# For auditors: how to test the approval control This page is for an auditor or reviewer testing a client's approval control in Xero. It says what the control is, how to take a sample, and what evidence you can pull without relying on the client's say-so. WorkApproved is a record of what happened. It is not an audit or an opinion. On this page: [1. Who is allowed to approve, and under what limits](https://workapproved.app/auditors#who-may-approve) · [2. Was every document covered](https://workapproved.app/auditors#every-document-covered) · [3. Is the record reliable](https://workapproved.app/auditors#record-reliable) · [3a. Risk flags on bills](https://workapproved.app/auditors#risk-flags) · [4. Changes to the control itself](https://workapproved.app/auditors#changes-to-the-control) · [5. What access an auditor gets](https://workapproved.app/auditors#auditor-access) · [How to take a sample](https://workapproved.app/auditors#take-a-sample) · [What this evidences, and what it does not](https://workapproved.app/auditors#what-this-evidences) ## 1. Who is allowed to approve, and under what limits - Each document type (bills, sales invoices, purchase orders) has its own workflow of steps. A rule chooses the approvers by amount, supplier, account code or tracking category, and a step can need any one of its approvers or all of them. - The person who submitted a document can be blocked from approving it. A catch-all person and a fallback administrator mean no document is left without an approver. - Delegation is by dated stand-in, so you can see who covered whom, and when. - The workflow is versioned. You can open the version that applied on a given date and compare it with who approved. ## 2. Was every document covered - A document enters its workflow when it is submitted for approval in Xero. - If a document in a controlled type is authorised in Xero by hand, outside WorkApproved, it is recorded as approved outside WorkApproved, shown as an exception, and the organisation's administrators are alerted. The same happens when a document is changed after it was approved. - Purchase orders are picked up by a regular check of Xero (about every 30 minutes); bills and sales invoices arrive as Xero reports them. ## 3. Is the record reliable - On final approval a PDF certificate is attached to the document in Xero before the document is authorised, so nothing is authorised without its certificate existing. - The certificate shows the document and its lines, each step of the approval path (including skipped steps), who approved, the time, the approver's IP address where captured, any restarts, questions and reassignments, the risk flags raised and how they were acknowledged, and the supplier's attachments (appended where possible, otherwise listed with name, size and SHA-256). - Each certificate carries a link to a public page. It says whether the certificate matches WorkApproved's records, shows the document number, organisation, approval date and a SHA-256 digest, and has a "check a file" box that hashes a file in your browser, so the file is never uploaded. If a certificate has been replaced or the document changed after approval, the page says so. - The check covers the recorded evidence, not the PDF file itself, and the PDF is not digitally signed. - A rejection needs a written reason, and every decision, question and answer is recorded. ![The first page of an audit certificate PDF for an approved bill: the document's details and lines, then the approval chain, showing which steps were skipped and who approved, with the time and the approver's IP address.](https://workapproved.app/img/screens/05-certificate-page1-desktop-light.png) The audit certificate: the document, the approval path and who approved. ![The public certificate check page. It says This certificate matches our records and shows the document number, organisation, approval date and a SHA-256 digest, with a box to check a file against the certificate.](https://workapproved.app/img/screens/06-verify-desktop-light.png) The page a certificate's link opens. No login needed. ## 3a. Risk flags on bills - Each bill is checked for 19 common signs of error and fraud before it is approved, such as a changed supplier bank account or a duplicate invoice. A flag says what was found and what to do, and a high flag must be acknowledged before the bill can be approved. Flags and acknowledgements appear on the certificate. - The full list of checks and their thresholds is shown to administrators and auditors only. Only bills are checked. ## 4. Changes to the control itself - The organisation audit log records who did what, when, from which address, and whether it succeeded, including every settings and workflow change. - Weakening a control, for example switching off a check, requires a written reason, which is kept with the change. - Changes to who has which role are recorded and alert the organisation's administrators. ## 5. What access an auditor gets - An auditor is given the read-only Auditor role in the organisation. It shows everything in the organisation: approvals, certificates, settings, risk details, workflow versions and the audit log. It cannot approve, reject or change anything. - Two-factor sign-in is required for auditors. - WorkApproved staff cannot approve, reject or change a workflow for a customer. ## How to take a sample 1. Ask the client for the population: the bills, sales invoices or purchase orders authorised in Xero in the period. 2. Select your sample from that list. 3. Open each selected document in Xero and find its WorkApproved certificate in the attachments. 4. Read the certificate: approvers, order, times, skipped steps, risk flags and how they were handled. 5. Check it: open the link on the certificate, confirm the page says it matches the records and that the digest matches, or use "check a file" on a file you hold. 6. Compare the approvers with the workflow version that applied on that date, using the workflow history. 7. Test completeness: look at the exceptions for the period, which lists anything authorised outside WorkApproved or changed after approval. 8. Test the control environment: look through the audit log for the period for changes to workflows, risk checks and roles. ## What this evidences, and what it does not WorkApproved records who approved what, in what order, and what Xero reported to it. A certificate does not say that a transaction was proper, that goods or services were received, or that a payment was made. Risk checks flag common signs of error and fraud; no flag does not mean no problem. WorkApproved does not release payments. Retention: the audit log is kept for 3 years, attachment copies for 18 months (their SHA-256 values stay), and certificates are kept while the organisation is on WorkApproved. Questions about the controls: hello@workapproved.app Screens shown are illustrative and evolve as we release improvements. ## Start your free trial 7 days free. A card is needed to start. From NZ$39 + GST per Xero organisation per month, unlimited users. [Start free trial](https://go.workapproved.app/register). --- Start a free trial: https://go.workapproved.app/register (7-day free trial, card needed) · Sign in: https://go.workapproved.app/login Contact: hello@workapproved.app (support) · security@workapproved.app (security reports) Legal: [Terms](https://workapproved.app/terms.md) · [Privacy](https://workapproved.app/privacy.md) · [Partner terms](https://workapproved.app/partner-terms.md) · [Subprocessors](https://workapproved.app/subprocessors.md) WorkApproved is a product of [Stone Pritchard Limited](https://stonepritchard.com), [NZBN 9429053953216](https://www.nzbn.govt.nz/mynzbn/nzbndetails/9429053953216/), New Zealand. © 2026 Stone Pritchard Limited. Xero is a trademark of Xero Limited. WorkApproved is an independent product and is not endorsed by, or affiliated with, Xero.