Contract Audits: Scope, Evidence and Corrective Actions

A contract audit is a structured examination of whether contract terms, performance and financial records agree. It starts with a defined question, tests supporting evidence and records exceptions for response and correction. A private supplier audit might compare invoices with agreed rates and acceptance records. A federal government cost audit has a different remit: FAR 42.101 describes financial and accounting reviews of estimated or incurred costs and related controls.

Use the audit as a feedback step in contract lifecycle management: a finding should improve the payment, approval or performance process that produced it. This guide supplies a completed fictional workpaper, a reusable audit plan and closure tests. It is general information, not legal advice.

Decide what kind of audit you mean

“Contract audit” can describe several activities. An operational audit checks a private agreement against what happened. A supplier compliance audit examines a defined obligation, such as reporting or approved subcontracting. A government cost audit addresses the applicable procurement regime. An audit of blockchain smart-contract code is a separate technical service; its testing methods and pricing do not answer this business-contract question.

A contract review checklist helps establish the agreed baseline before signing. Auditing tests subsequent events against that baseline. Neither a payment mismatch nor an absent document establishes fraud by itself.

Confirm access before requesting supplier records

Separate records your organization already holds from records you want another party to disclose. Read the actual audit clause and applicable law before making a demand. Identify who may inspect, which records are covered, the notice required, the period reviewed, permitted locations, confidentiality safeguards, restrictions on copying, cost allocation and the process for disputes. A clause headed “audit” is not permission to access every system or employee file.

If the agreement contains no clear access right, route the question to counsel and consider a consensual, limited information request. Do not present an internal checklist as authority to compel disclosure. Privileged communications, personal information, third-party confidentiality and security restrictions require separate review. Use extracts or controlled access where appropriate rather than collecting unrelated records.

For a California-governed agreement, Civil Code section 1636 addresses the parties’ ascertainable, lawful mutual intention, while section 1641 requires reading the contract as a whole. These interpretation rules do not create a universal private audit right. Read access, confidentiality, notice and remedy provisions together.

Write a short audit plan

Start with one answerable question: “Were September invoices calculated using the effective rate schedule, and do paid milestones have the acceptance evidence the contract requires?” Avoid promising a review of every legal, security and financial risk in one exercise.

CONTRACT AUDIT PLAN
Agreement and effective amendments: [IDs, dates, precedence]
Question and criteria: [specific contractual requirements]
Population: [all records within a stated period and boundary]
Selection: [full population or sample; rationale and limits]
Access authority: [clause, consent or applicable legal basis]
Records requested: [minimum necessary items]
Reviewer and independence/conflicts: [names and roles]
Response process: [recipient, delivery route, agreed deadline]
Finding categories: [confirmed discrepancy / missing evidence / no exception]
Closure: [owner, action and independent recheck]
Restrictions: [confidentiality, access, retention and permitted use]

Build the document set from a reconciled contract repository, not whichever attachment is easiest to find. Include the executed version, incorporated schedules, effective changes and evidence of approval. Record missing versions before calculating a supposed overcharge.

Worked example: four invoices from a population of eighteen

All names, documents, amounts and events below are fictional. We ran arithmetic checks on a locally created synthetic dataset. No organization was audited, and no real supplier, bank or acceptance records were inspected.

Alder Operations engages North Services. The invented agreement uses a $100 unit rate and requires a signed acceptance record before paying milestone M2. Its limited audit clause permits review of relevant billing records after five calendar days’ notice, excluding the receipt day. The fictional notice is received October 1 for an October 6 review. This timing comes from the invented clause, not a general legal notice rule.

The population is eighteen September invoices under this agreement. We deliberately select three flagged cases and one ordinary invoice for comparison. This is a judgmental selection, not a random sample. The script contains all eighteen invented invoices, but the reported audit tests cover only the four selected invoices. Do not extrapolate an error rate or savings estimate to the other fourteen.

The confirmed discrepancies total $200 + $600 = $800. The $2,000 milestone remains a separate evidence question. Adding it to $800 and announcing “$2,800 recovered” would misstate both the evidence and the status. Even the $800 is an observed discrepancy in this invented dataset, not a court determination of entitlement or an accusation of dishonest conduct.

Make each exception reproducible

Keep the contract criterion, observation and inference in separate fields. A second reviewer should be able to locate the exact schedule, invoice and payment entries that support the result. Preserve originals and version identifiers; record how the data was obtained and any gaps. Use the vendor obligation facts record when the issue may also involve a performance dispute.

