Contract compliance audits: recovering overpayments from suppliers

Supplier spend is one of the largest costs in most organisations, yet few check what they were charged against what the contract allows. A contract compliance audit closes that gap. It tests supplier invoices, rates, rebates, variations and cost claims against the agreed terms, quantifies any overpayment and recovers it. This guide explains what a contract compliance audit involves, when to commission one, where overpayments usually arise, what data you need, how recovery works without damaging a good supplier relationship, and what to do if the evidence starts to point towards fraud.

The subject has particular weight for public bodies, because most of the Procurement Act 2023, which brought in new contract management duties, came into force on 24 February 2025.¹ Audit committees in every sector are also asking harder questions about value for money from large contracts, and a well-run contract audit answers them with evidence.

What a contract compliance audit is

A contract compliance audit is an independent review of whether a supplier, and your own organisation, have performed a contract in line with its terms. The focus is usually financial: were the right prices charged for the right quantities, were rebates and service credits applied, were variations properly authorised and valued, and were open-book costs allowable? It differs from a procurement audit, which looks at how a contract was awarded, and from the external audit of your accounts, which is not designed to find supplier overcharging.

A good contract audit has two outputs: a quantified schedule of amounts owed back to you, supported by evidence the supplier can verify, and an explanation of why the errors happened, so that the controls can be fixed.

When to commission one

• High-value or long-running contracts with complex pricing: rate cards, indexation, volume tiers or bundled services.
• Cost-reimbursable, target cost or other open-book contracts, where the price depends on the supplier’s own records.
• Contracts with many variations, change orders or compensation events.
• Before agreeing a final account, renewing a contract or re-tendering, while you still have commercial leverage.
• After a system migration or a change in the team managing the contract.
• When spend has grown faster than activity and nobody can explain why.

Public contracts under the Procurement Act 2023

For contracting authorities covered by the Procurement Act 2023, the Act’s contract management provisions bear directly on compliance. Most public contracts carry an implied term that valid, undisputed invoices are paid within 30 days (section 68). For contracts above £5 million, authorities must normally set at least three key performance indicators (section 52) and assess performance against them at least once every twelve months. Authorities must also publish information where a supplier’s breach leads to termination, damages or a settlement, or where poor performance is not put right (section 71). Most modifications require a contract change notice first (section 75). Devolved Scottish authorities are generally excluded from the Act and follow Scottish procurement legislation.² None of this replaces a contract audit, but weak contract records make accurate notices harder, and a settlement reached after an audit may need to be considered against the section 71 duty.

Right-to-audit clauses: what they should contain

Your ability to audit a supplier depends on the contract. Without a clear audit clause you are limited to your own records. The Institute of Internal Auditors’ Third-Party Topical Requirement, issued on 15 September 2025 and effective from 15 September 2026, sets a baseline for internal audit’s assessment of third-party governance, risk management and control.³ IIA commentary on applying it lists audit rights among the contract clauses that should be applied consistently, alongside indemnity, data security and exit plans.⁴

Drafting is a matter for your lawyers, but in practice an effective clause covers the following points:

• Scope of records: books, accounts, invoices, timesheets, payroll extracts, subcontractor invoices, rebate calculations and system data relevant to the charges, in electronic form where it exists.
• Who may audit: your organisation, its internal auditors and any independent third party you appoint, subject to reasonable confidentiality undertakings.
• Access: reasonable notice, access to premises, systems and people who can explain the records, and a timescale for producing information.
• Retention and survival: a records retention period that runs beyond expiry or termination and is at least as long as the period within which you could bring a claim, with the audit right expressly surviving the end of the contract.
• Flow-down: an obligation on the supplier to secure equivalent rights over its subcontractors’ records where their costs are passed through.
• Consequences: repayment of overcharges within a set period, the right of set-off against future payments, interest, and an agreed allocation of audit costs where overcharging exceeds a stated level.
• Definitions: for open-book contracts, a clear definition of allowable cost, fee and disallowed cost, so that disputes are about facts rather than meaning.

