount": 937,
 "url": "/blog/pcaob-auditing-standard-2201-external-auditors-actually-require.html",
 "reading_time": "4 min read",
 "seo_title": "What auditors require for payment approval evidence",
 "meta_description": "Companies submit chat screenshots to evidence payment approval controls. AS 2201 asks for operating effectiveness, which a screenshot is not.",
 "hub": {
  "slug": "topics/payment-release-authorization",
  "title": "Payment release authorization"
 },
 "answer": "Evidence of operating effectiveness, not evidence that a control exists. Under PCAOB AS 2201 the auditor tests whether the control operated throughout the period, at sufficient frequency, by someone with the right authority. A chat screenshot evidences none of those things.",
 "answer_q": "What will an external auditor accept as evidence of payment approval?",
 "glossary": [
  {
   "term": "Operating effectiveness",
   "def": "Whether a control actually functioned throughout the period, as distinct from whether it was well designed."
  },
  {
   "term": "Re-performance",
   "def": "The auditor independently executing the control or its verification. The strongest evidence class, and rarely available for human approvals."
  },
  {
   "term": "Population testing",
   "def": "Testing every instance rather than a sample, which becomes practical once verification is mechanical."
  }
 ],
 "checklist": {
  "title": "Producing evidence an auditor can test",
  "id": "produce",
  "desc": "Four properties.",
  "steps": [
   {
    "name": "Generate it as part of the control.",
    "text": "Not as a reporting step afterwards — evidence assembled later can be assembled selectively."
   },
   {
    "name": "Bind it to the artefact.",
    "text": "The commit, the payment payload, the exact object that executed."
   },
   {
    "name": "Make it attributable to a person.",
    "text": "A credential, with the authenticator's verification state."
   },
   {
    "name": "Make it re-performable without you.",
    "text": "A published key and a verification procedure the auditor can run."
   }
  ]
 },
 "cta": {
  "title": "Where this fits in Manav",
  "html": "Manav produces the receipt as a by-product of the approval itself, bound to the payment payload and the approver's credential. An auditor verifies the whole population against a published key without touching your systems.",
  "href": "../docs.html",
  "label": "See audit evidence"
 }
}