FILLED EXCEPTION RECORD, FICTIONAL
Finding: A02, rate discrepancy on INV02
Criterion: signed Rate Schedule R1, $100 per unit
Documents: R1, complete supplied amendment set, INV02, PAY2
Observation: 40 units invoiced at $105; $4,200 paid
Calculation: $4,200 minus (40 x $100) = $200
Classification: confirmed discrepancy in supplied fictional records
Supplier response: agrees to a $200 credit, CR02
Owner: finance reviewer; procurement confirms rate baseline
Closure requirement: credit applied and reconciled to the ledger
Status at initial review: open; credit promise alone is insufficient
Limits: no legal entitlement finding; no population extrapolation

For INV07, record the missing acceptance evidence and request it before calling the payment improper. The supplier might produce a valid record, the parties might dispute what constitutes acceptance, or further review might reveal a control failure. Record those possibilities without silently converting them into findings.

Respond, correct and verify closure

Give the responsible person a clear statement of the evidence and the question to answer. Set a practical response date through the applicable process. If a formal contractual notice is required, follow the actual clause and retain delivery evidence. An audit report does not automatically satisfy a breach notice, stop payment, authorize setoff or terminate the agreement.

In the fictional follow-up, the supplier issues credit CR02 for $200 and it is actually applied against INV19. A separate $600 refund RF11 is matched to bank entry BANK08 and the ledger. Those invented closure records reconcile the $800. They illustrate what to verify, not an actual recovery. INV07 remains open because acceptance evidence is still missing.

Our local calculation checks confirmed the $800 discrepancy total, the separate $2,000 unresolved amount and the matching $800 in synthetic closure entries. They did not authenticate documents, assess sampling assurance or establish legal compliance. Fix the underlying controls too: protect the approved rate table, reconcile payment references and require the agreed evidence before the next milestone payment. Assign those tasks within contract administration.

United States federal audits have a different scope

FAR 42.101 places government contract auditing within financial and accounting review; DCAA normally performs these audits, with stated exceptions and other arrangements. This is not a rule appointing DCAA to audit ordinary private supplier agreements.

Where included and applicable, FAR 52.215-2, Audit and Records, Negotiation sets defined examination and access rights. Its cost-examination paragraph identifies contract types; other paragraphs address certified cost or pricing data, pertinent records and reports. Record availability is generally tied to three years after final payment, subject to shorter FAR periods, longer statutory or contractual requirements and additional termination or dispute conditions. Do not import that period into every private contract.

For GSA, GSAM subpart 542.70 also calls for internal controls around variable contract features rather than sole reliance on audit rights. The exact solicitation, awarded clauses, applicable agency rules and authorized scope matter. The private workpaper above is an editorial aid, not a federal audit standard.

Contract audit checklist

[ ] State the audit question, agreement and review period.
[ ] Confirm access authority and protect restricted information.
[ ] Reconcile the executed contract, schedules and amendments.
[ ] Define the complete population before selecting records.
[ ] Explain selection and prohibit unsupported extrapolation.
[ ] Match rates, quantities, acceptance and payment references.
[ ] Separate confirmed discrepancies from missing evidence.
[ ] Preserve source IDs, calculations and supplier responses.
[ ] Assign corrective actions and verify actual closure evidence.
[ ] Record untested areas, open questions and the follow-up date.

Frequently asked questions

What is the purpose of a contract audit?

To answer a defined question about compliance, performance or charges using supporting records, then document findings and corrective action. Specify the context before choosing tests.

How is an audit different from reviewing a contract?

Pre-signing review assesses proposed terms. An operational audit compares agreed terms with subsequent records and events. A review can establish the criteria that the later audit uses.

Can we audit a supplier without an audit clause?

Do not assume a right to compel records. Review applicable law and the agreement with counsel; consider a consensual request. An internal review of your own records and compelled access to another party’s records are different questions.

Does a missing document mean a breach occurred?

It identifies an evidence gap. Check what the contract requires, whether the document exists elsewhere and what the party says. A legal conclusion needs more than a blank folder.

How many invoices should we sample?

There is no universal number in this guide. Define the population, risk, objective and assurance needed. Obtain appropriate audit expertise for statistical sampling. Four deliberately selected fictional invoices do not establish a population-wide error rate.

What should an audit report include?

Scope, criteria, selection method, evidence, calculations, confirmed and unresolved findings, responses, owners, closure tests and limitations. Distinguish proposed credits from credits applied or refunds received.

Prepared by the Viaclause editorial team. The worked audit uses synthetic records and local arithmetic checks only. The banner is an AI-generated fictional documentary illustration.

Sources

• FAR 42.101, contract audit responsibilities.
• FAR 52.215-2, Audit and Records, Negotiation.
• GSAM subpart 542.70, audit of contractor records.
• California Civil Code section 1636, mutual intention.
• California Civil Code section 1641, reading the whole contract.