Compliance checks are written rules that test every document against company policy and the law before payment, with each result logged. They swap a reviewer's judgment call for a test that anyone can repeat and an auditor can replay.
Picture a Financial Controller at a 500-person manufacturer in India during quarter close. A supplier invoice above the approval limit has been paid, and the approval note says "approved". Nobody can say who approved it first, who approved it second, or what the invoice was tested against.
This is the gap between a reviewed document and a checked one. Reviews depend on whoever is looking that day. Rules depend on policy, and they run the same way on the 5th invoice and the 5,000th.
This guide shows how finance teams write those rules and where the MCA audit-trail rule stops short. It also covers what changes when agents run the checks and people keep the decisions.
Compliance Checks (definition)
Compliance checks are written rules that test a document, such as an invoice, purchase order or goods receipt, against company policy and legal requirements. Each check returns a pass or a fail, and the result is logged with the rule, the time and the owner. They differ from a review because the same document always gets the same outcome.
TL;DR
- Compliance checks are written rules that test each document against policy and law, then log the result.
- A reviewed invoice is not a checked invoice, and a checked invoice proves nothing unless the check was logged.
- Five rules cover most AP exposure: approval sequence, three-way match, duplicates, tax validity and bank-detail changes.
- The MCA audit-trail rule logs edits to the ledger. It does not log whether the document behind the entry was checked.
- The Two Trails test: for any paid invoice, can you show both the ledger trail and the document trail?
- Rules run on every document, while sample testing covers a small slice of the population.
- The cost of an unchecked invoice is the leakage and the accountability, not the invoice itself.
Why an Approved Invoice Is Only a Reviewed Invoice
Take an example policy: supplier invoices above Rs 5 lakh need approval from A, then B, then C. In a manual process, someone may check that three signatures exist. The sequence is not visible on the page, so it often goes unchecked.
The Head of AP sees a clean pack and releases payment. The risk sits with the people who signed, and a missed step can cost someone their role. The documents were reviewed, but the policy was never tested.
Internal audit leaders see the same weakness. In a 2026 IIA and AuditBoard survey of North American audit leaders, 65% named fabricated invoices or financial documents a top AI-enabled fraud risk. Another 57% cited a lack of the right technology or tools as a barrier.
Why a Checklist Is Not a Rule
The assumption is that a good checklist gives you control. The reality is that a checklist asks a person to remember the rule, while a rule runs whether anyone remembers or not.
| Question | Review with a checklist | Compliance check |
|---|---|---|
| Who decides pass or fail? | The reviewer on the day | The written rule |
| Same document, same result? | Not always | Always |
| Evidence left behind | A tick or a signature | Rule, result, time and owner |
| Coverage | As many files as the team can read | Every file in the population |
When two reviewers disagree on the same invoice, the disagreement can be less about the facts than about the rule. Neither may be able to point to a written rule that settles it.
Five Rules Every Finance Team Can Write This Week
You do not need new software to write these. You need policy turned into "if this, then that" statements:
- Approval sequence: if the invoice exceeds the limit, then the approvals must be recorded in the required order before payment is due.
- Three-way match: if the invoice, the purchase order and the goods receipt differ by more than the set tolerance, then hold the invoice.
- Duplicates: if the same vendor, invoice number or amount appears again within the set window, then flag it before payment.
- Tax validity: if the invoice falls under the e-invoice rules, then it must carry a valid IRN and a matching GSTIN.
- Bank-detail change: if a vendor's bank details differ from the master record, then a second person must confirm before payment.
A Head of Shared Services may be able to draft all five in an afternoon. The hard part is not writing them. It is agreeing on the tolerance and the owner for each one.
The Two Trails: What the MCA Audit-Trail Rule Does Not Cover
For financial years starting on or after 1 April 2023, accounting software must keep an audit trail and an edit log that cannot be disabled. Under Rule 11(g), the statutory auditor reports on it. That is a real control, and many finance teams now rely on it.
But it records changes to the books. It tells you who edited an entry and when. It does not tell you whether the invoice behind that entry was checked against policy before the entry was made.
The ledger trail answers who changed the record. The document trail answers whether the source document was tested, against which rule and by whom. A careful auditor wants both, and many teams may only be able to produce the first.
Where Sample Testing Leaves Gaps
Internal audit has long worked by sampling, because reading everything was impossible. The cost shows in the fraud data. The ACFE's 2026 report analysed 2,402 occupational fraud cases with more than $3.4 billion in losses, a median of $104,000 per case.
Consider, as an illustration, a Head of Internal Audit who tests 40 invoices from a population of 4,000. That covers 1% of the population. The rest rely on the reviewer having done the job, while a rule runs on all 4,000.
This is the shift behind continuous auditing. The auditor stops hunting for exceptions in a sample and starts reviewing the exceptions that rules have already surfaced.
What Changes When Agents Run the Rules and People Decide
Rules are repetitive and high volume, which makes them a good fit for agents. KlearStack uses its AP Invoice Agent to match and verify invoices against the rules and to route exceptions to a named person. The agents take the drudgery, and your team keeps the judgment and the final decision.
Consider a team handling 3,000 invoices a month and spending 8 minutes on each check, which is 400 hours of review. If the team reached the platform's stated 95%+ straight-through rate within 90 days, about 150 invoices would reach a person. That is roughly 20 hours at the same pace.
| Step | Manual review | Rules run by agents |
|---|---|---|
| Check | One reviewer per invoice | Every invoice, against written rules |
| Evidence | A signature or a note | A logged result per rule |
| Exceptions | Found at audit or after payment | Routed to a named person before payment |
| Audit request | Reconstruct from emails | Replay the trail |
When Compliance Checks Will Not Help Yet
Rules need something to stand on. Four situations call for groundwork first:
- If the approval policy is unwritten or disputed, there is nothing to turn into a rule.
- If the vendor master is full of duplicates, the duplicate rule will drown in noise.
- If invoices arrive as photos in chat threads, they need a proper intake before checks can run.
- If volume is a few dozen invoices a month, a disciplined manual process may be enough.
The Cost of an Unchecked Invoice Is Not the Invoice
APQC's 2024 benchmarking, reported by Corpay, puts duplicate and erroneous payments at 0.8% of disbursements for top performers. The median organisation sits at 1.5% and the weakest at 2%. On an illustrative Rs 500 crore of annual payables, the median rate would be Rs 7.5 crore leaving the business.
That is the leakage. The larger cost is accountability, because the person who signed an invoice nobody checked can be the one answering for it. Finance teams that run written rules on every document and keep both trails turn that exposure into a logged exception.
