Introduction
A payment system that's processing transactions isn't the same as a payment system that's correct. Money can move through authorization, settlement, fees, refunds, chargebacks, cash handling, and reconciliation with errors hiding in plain sight the whole time.
Consider what happened in Avondale, Arizona. A November 2025 review found that 4 of 27 cash funds did not reconcile, according to a City of Avondale audit report.
Auditors couldn't verify two cash machines because access wasn't available during the review. Transactions were still processing. The controls behind them weren't fully working.
This matters even more for government agencies, tax collectors, courts, and utilities. Payment volume is high, channels multiply fast, and public funds carry extra scrutiny.
This article walks through a practical payment audit checklist, a step-by-step process, common findings, and the technology controls worth evaluating along the way.
Key Takeaways
- Audit the full payment lifecycle: initiation, authorization, settlement, reconciliation, and exceptions.
- Checklists must cover accuracy, security, vendor terms, access controls, refunds, and audit trails.
- PCI DSS and EMV support security but don't replace transaction testing or control reviews.
- Assign every finding an owner, corrective action, and follow-up date.
What Is a Payment Audit?
A payment audit is a structured review of how money is collected, processed, recorded, and reconciled. It examines transactions, systems, fees, controls, and documentation to confirm that what was collected matches what was posted and deposited.
That's a different exercise than an accounts payable audit. Invoice audits validate bills before an organization pays a supplier. Payment audits go the other direction, focusing on funds coming in from residents, taxpayers, and customers.
The Payment Lifecycle Auditors Map
A thorough audit traces each dollar through every stage:
- Payment initiation (online portal, counter, kiosk, or mail)
- Identity or account lookup
- Authorization
- Transaction capture
- Settlement
- Posting to the general ledger
- Refunds or reversals
- Reconciliation and reporting
Missing a stage means missing where errors typically hide, especially during handoffs between systems.
Objectives and Scope
The core objectives are consistent across agencies:
- Catch errors and duplicate activity
- Validate processor charges
- Reduce fraud exposure
- Confirm policy and contract compliance
- Strengthen accountability
Scope should reflect the actual channels in use. That might include online portals, staffed counters, payment terminals, self-service kiosks, and every payment type your agency accepts: cash, checks, cards, ACH, and digital wallets.
A narrow audit that only checks card transactions will miss problems sitting in the cash drawer or the ACH file.
Payment Audit Checklist: What to Review
A useful checklist starts with scope, not spreadsheets. Define the boundaries first:
- Set the audit period and materiality threshold
- Identify payment channels, departments, processors, and merchant accounts in scope
Then gather source documents before testing anything:
- Pull statements, transaction exports, and settlement reports
- Collect contracts, policies, and exception logs
Transaction Accuracy and Completeness
Pick a sample and trace it end to end:
- Compare the customer record, payment device or portal, processor record, settlement report, and general ledger for each selected transaction
- Test authorization status, amount, date, account identifier, payment method, convenience fee (if applicable), and final posted amount
- Flag missing transactions, duplicate records, altered amounts, failed reversals, and anything left unsettled
Fees, Contracts, and Processor Billing
Processor statements rarely match expectations perfectly. Compare each statement against:
- Contracted pricing and service fees
- Network charges, chargeback fees, and equipment costs
Before assuming a charge is wrong, pull the current contract. Merchant category codes and channel classifications can legitimately change pricing treatment.
Security, Cash, and Governance
- Confirm payment data handling aligns with applicable PCI DSS requirements and internal security policy
- Verify tokenization or encryption, restricted access, secure device configuration, and incident-response responsibilities
- Test cash acceptance, drawer records, deposit documentation, and check handling
- Confirm refunds and voids require authorization and trace back to the original transaction
- Reconcile processor settlements, bank deposits, and the general ledger, separating timing differences from unexplained variances
- Check that duties are segregated between processing, refund approval, reconciliation, and system administration
Treat certifications like PCI DSS attestations as evidence to verify, not proof that controls are working as intended.
How to Conduct a Payment Audit Step by Step
Running the audit itself follows a logical sequence. Skipping steps tends to produce findings that can't be defended later.
Define the objective and risk profile. Decide whether you're focused on fees, fraud, reconciliation, compliance, a new processor, or the full lifecycle. Prioritize high-volume, high-value, or exception-heavy areas first.
Map every payment flow. Document how a payment moves from the resident or customer through the interface, terminal, processor, bank, and general ledger. Note every approval, data transformation, and manual handoff.
Collect and protect the evidence. Preserve originals and limit access to sensitive data. Gather:
- Processor statements, raw transaction data, and settlement files
- Bank records, contracts, and fee schedules
- Refund reports, chargeback records, and user-access lists
Test transactions and reconcile totals. Select a risk-based sample and trace individual payments end to end. Separately compare daily totals across operational systems, processors, bank deposits, and the ledger.