Where supplier overpayments typically arise

In practice, most overpayments are not fraud. They come from complex pricing, manual processes, poor data and contract terms that the people approving invoices have never read. The table below sets out the finding types that commonly arise in contract audits, their usual root causes and the data needed to test them.

Finding type	Typical root cause	Data to request
Pricing and rate errors	Rates not loaded into the finance system; superseded rate card used; wrong grade or band charged	Signed price schedules and rate cards, invoice line detail, timesheets or delivery records
Indexation and annual uplifts	Uplift applied early, compounded incorrectly or based on the wrong index	Indexation clause, published index values, invoices either side of each uplift date
Duplicate payments	Same invoice paid twice from paper and electronic copies, re-keyed references, duplicate supplier records	Full payments ledger, supplier master file, invoice images and remittances
Unapplied rebates, discounts and credit notes	Volume rebates not claimed; early payment discounts missed; credit notes issued but never offset	Rebate terms, volume data, supplier statements, credit note listings
Change orders and variations	Work instructed informally; variations valued at the supplier’s rates rather than the contract’s mechanism; overlap with base scope	Change control log, approvals, variation valuations, original scope and specification
Open-book and cost-reimbursable costs	Costs outside the allowable cost definition; fee applied to ineligible items; overheads recovered twice	Supplier cost ledgers, payroll and timesheet records, subcontract accounts, fee calculations
Retention	Retention not deducted, released early or released in full despite outstanding defects	Retention ledger, payment certificates, completion and defects certificates
Service credits and deductions	Performance failures recorded but credits not calculated or not deducted	Service level reports, KPI data, service credit schedule
Quantities and goods not received	Invoices approved without goods receipt; partial deliveries billed in full	Purchase orders, goods received notes, delivery and site records
Expenses and pass-through charges	Mark-ups on items meant to be at cost; expenses outside the agreed policy	Expenses clause, receipts, third-party invoices

Open-book and target cost contracts

Open-book arrangements carry the greatest risk because the price is built from the supplier’s own records. In construction, the NEC4 Engineering and Construction Contract shows the pattern. Under Option C, a target contract with an activity schedule, the contractor is paid Defined Cost plus a fee, with any difference against the target shared through the pain/gain mechanism. Defined Cost is set by a schedule of cost components and must be evidenced, and certain costs are disallowed and borne by the contractor. Option E is cost reimbursable, with no pain/gain share.⁵ An audit of such a contract tests whether costs fall within the schedule, whether disallowed costs were excluded, whether the fee was applied only to eligible cost, and whether the target reflects agreed compensation events.

Data, documents and analytics for a contract audit

The quality of a contract audit depends on the quality of the data request. Ask early, be specific, and ask for full populations rather than samples wherever possible. A typical request includes:

• the signed contract, all schedules, every variation and side letter, and any framework call-off terms;
• a line-level extract of invoices and payments for the audit period, with the supplier master file;
• purchase orders, goods receipt records and approval trails;
• change control logs, instructions and variation valuations;
• performance reports, KPI data and service credit calculations;
• rebate statements, credit notes and supplier statements;
• under the audit clause, the supplier’s own cost records, timesheets and subcontract accounts.

Analytics turn this data into findings. Useful tests include re-pricing every invoice line against the contract rate; fuzzy matching on invoice number, amount, date and supplier to find duplicates; comparing invoiced quantities with orders and receipts; checking the timing and rate of uplifts; recalculating rebates from volume data; and flagging invoices dated after contract expiry. Testing the whole population matters for recovery: a sample error can only be extrapolated, and suppliers rarely repay an extrapolation, whereas a population test gives a line-by-line schedule they can check.

