Audits rarely go wrong because a company lacks money; they go wrong because the company cannot prove where the money went. For businesses that collect payments online, proof depends on reconciliation: the documented matching of customer payments, gateway settlements, bank deposits and ledger entries. When this evidence is scattered across spreadsheets and inboxes, audits become long and stressful. Using Payment Gateway Reconciliation Software helps teams build a controlled, repeatable process that auditors can follow with confidence. This article explains what auditors look for and how to prepare.
What Auditors Want to See
Auditors test whether reported numbers are complete, accurate and supported. For payments, they typically sample transactions and trace them from the customer order, through the gateway record, to the bank deposit and the ledger entry. They check cut-off at period end, to ensure that revenue and cash are recorded in the right period. They look at refunds and chargebacks, to confirm that reversals are recorded correctly. They review fees and tax. And they assess the controls around the process: who performs reconciliation, who reviews it, how exceptions are handled and how changes are authorised.
The Problems With Manual Evidence
Spreadsheet-based reconciliations can satisfy auditors, but they require effort and discipline. Files may be overwritten, formulas may change without a record, and it may be unclear who prepared or approved a version. When an auditor asks how a particular deposit was reconciled, the team must search through folders and emails. Different months may use different methods. Adjustments may lack explanations. Each of these weaknesses leads to extra questions, longer fieldwork and sometimes formal findings.
Building Evidence Into the Process
The best approach is to make evidence a by-product of the daily process rather than a separate project before the audit. Automated reconciliation records each import, each match and each manual action with a timestamp and user. It stores source files unchanged, so original data remains available. It keeps a history of rule changes and who approved them. When the auditor selects a transaction, the team can show the full trail within minutes.
Key Controls to Put in Place
Completeness: confirm that every source is included and that record counts and totals agree with provider dashboards. Accuracy: use consistent matching rules, tolerance limits and fee checks. Timeliness: reconcile at a defined frequency, with deadlines for clearing exceptions. Segregation of duties: ensure the person who prepares a reconciliation is not the only person who reviews or approves it, particularly for adjustments. Authorisation: require approval for write-offs or manual matches above a threshold. Access control: limit who can change rules, connections and settings, and review permissions regularly. Retention: keep source data, results and logs for the period required by regulation and company policy.
Exception Management as a Control
Auditors pay special attention to how unmatched items are handled. A growing list of aged, unexplained items suggests weak control. Define categories, owners and target dates for each exception. Review ageing weekly and escalate items beyond agreed limits. Document the reason and resolution of material items. A short note explaining why a difference arose and how it was cleared demonstrates control and saves time when questions arise.
Cut-Off and Clearing Accounts
At period end, payments captured but not yet settled sit in clearing or in-transit accounts. These balances should be explained at transaction level, with expected settlement dates. After period end, show that the items cleared as expected. If a clearing balance includes old items, explain them or write them off with approval. Auditors often test the first days of the next period to confirm that settlements relate to the right sales, so keep a clear list ready.
Refunds, Chargebacks and Fees
These are common audit focus areas because they affect revenue and expenses. Keep a register of refunds and chargebacks linked to original sales, with dates and outcomes. Reconcile fee totals to gateway statements and contracts, and keep invoices where tax credits are claimed. Show how provisions for expected chargeback losses are calculated and reviewed. A consistent method, applied every month, builds credibility.
Change Management and System Controls
Because rules drive the results, changes to them are a risk. Maintain a log of every rule creation, edit and deletion, with the reason, the person who requested it, the approver and the date. Test changes on sample data before applying them. Restrict administrative rights to a small group. Record changes to integrations, such as new gateways or bank accounts. If your reconciliation tool is hosted by a vendor, obtain their security reports and discuss how data is protected, backed up and recovered.
Preparing an Audit Pack
Assemble a standard pack for each period and keep it ready. A good pack contains the reconciliation summary by gateway and bank account, the list of settlements with matching totals, the exception list with explanations and ageing, the clearing account breakdown, the refund and chargeback register, the fee verification results, the journal entries posted and the sign-off of preparer and reviewer. Add a short narrative describing anything unusual, such as a change in gateway, a promotion that affected volumes, or a settlement delay caused by a bank holiday. When auditors arrive, the pack answers most of their questions before they ask.
Walkthroughs and Sampling
Auditors commonly begin with a walkthrough, where the team explains the process from payment to ledger. Prepare a simple diagram and a written procedure. Then they select samples. Practise tracing a few random transactions yourself. Can you show the order, the gateway reference, the settlement it belongs to, the bank credit and the journal entry? If any step takes long, improve your references or reporting before the audit. Also prepare to show how you detect and handle errors, for example by presenting an example of an exception from detection to resolution.
