76% of US organisations experienced attempted or actual payments fraud in 2025, and 74% were hit by business email compromise, according to the 2026 AFP Payments Fraud and Control Survey published in April 2026.
Gigapay is the Merchant of Record for creator payouts: one vendor of record that pays your creators on your behalf and takes on the compliance, the payouts, and the support, so the audit trail for the whole category lives in one place.
Internal audit reads the same fraud numbers, which is why contractor and creator payments now get sampled like any other supplier spend, with the same six documents requested for every line.
This article breaks down what an accounts payable audit samples in high-volume contractor payments, what a pass and a fail look like, what to hand the auditor, and how to fix the trail before the next campaign.
Key Takeaways
- Internal audit samples six documents per contractor payment: contract, approval, tax form, invoice, payment, identity.
- Approvals in Slack or WhatsApp do not count as evidence in an accounts payable audit.
- One counterparty, one master agreement, and one consolidated invoice make any sample pass.
- DAC7 fines reach €50,000 per report in Germany and SEK 12,500 per seller in Sweden.
- Finance attends the audit and answers for the trail. Marketing does not.
Why High-Volume Contractor Payments Fail Accounts Payable Audits in 2026
Creator payments grew up outside accounts payable. Marketing found the creator, agreed the fee in a DM, and paid through PayPal or a personal expense claim because procurement would not onboard a 19-year-old without a company number. That worked at 20 creators a year. At 600, the same pattern becomes a control gap that internal audit can see from the general ledger.
The fraud data explains why auditors now look. The 2026 AFP survey, based on 465 treasury practitioners, found that financial losses hit 48% of organisations under $1 billion in revenue and 66% of those above it.
The ACFE's Occupational Fraud 2026: A Report to the Nations, released in May 2026, analysed 2,402 cases across 143 countries and put the median loss at $104,000 per case, with the typical scheme running about 12 months before detection.
Schemes caught within six months cost a median of $40,000. Schemes that ran past five years cost more than $1.1 million. Weak or missing internal controls remained the leading contributor.
Contractor payments carry every risk factor in those reports. The payee is often an individual with no registered business. The relationship owner sits in marketing, not finance. Banking details arrive by email, which is the exact channel business email compromise exploits.
And the volume is rising fast: the CreatorFest State of Creator Compensation 2026 study, which Gigapay partnered on, found that 75% of US marketers and 50% of UK marketers now spend $1 million or more a year on creators, and micro-creator rates have risen 200% to 233% since 2024. Europe alone counts 8.6 million creators earning income, with brand budgets compounding at 26% a year.
An audit looks at that spend and asks one question: can you evidence every payment the same way you evidence a payment to your packaging supplier? For most brands and agencies, the honest answer is no.
The Regulatory Pressure Behind Creator Payment Audit Trails
Internal audit is one reason to fix the trail. Tax authorities are the second, and their information is better than it used to be.
DAC7 reporting penalties by country
DAC7, in force since 1 January 2023, obliges platform operators to collect and verify seller tax data and report it annually by 31 January (2 February in Germany). The penalties for defective or missing reports vary by member state:
The per-seller structure matters for anyone paying creators at volume. At 500 misreported sellers, Swedish exposure alone reaches SEK 6.25 million.
Tax investigations targeting influencer income
The DAC7 data does not sit in a drawer. It feeds audits. In July 2025, North Rhine-Westphalia's State Office for Combating Financial Crime announced it was evaluating more than 6,000 data records from social media platforms, estimated the undeclared tax at around €300 million, and confirmed roughly 200 criminal proceedings against creators in that state alone.
Hamburg announced a review of 140 influencers with results expected in the first quarter of 2026. Sweden's Skatteverket runs targeted influencer reviews and treats gifted products as taxable at market value. In the UK, HMRC sends platform-data nudge letters to creators, and umbrella joint and several liability rules for agencies and end clients went live on 6 April 2026.
When an investigator traces a creator's income back to the brand that paid it, the brand's own records become evidence. If those records are a PayPal export and a WhatsApp thread, the brand has a problem it did not know it was carrying.