The contract compliance audit process, from scoping to recovery

1. Select and scope. Rank contracts by spend, pricing complexity, known issues and the strength of the audit clause, then agree the period and finding types in scope.
2. Read the contract. Summarise the terms that drive payment: rates, uplifts, rebates, retention, service credits and allowable cost.
3. Notify the supplier in line with the audit clause, explaining scope and timetable.
4. Collect and analyse data, starting with your own records, then the supplier’s where the contract allows.
5. Validate findings. Clear false positives internally first. Each finding needs the contract reference, the calculation and the source documents.
6. Share and resolve. Issue a schedule of findings, allow the supplier time to respond, and agree, adjust or withdraw each item on the evidence.
7. Recover by refund, credit note or set-off as the contract allows, and record the recovery.
8. Fix the cause by agreeing control improvements with the contract owner and finance.

Time limits for recovering overpayments

Time limits shape the audit period. In England and Wales, an action founded on simple contract cannot be brought more than six years after the cause of action accrued.⁶ The period for an action on a specialty, which includes a contract executed as a deed, is twelve years.⁷ Where an action is based on the defendant’s fraud, where a relevant fact has been deliberately concealed, or where the action is for relief from the consequences of a mistake, the period does not start until the claimant discovered the fraud, concealment or mistake, or could with reasonable diligence have discovered it.⁸

Scotland works differently. Under the Prescription and Limitation (Scotland) Act 1973, an obligation is extinguished if it subsists for a continuous period of five years without a relevant claim being made or the obligation being relevantly acknowledged. Periods during which the creditor did not make a claim because of the debtor’s fraud, or because of error induced by the debtor’s words or conduct, are not counted, but only until the creditor could with reasonable diligence have discovered the fraud or error.⁹ The five-year prescription applies to obligations arising from a contract and to obligations based on the redress of unjustified enrichment, which is how the repayment of money paid in error is usually framed.¹⁰ In practice, audit the most recent periods first, act promptly, and take legal advice before relying on an older claim.

Recovery and the supplier relationship

Recovery is easier, and the relationship survives, when the audit is run as a joint exercise in getting the numbers right rather than an accusation. A few practices make a large difference:

• Tell the supplier at the start what you are testing and why. Contract audits should be routine contract management, not a sign of distrust.
• Report underpayments as well as overpayments. It builds credibility.
• Settle clear errors, such as duplicates and wrong rates, quickly, and take matters of interpretation through the contract’s dispute process.
• Agree the recovery route in writing and keep the contract manager involved, because they own the relationship after the auditors leave.

Public bodies have less room to write off amounts owed. The Scottish Public Finance Manual, for example, states that public sector organisations should always pursue recovery of overpayments, irrespective of how they came to be made. For overpayments to suppliers and contractors, where a request for repayment is refused and set-off is not possible, the organisation should consider legal action, with the effort proportionate to the amount and circumstances.¹¹ Document and approve any decision not to pursue a finding.

When findings suggest fraud

Occasionally the pattern does not look like error. Indicators include altered or reused documents, timesheets for people who were not on site, untraceable subcontractors, overcharging concentrated on one approver, and resistance to providing records the contract clearly requires. When that happens, change approach straight away:

1. Stop discussing the findings with the supplier and with any staff who may be involved.
2. Preserve data extracts, invoices and system logs, recording how each was obtained.
3. Escalate under your fraud response plan and, where appropriate, involve legal advisers so the investigation is structured with privilege in mind.
4. Commission an independent fraud investigation by people trained in interviewing, evidence handling and reporting to a standard that will stand up to civil, disciplinary or criminal proceedings.

Large organisations should also remember that the failure to prevent fraud offence under the Economic Crime and Corporate Transparency Act 2023 came into effect on 1 September 2025. Home Office guidance makes clear that an organisation is not liable where it is the victim or intended victim of the fraud, so a supplier overcharging you does not engage the offence. A supplier providing services for or on your behalf can, however, be an associated person, so a fraud by that supplier intended to benefit your organisation can.¹² Our guide to the failure to prevent fraud offence explains how to build procurement and contract risks into your fraud risk assessment.

