How we audit a 3PL invoice
Most audit tools ask you to trust a number. We think you should be able to check ours — and so should your 3PL. This page explains, in plain language, exactly how Auditario decides what to call a billing error, how AI is (and isn't) used, and why our numbers are deliberately conservative.
What we have read
A method is only as good as the documents it was built against. Ours was built against real 3PL invoices obtained from public records — not templates, and not invoices we invented.
What reading them changed
The point of the corpus is not its size. It is that real invoices break assumptions that look safe in a spec, and we would rather find that here than in your dispute. Four we found this way:
- Percentage fees hide in the quantity column. A late fee of 5% was billed as
quantity
0.05against a rate of205,403.51. Quantity × rate ties exactly, so every arithmetic check passed and the row read as our strongest possible signal. Priced against a storage rule it would have produced a confident demand for $13,669.02 of charges that were genuinely owed. A rule may now only price a line whose quantity is a plausible count of that rule's unit. - “Recoverable” was counting money we could not date. When no dispute-window clause was on file, those dollars fell through into the claimable column — which is every merchant who has not yet sent a contract. Recoverable now requires positive evidence that the window is open, and unknowns are stated as unknown.
- Split shipments are not duplicates. One order legitimately billed across two shipments looks identical to a double-bill until you check the carrier reference.
- A scanned invoice can carry a text layer that lies. Detecting one is not the same as trusting it, and we no longer do.
Documents are held only as long as they are useful for testing, are never used to train a model, and are reported here in aggregate only. Nine files that could not be verified against their source are quarantined and excluded from every count above.
The three sources of truth
Every conclusion comes from comparing three things:
- What you agreed to pay — your rate card, MSA, amendments, and any written concessions from your provider, in strict order of precedence (a signed amendment beats the original rate card; a document always beats an AI's interpretation).
- What you were billed — every invoice line, normalized into standard charge categories, with each line traceable back to the exact page, row, or cell it came from.
- What actually happened — your Shopify orders, fulfillments, cancellations, and returns, matched to invoice activity by order references and tracking numbers, deterministically before anything probabilistic.
What “verified” means — and what it doesn't
We classify every result into one of five categories, and we never blend them into one headline number:
| Class | Meaning |
|---|---|
| Verified | The contract, the invoice, and any required operational evidence are all present, the calculation is exact, and nothing material is unresolved. This is the only class we present as recoverable dollars. |
| Needs verification | Likely an issue, but one fact is unresolved — and we tell you exactly which fact and what would resolve it. |
| Optimization | A contractually valid charge you could reduce by changing process, packaging, or terms. Real money, but not an error. |
| In your 3PL's favor | Underbilling. Yes, we report it. An audit that only ever finds errors in one direction isn't an audit. |
| Data quality | The sources conflict or are incomplete, so no reliable conclusion exists. We say so instead of guessing. |
How AI is constrained
AI is very good at reading messy documents and very bad at being accountable for arithmetic. So we split the job:
- AI reads; it never calculates money. Rate rules are extracted from your contract into a strict schema, and messy charge descriptions are mapped to standard categories. Where a model assists that extraction it never decides anything: the schema rejects what does not fit, two independent passes must agree before a rule is used, and no model ever produces a dollar figure — every amount on your report is computed arithmetically from the rule and the billed line.
- Deterministic code does all the math. Expected charges are computed by exact, repeatable arithmetic from versioned rules — the same inputs always produce the same dollars, to the cent.
- Every tie is broken against us. Every finding is tested against the ways it could be wrong — wrong clause, superseded amendment, a billing-lag explanation — and where any of those is unresolved it is downgraded rather than published as verified.
- Ambiguity goes to you, not to a guess. If your contract could mean two things and the difference is worth real money, we ask you one specific question — and your answer is versioned and reused forever.
Why “flagged” and “recovered” are different numbers
Some audit vendors advertise everything they flag as if it were money in your pocket. We track the full journey separately: identified → verified → disputed → acknowledged by your provider → credited on an actual invoice. Where a provider in this category charges on recovery, the honest version computes it only on credits that verifiably landed. We do not charge on recovery at all — the price is flat — and our public numbers still count only that last stage.
Dispute windows: the clock your contract started
Most 3PL agreements limit how long you have to dispute an invoice — often 30 to 90 days. We extract that clause first, stamp every finding as inside or outside its window, audit your most recent invoices first, and never present time-barred findings as recoverable. (They're still useful — as evidence for your next rate negotiation.)
What happens when we find nothing
You get a reconciliation statement: how many lines were checked, against which rate-card version, what percentage of spend was covered, and what remained unresolved. It is not a guarantee or an attestation — it's a precise description of what was verified. Many merchants file it with each month's payment approval.
Your data
- Documents are encrypted in transit and at rest, hashed on receipt, and versioned — an uploaded contract is never silently altered.
- Every upload is covered by a standing confidentiality and data-processing agreement.
- Shopify access is read-only and minimal: order IDs, SKUs, quantities, timestamps — not your customers' names, emails, or addresses.
- Your data is never used to train AI models, is deletable on request, and is exportable in full, in one click, at any time.