Record retention periods for contractor payment evidence
An audit trail also has to survive. Retention rules for invoices and payment vouchers differ by country, and the clock usually starts at the end of the financial year, not the invoice date:
A creator you paid in 2026 may be sampled in a German audit in 2033. If the evidence lives in a marketing manager's inbox, and that manager left in 2028, the sample fails.
What an Accounts Payable Audit Samples in Contractor Payments
Internal audit does not read every transaction. It samples. For each sampled payment, the auditor requests a fixed set of documents and tests whether they agree with each other.
The six documents internal audit requests for every sampled payment
The auditor is not testing whether the creator did good work. The auditor is testing whether each document exists, whether they all name the same person, and whether the money followed the approval rather than preceding it.
How internal audit sampling works for contractor payments
Auditors size a sample based on the population, the risk rating, and the control reliance they want to place on it. Under ISA 530 and the IIA's standards, a sample may be random, systematic, or stratified. Contractor payments are usually stratified: the auditor pulls a few high-value items, a few payments to new payees, a few cross-border items, and a random selection from the rest.
The practical consequence is that you cannot prepare for a sample. You do not know which 25 or 40 lines will be picked. The only defensible design is one where every payment carries the same six documents in the same place, so any sample works.
What a Passing Accounts Payable Audit Trail Looks Like
A passing trail for high-volume contractor payments has seven properties. Each one removes a question the auditor would otherwise ask.
The pattern is the same one finance already uses for any large supplier.
- One vendor of record.
- One contract.
- Batched invoices.
- Drill-down on request.
The difference is that creator payments were never structured that way, because the individuals behind them could not pass vendor onboarding.
What a Failing Accounts Payable Audit Trail Looks Like
Failures are easier to describe because most finance teams have seen them.
- 200 PayPal exports: The payment record exists, but nothing ties it to a contract or approval. The auditor sees money leaving and has to reconstruct the reason from marketing's memory. PayPal's cross-border reality also adds fees of €16 to €20 per payment plus around 4% FX, which means the amount paid rarely matches the amount approved.
- Missing tax forms: No TIN, no VAT number, no W-8 for the US creators, no evidence anyone checked whether the payee was a company or an individual. Under DAC7 and national rules, the tax status of the payee is the whole point. A missing form is a finding on its own.
- Invoices that do not match names: The contract says Emma. The invoice says Emma's boyfriend's limited company. The bank account belongs to a third name. Each mismatch is exactly the pattern auditors are trained to flag, because it is the pattern fraud takes.
- A marketing manager who "confirmed in WhatsApp”:The approval happened. It just happened in a channel that cannot be exported, cannot be timestamped reliably, and cannot show delegated authority. From the auditor's perspective, an approval that cannot be evidenced did not occur.
One of these in a sample of 40 is a note. Four of them is a written finding against the control environment, and that finding goes to the audit committee.
The Cost of a Broken Contractor Payment Audit Trail
The cost shows up three times: in the run rate, in the audit, and in the remediation.
Cost per invoice for manual contractor payments
Ardent Partners' State of ePayables 2025 puts the average fully loaded cost to process one invoice at $10.89, against $2.78 for the top-performing AP teams in the study, with an average cycle time of 10.9 days. Creator invoices sit well above that average because they arrive in inconsistent formats from payees who are not in the vendor master.
Gigapay's own analysis, using Ardent's cost framework, bank FX, and labour, puts the true cost of a manual cross-border creator payment at €40 to €60 all-in.
For a brand running 600 creator collaborations a year, Gigapay's published breakdown estimates the manual process at around €139,590 a year and 840 admin hours, with 300 or more individual vendor entries in the ERP. The same volume through one counterparty runs at roughly €46,350 and 60 hours, with one vendor entry.
What audit remediation costs in salaries
Robert Half's 2026 Salary Guide gives the US starting ranges for the people who deal with a failed sample:
At a mid-range senior internal auditor salary of about $105,000, an hour of audit time costs roughly $50 before overhead. A failed contractor payment sample typically triggers an expanded sample, a walkthrough with marketing, and a follow-up test in the next cycle.
Forty hours of auditor time plus forty hours of AP time to reconstruct evidence puts the direct labour cost of one finding near $4,000, and that is before the campaign that gets frozen while finance fixes the trail.