Regulatory and Tax Considerations
Depending on your location, payments may also involve tax and regulatory obligations. Collected taxes must be reported correctly, and fees may carry tax that you can claim only with proper documentation. Payment data may be subject to privacy and security rules, so limit sensitive information in reconciliation files and use secure channels. Retention periods vary, so agree on a policy with legal and compliance teams. Clear reconciliation records also support tax filings and responses to notices, since you can show how reported sales relate to money received.
Technology and Control Over Spreadsheets
Even with a reconciliation platform, teams still use spreadsheets for analysis. Control them. Store them in a managed location, restrict editing, and avoid using them as the system of record. If a spreadsheet is used for adjustments, document the logic and have it reviewed. Where possible, export from the platform instead of retyping. This reduces the risk of transcription errors and keeps evidence consistent.
Benefits Beyond the Audit
Strong controls do more than satisfy auditors. They reduce fraud risk by making unauthorised changes visible. They shorten the close by clearing items earlier. They improve trust among investors, lenders and partners who rely on your financial statements. They make acquisitions and fundraising easier, because due diligence teams can review clean records. And they reduce the stress on your team, who no longer need to reconstruct history under pressure.
A Maturity Path
Most teams move through stages. At the first stage, reconciliation is manual, monthly and dependent on individuals. At the second, it is documented and consistent, with templates and review steps. At the third, it is automated, daily and rule-driven, with exception workflows and logs. At the fourth, it is integrated with the wider finance process, feeding forecasts, reporting and risk monitoring. Assess where you are and choose the next step. Moving from stage one to stage three often delivers the largest gain in control and efficiency.
Questions to Ask Yourself
Could a new team member perform the reconciliation using only our documentation? Can we show who approved each manual adjustment? Do we know the age and value of every open item today? Can we trace any sampled payment end to end in a few minutes? Do we have a record of every rule change? If the answer to any question is no, you have found a place to strengthen controls before the next audit.
Frequently Asked Questions
Do auditors trust automated reconciliation? They trust controlled, documented and testable processes. Automated tools with clear logs and access control often provide stronger evidence than manual files.
How long should we keep reconciliation records? Follow legal and policy requirements, commonly several years. Ensure that source data and matched results can be retrieved and not only summaries.
Who should review reconciliations? A person independent of the preparer, with enough knowledge to challenge the results, such as a senior accountant or finance manager.
What if we find an old error during an audit? Disclose it, explain the cause and show the correction and the control you have added to prevent recurrence. Transparency builds credibility.
Case Example: Passing an Audit With Fewer Surprises
Consider a growing online services company that used to prepare for audits by gathering files for two weeks. Each year, the auditors asked for support on a sample of payments, and each year the team spent days locating gateway reports and explaining differences between the bank and the ledger. Two years running, the auditors raised a finding about aged unreconciled items and a lack of review evidence.
The company introduced daily reconciliation with automated matching and a simple governance routine. Every exception had an owner and a reason code. Items older than thirty days were reviewed by the finance manager each week. Rule changes were logged and approved. At month-end, a preparer and a reviewer signed off the reconciliation pack, and the signed pack was stored with the source files.
At the next audit, the auditors selected twenty-five transactions. For each, the team displayed the order, the gateway record, the settlement, the bank credit and the journal entry in a few minutes. The aged-item finding disappeared because the oldest open item was only a few weeks old and fully explained. Fieldwork on revenue and cash finished days earlier than in previous years, and the team spent the time they saved on improving forecasting. The change did not require extra people; it required a process that created evidence as work was done.
Training and Awareness
Controls work only when people understand them. Include reconciliation procedures in onboarding for new finance staff. Run a short annual refresher that covers the purpose of each control, what evidence must be kept and how to escalate problems. Encourage staff to raise concerns when they see weak spots, such as a connection that depends on a personal login or a spreadsheet that only one person understands. Treat such reports as improvements, not criticism. A team that sees controls as helpful rather than bureaucratic tends to maintain them better, and auditors notice the difference in attitude as well as in documentation.
Conclusion
Audit readiness is built every day, not in the weeks before the auditors arrive. By reconciling payments regularly, recording evidence automatically, separating duties, managing exceptions and controlling changes, finance teams create a process that stands up to scrutiny. The effort pays back through smoother audits, better decisions and greater confidence in the numbers. Start by reviewing your current process against the controls above, fix the largest gaps first and build toward a daily, documented and automated routine.
Comments