Analyze exceptions and root causes. Distinguish one-off mistakes from recurring patterns. Classify findings as:
- Data-entry errors or duplicate payments
- Timing differences or billing issues
- Unauthorized adjustments or system-integration problems
- Document, escalate, and remediate. Record the condition, expected control, evidence, impact, root cause, owner, and due date. Loop in legal, finance, IT security, or the processor when fraud, sensitive data, or contractual noncompliance is involved.
Common Payment Audit Findings and Corrective Actions
Certain problems surface again and again across public-sector payment audits. Here's what to watch for.
Duplicate, Missing, or Misapplied Transactions
Duplicate submissions, incomplete reversals, and incorrect account identifiers push customer accounts and organizational records out of sync. Close the gap with:
- Duplicate detection
- Idempotency controls
- Exception queues
- A documented correction procedure
Refunds That Never Get Issued
A 2024 Sarasota County audit sampled 100 refund-credited accounts and found a customer had overpaid $634.40 on a closed utility account, with no refund issued for roughly four months, according to the Sarasota County Clerk and Comptroller's audit findings.
The root cause was simple: no formal customer-refund procedure existed. A written policy and a tracking log close that gap.
Unreconciled Settlements and Unexplained Variances
Timing differences, batching, fees, and manual adjustments all create legitimate gaps between systems. Build a reconciliation schedule that separates known timing differences from unresolved variances, and assign each exception an owner and resolution date.
Unauthorized Refunds, Voids, or Access Changes
Warning signs include unusual refund frequency, activity outside normal job duties, and shared credentials. Address this with:
- Role-based access controls
- Dual approval for sensitive actions
- Periodic access reviews
- Immutable audit logs
Documentation Gaps
A New York State Comptroller audit of Salamanca reviewed 1,835 collection entries tied to 29 deposits totaling nearly $2 million. 1,759 of those entries lacked duplicate press-numbered receipts, making it impossible for auditors to confirm timely deposits, per the New York State Comptroller's 2024 audit.
No funds were found lost or misappropriated. The finding was purely a documentation gap, but it still blocked a clean audit trail. Standardized receipting and consistent evidence retention would have closed it.
When to Audit and Who Should Be Involved
Run a baseline audit before launching a new processor, payment channel, kiosk fleet, or fee structure. After that, schedule recurring reviews based on transaction volume and risk level.
Additional triggers worth watching for:
- Unexplained reconciliation variances
- Rising chargebacks
- Unusual refund activity
- Processor or bank changes
- Security incidents
- Repeated customer complaints
- Major system updates
Timing is only half the control. Who owns the work matters just as much.
Responsibility shouldn't sit with one department. Typical stakeholders include:
- Finance and treasury
- Accounts receivable
- IT and information security
- Compliance and internal audit
- Department owners
No single person should control initiation, approval, reconciliation, and system administration all at once. Public agencies should also document management approval and any applicable procurement or records-retention rules before changing payment procedures. Retention periods and requirements vary by state and program.
Using Technology to Strengthen Payment Audit Controls
Centralized transaction reporting, automated reconciliation, exception alerts, and searchable audit logs increase how much of a payment environment you can review. They don't replace human investigation, but they make it faster to find where to look.
KIOSK PAY STATION's government and utility bill-payment work illustrates the kind of control-relevant feature set worth evaluating in your own environment: PCI-DSS-compliant, EMV-certified processing with encryption, support for cash, check, card, and e-wallet payments, and export-ready data built for reconciliation workflows rather than as a substitute for them.
When Riverside County deployed two self-service kiosks, they collected $3.01 million over seven days, outpacing eight staffed cashier stations that processed $2.4 million over the same period. That's a throughput story, not an audit exemption. The transactions still need testing.
What to Verify on a Kiosk or Self-Service Channel
- Device inventory and physical tamper checks
- Software version and update history
- Accessibility and language settings
- Cash or check handling accuracy
- Receipt and account-lookup accuracy
- Uptime and monitoring records
- Transaction-to-settlement matching
- Maintenance history and log access
Automation should route exceptions to accountable staff, not resolve them automatically. A system that auto-approves an unusual refund or a failed reconciliation without human review is a control gap waiting to be found in your next audit.
Frequently Asked Questions
What is a payment audit?
A payment audit is a review of payment transactions, fees, systems, controls, security, settlement, and reconciliation. Its purpose is to catch errors, reduce risk, and identify where processes need improvement.
What should you not say during an audit?
Avoid speculation, unsupported conclusions, blame, or minimizing discrepancies. Stick to what the records actually show, and escalate any question you can't answer with evidence.
What are the four main types of audits?
The four types most often cited are internal, external (independent), compliance, and operational or financial. A single payment review frequently combines elements of more than one type.
How often should a payment audit be performed?
Use a risk-based schedule with recurring monitoring. Add targeted reviews after processor changes, new system launches, security incidents, or a spike in variances or chargebacks.
What documents are needed for a payment audit?
Typical files include:
- Processor statements and transaction-level data
- Settlement, bank, and reconciliation reports
- Contracts, fee schedules, policies, and prior findings
- Refund, chargeback, and access-log records