The regulatory tail
The direct labour cost is the smallest number. The DAC7 per-seller fines above scale with your creator count. A German KSK audit can look back five years and apply the 4.9% levy retroactively. And a defective tax file tells the receiving authority that the rest of your operation deserves a closer look.
How to Build an Audit-Ready Process for High-Volume Contractor Payments
The fix is structural. Adding a compliance checklist to a broken process produces a documented broken process.
- Move the creator category to one counterparty: Whether that is a Merchant of Record or an internal entity, the auditor should find one vendor record for creator spend.
- Sign a master agreement that covers all payees under it: Individual creator contracts can sit beneath it as schedules or platform terms, but the sampled payment must trace to one signed document.
- Put approvals in the AP workflow, at campaign or batch level: Named approver, date, amount, delegated authority limit. Nothing in chat tools.
- Verify identity and tax status at onboarding, before the first payment: Collect name, address, TIN, VAT number where relevant, company registration where relevant, date of birth, ID copy, and bank account, and store the pack against the payee.
- Generate invoices through self-billing: When the platform issues the invoice on the creator's behalf, the name on the invoice, the contract, and the bank account are the same by construction.
- Pay through rails that return a unique, unchangeable reference: Reconciliation needs a key. A screenshot is not a key.
- Keep role-based access with activity records: The person who onboards a payee should not be the person who releases the batch.
- Retain everything for the longest applicable period: For a brand paying German creators, that is eight years for the invoice and voucher, from the end of the financial year.
Each step maps to one of the six documents the auditor will ask for, or to one of the seven properties of a passing trail.
What to Hand Internal Audit for Contractor Payments
When the request arrives, the pack should be short and complete.
The live posts, screenshots, and campaign reports belong in the background as supporting context, not in the audit file. Auditors test the payment control. They do not test the content.
One caution on the US side: W-8, W-9, and 1099 documentation only enters scope where US payees or a US paying entity are involved. The reporting position under a Merchant of Record structure differs from direct payment, so state it in writing rather than letting the auditor infer it.
How Gigapay Structures the Accounts Payable Audit Trail for Creator Payments
Gigapay formally purchases the creator's deliverable and resells it to the client, which makes Gigapay the counterparty on paper and in the ERP. That single structural fact produces most of the passing trail.
1. One vendor record
Your ERP holds Gigapay Sweden AB, once. WPPMedia's GOAT agency and enterprise brands like Boozt run hundreds of creators a year through that one entry.
2. One master agreement
The Gigapay service agreement is the MoR MSA the auditor asks for. Creators accept platform terms beneath it. Clients cannot self-onboard; every client goes through a sales process, provides a company registration number and office address, and signs the agreement, which gives you a clean record of who is on the other side.
3. Batch approvals and consolidated invoicing
You upload a CSV or call the API to create a project and its payouts. Gigapay issues one consolidated invoice per batch, with a line per payee, and generates self-billing invoices on behalf of creators. Gigapay's published benchmark is an 80% reduction in invoice volume.
4. Payee-level evidence on request
Every creator completes KYC before they can receive money. For international individuals, Gigapay collects name, address, TIN, personal number where relevant, country of work, nationality, VAT number where relevant, date of birth, a copy of ID, bank account, and an A1 form where relevant.
Nobody gets paid without providing all of it. Creators can onboard as an individual, sole trader, or company, and no registered business or VAT number is required, which is what removes the "we can't pay her, she's not a vendor" block without removing the evidence.
5. Immutable payment references
Every payout carries a unique reference returned through the API and webhooks. Payouts settle instantly when the account is pre-funded, over SEPA Instant, Faster Payments, and ACH, across 65+ countries and 50+ currencies.
6. Tax reporting handled by the counterparty
Gigapay reports compensation to private individuals to Skatteverket, with an exchange of income statements to the payee's local authority where relevant.
- For EU countries in scope, Gigapay files the DAC7 reports to Skatteverket, and handles KU14 reporting for Denmark.
- For German clients, Gigapay shares the collected data so the client can meet its own KSK reporting duty, since KSK treats Gigapay as an intermediary.
