Detecting Duplicate Payments and Round-Tripping in an AP Audit

Accounts payable is one of the highest-volume, lowest-scrutiny areas in most organisations. A statutory or internal audit of AP typically samples a few dozen payments and tests them for authorisation and support. That approach finds process errors. It does not reliably find the payment made twice, or the money that left the group and came back.

Why duplicates slip through

A genuine accidental duplicate is often an exact match on vendor, amount, and invoice number — and even those are missed if the sample does not happen to include the pair. A deliberate one is disguised: the invoice number gets a suffix, two digits are transposed, an extra space is added, the same invoice is entered against a slightly different vendor code, or the second payment goes out weeks later. None of these look like duplicates in a spreadsheet sorted by date.

Near-duplicate detection

Full-population detection tests every payment against every other payment on combinations of vendor, amount, invoice reference, and date, and — importantly — on fuzzy matches:

• Same amount and date, invoice references one character apart
• Same invoice and vendor, amounts differing by a rounding or a tax component
• Same invoice paid against two vendor codes that resolve to the same bank account
• A credit note that reverses one payment but not the duplicate

Each candidate pair is ranked and linked to both source vouchers so the auditor can confirm or clear it quickly.

Round-tripping and circular flows

Round-tripping moves money out of the group and back to inflate turnover or disguise a diversion. It is invisible at the level of a single transaction because each leg looks ordinary. Tracing the full population of outgoing and incoming payments for chains — money out to a party and back to the group, or to a related entity, within a defined window — is what surfaces it. Matching beneficiary bank accounts on outgoing payments against employee and related-party accounts finds the more direct version.

Running it as a continuous check

Duplicate and circular-flow detection does not have to wait for the annual audit. Once the payment feed is defined and reconciled to the payment-run totals, the same tests run weekly, flagging new candidates as they appear — which is when recovery is still possible.