Strengthening contract controls

Preventing leakage is better than recovering it. The controls that most often close the gaps a contract compliance audit finds are:

• a contract register with an owner, value, expiry date and key commercial terms for each contract;
• contract rates and uplift dates loaded into the finance system, so invoices are matched to agreed prices;
• three-way matching of order, receipt and invoice, with reviewed exceptions;
• supplier master file controls, including duplicate checks and verification of bank detail changes;
• formal change control, with variations approved within clear limits set out in your delegation of authority matrix;
• rebate, retention and service credit trackers maintained by the contract owner and reconciled to the ledger;
• a rolling programme of contract audits, prioritised by risk, reported to the audit committee.

These controls matter most where contracts are long, complex and heavily varied, as target cost and term maintenance contracts in construction, real estate and energy often are.

How we can help

Our procurement and contract audits test supplier charges against contract terms, quantify overpayments line by line and support recovery, while recommending the control changes that stop leakage recurring. Where the evidence points to deliberate wrongdoing, our independent fraud investigations team can take the matter forward. We work with organisations in construction, real estate and energy and across other sectors. To discuss a contract you are concerned about, book a free 20-minute call.

This article is general guidance, not legal advice. Take advice on your organisation’s specific circumstances.

Frequently asked questions

What is a contract compliance audit?

A contract compliance audit is an independent review of whether a supplier has charged and performed in line with the contract. It tests invoices, rates, rebates, variations and open-book costs against the agreed terms, quantifies any overpayment and supports its recovery. It also identifies the control weaknesses that allowed the errors to happen.

How far back can you recover supplier overpayments?

In England and Wales, a claim founded on a simple contract generally has to be brought within six years, or twelve years for a contract executed as a deed, and the period can be postponed in cases of fraud, deliberate concealment or mistake. In Scotland, contractual and unjustified enrichment obligations are generally extinguished after five years under the Prescription and Limitation (Scotland) Act 1973, with special rules where the debtor's fraud or induced error prevented a claim. Take legal advice before relying on older periods.

What should a right-to-audit clause include?

A good clause defines the records covered, including electronic data and subcontractor records, who may carry out the audit, the notice and access arrangements, and how long records must be kept. It should survive the end of the contract and set out how overcharges are repaid, including set-off and the allocation of audit costs. The exact wording is a matter for your legal advisers.

References

1. legislation.gov.uk (The National Archives), Made 16 September 2024. The Procurement Act 2023 (Commencement No. 3 and Transitional and Saving Provisions) (Amendment) Regulations 2024 (SI 2024/959)
2. legislation.gov.uk (The National Archives), 2023 (revised text). Procurement Act 2023 (sections 2, 52, 68, 71 and 75)
3. The Institute of Internal Auditors, Issued 15 September 2025 (effective 15 September 2026). Third-Party Topical Requirement
4. The Institute of Internal Auditors, 19 November 2025. Navigating Risk Using the Third-Party Topical Requirement
5. NEC (neccontract.com), 18 June 2024. NEC4 ECC pricing provisions – an introduction for new NEC users
6. legislation.gov.uk (The National Archives), 1980 (revised text). Limitation Act 1980, section 5: Time limit for actions founded on simple contract
7. legislation.gov.uk (The National Archives), 1980 (revised text). Limitation Act 1980, section 8: Time limit for actions on a specialty
8. legislation.gov.uk (The National Archives), 1980 (revised text). Limitation Act 1980, section 32: Postponement of limitation period in case of fraud, concealment or mistake
9. legislation.gov.uk (The National Archives), 1973 (revised text). Prescription and Limitation (Scotland) Act 1973, section 6: Extinction of obligations by prescriptive periods of five years
10. legislation.gov.uk (The National Archives), 1973 (revised text). Prescription and Limitation (Scotland) Act 1973, Schedule 1: Obligations affected by prescriptive periods of five years
11. Scottish Government, Page updated June 2019 (as shown on the page). Scottish Public Finance Manual: Overpayments
12. Home Office, 6 November 2024. Economic Crime and Corporate Transparency Act 2023: guidance to organisations on the offence of failure to prevent fraud