7. Security and access
Gigapay is ISO 27001 certified and GDPR compliant, with role-based user access on Enterprise plans and a full activity history through the API and webhooks.
The result is that a stratified sample of 40 creator payments resolves to one contract, a handful of consolidated invoices, and 40 onboarding packs that all say the same name. That is what a pass looks like.
Who Attends an Accounts Payable Audit of Contractor Payments
Finance attends. Marketing does not.
That sounds blunt, and it is meant to. An audit of creator payments tests the payment control. The person who owns the payment control is the AP manager, the controller, or the head of finance. When marketing attends, two things go wrong: the auditor hears campaign context instead of control evidence, and marketing ends up defending decisions it never had the authority to make.
The right preparation is a 30-minute session before the audit where finance collects marketing's context and adds it to the file. Marketing owns the relationship. Finance owns the evidence.
Accounts Payable Audit Checklist for High-Volume Contractor Payments
Run this before the audit letter arrives, not after.
- One vendor record in the ERP for the creator category
- One signed master agreement covering all payees under it
- Approvals recorded in the AP workflow at batch level, with named approver, date, and amount
- Consolidated invoice per campaign or batch, reconciled to the ERP payment
- Onboarding pack per payee: identity, tax ID, VAT or company number where relevant, bank verification
- Self-billing invoice per payee, with the same name as the contract and the bank account
- Unique payout reference per payment, tied to the invoice
- Role-based access with activity records for onboarding, approval, and release
- Written note on tax reporting scope (DAC7, KU14, KSK, 1099 where relevant) and who files
- Retention set to the longest applicable period across your payee countries
- Finance named as the audit owner, marketing context collected in advance
If more than two of those boxes are empty, the next sample is a coin flip.
Conclusion
Gigapay is the Merchant of Record for creator payouts, which means the audit trail for the whole category lives with one counterparty instead of across 200 exports and a chat thread.
An accounts payable audit of contractor payments samples six documents per line and tests whether they agree.
A passing trail has one vendor record, one master agreement, batch approvals, a consolidated invoice, payee-level evidence on request, unchangeable payment references, and access logs. A failing trail has PayPal exports, missing tax forms, mismatched names, and an approval that lives in WhatsApp.
The cost of the failure arrives as auditor hours, frozen campaigns, and per-seller fines that scale with the thing you are trying to grow. If last year's audit wrote up contractor payments, fix the trail before the next campaign.
Book a demo and bring the audit finding with you. We will show you what the same sample looks like on Gigapay.
Read Next:
- Month-End Close When Services Spend Is 300 Uninvoiced Contractors
- 1099-NEC in 2026: The $2,000 Threshold, State Gaps, and Why Classification Still Sits With Finance
- Self-Billing and VAT Reverse Charge
FAQs:
1. How many samples does internal audit take from contractor payments?
Internal audit takes as many samples from contractor payments as its risk assessment requires, typically 25 to 60 items stratified by value, payee age, and country. You cannot predict which items get picked, so the only reliable design is one where every payment carries the same six documents in the same place and any sample works.
2. What is the best evidence for an accounts payable audit of creator payments?
The best evidence for an accounts payable audit of creator payments is a signed master agreement with one counterparty, a batch-level approval in the AP workflow, a consolidated invoice with a line per payee, a unique payout reference per payment, and an onboarding pack per creator containing identity, tax ID, and bank verification.
3. Does Gigapay provide a SOC 2 report for an accounts payable audit?
Gigapay provides ISO 27001 certification and GDPR compliance documentation for an accounts payable audit, and finance teams should ask for the current security pack during vendor due diligence.
4. Who should attend an accounts payable audit of contractor payments?
Finance should attend an accounts payable audit of contractor payments, specifically the controller or head of finance and the AP manager, because the audit tests the payment control they own. Marketing provides campaign context to finance in writing beforehand and does not attend.
5. Why do approvals in Slack or WhatsApp fail an accounts payable audit?
Approvals in Slack or WhatsApp fail an accounts payable audit because they cannot be exported reliably, cannot demonstrate delegated authority limits, and cannot be tied to the payment amount and date in the AP system. An approval that cannot be evidenced is treated as an approval that did not happen.
.jpg)
