Short answer: An external audit gives an opinion on whether your financial statements are correct. An internal audit checks controls and risks. A recovery audit looks for money you have already lost, such as duplicate payments, overbilling and missed credits, and is often paid as a share of what it recovers.
The three audits side by side
| Audit | Main question | Who it serves | Typical fee |
|---|---|---|---|
| External audit | Are the financial statements fairly stated? | Shareholders, lenders, regulators | Fixed fee |
| Internal audit | Are our controls working, and where are the risks? | Board and management | Salaries or a fixed fee |
| Recovery audit | Where has money already leaked, and can we get it back? | CFO and owner | Often a share of verified recoveries |
Why a clean external audit can still miss lost money
A bill paid twice is recorded correctly twice. The books balance, so the statements are fair, and the auditor's opinion is right. But the cash is still with the vendor. External auditors test samples for material misstatement; they are not paid to chase every overpayment line by line.
What a recovery audit checks
- Duplicate vendor payments and unapplied credit memos
- Vendors billing above the agreed purchase-order price
- Freight and charges that should have been billed to customers
- Tax credits (VAT or GST) that were available but never claimed
- Early-payment discounts offered by vendors but missed
How recovery audits are paid
Large recovery-audit firms commonly work on contingency: they keep a percentage of what is actually recovered, and charge nothing if nothing comes back. Prozone offers the same model for mid-market companies: a free 72-hour scan, then a fixed fee or 20–25% of verified recoveries only.
When a mid-market company should run one
- You pay hundreds of vendor bills a month and enter them by hand.
- You've changed ERP, merged entities or grown fast in the last two years.
- You have never compared vendor prices against purchase orders line by line.
Questions
Does a recovery audit replace our external auditor?
No. They answer different questions. Your external audit is still required; a recovery audit finds cash the statements can't show.
Will a recovery audit upset our vendors?
Not when it's done well. Every claim comes with the evidence, and most vendors credit a proven overpayment without dispute.
How long does a recovery audit take?
Prozone's free scan of three months of data takes about 72 hours. A full 12-month audit takes about 10 working days.