QuickBooks operations research

Auditing access changes around vendor record

A grounded QuickBooks support note for small business bookkeeping teams: vendor record with explicit evidence, decision rights, and a verified close.

Auditing access changes around vendor record research thumbnail
On this page Jump to section

Published October 27, 2026

Question and scope

The question should name the unit, the start event, the stop event, and the decision the result is meant to inform. The population should include cases handled by every owner and channel in scope, not only the queue with the cleanest records. Distinguish an administrative pause from a failure: a pause waits for a named decision, while a failure leaves the next action unowned. If the study is exploratory, label it exploratory and do not present the result as a stable baseline. If the case moved between owners, include both owner periods in the review note and name the handoff time.

Write the primary question and one supporting question, then stop; a long list of questions usually hides an undefined unit. A count without a denominator is not a measurement, especially when the queue changes size during the day. Record how corrections, reopens, and duplicate requests are treated so correction rate cannot be inflated by reclassification. The protocol should be short enough for an operator to follow and specific enough for a reviewer to repeat. Keep the review note with the case so the next sampler does not have to reconstruct the decision from memory.

Population and unit

A population that changes size during the day should be reported with the start, end, and net change, not only the closing total. Define whether a request that generates several vendor W-9 updates is one case or several before counting begins. The start event should be the first recorded request, not the first time the team opened the case. Keep a list of requests closed as duplicates and show which case survived. When a value is missing, record the missing state and the reason instead of leaving an empty field in the extract.

The unit is one vendor record case, from the opening request to the verified close, and linked events stay with that case. Exclude cases opened outside the window only when the exclusion rule was written before collection. Write the rule for a missing approval email before the first case so the treatment is consistent. Record the extraction date and the queue filter so another reviewer can reproduce the population count. At QBO Assistant, the vendor record review should end with a dated note and a named owner for the next check.

Definitions and measures

Define how a correction after close is linked to the original case and whether it creates a new case. Record the version of the approval email and the the close checklist snapshot used for each case. Define whether a case that waits for a third party is open, paused, or excluded, and apply that rule to every owner. Record the pause rule and the person authorized to release a paused case. If the evidence is sensitive, record the approved reference and access path rather than copying the content.

Name the owner who can declare a case complete, and record that role in the data dictionary. Test the data dictionary on a small set of cases and revise ambiguous fields before the main sample. Define whether a case that waits for a third party is open, paused, or excluded, and apply that rule to every owner. Define whether the measure counts requests, cases, or destination updates, and use that unit consistently. The note should distinguish what was observed, what was inferred, and what still needs an owner decision.

Data dictionary and evidence

The data dictionary should name the allowed values for status, exception reason, owner, and close evidence. Test the dictionary on a case with a missing reconciliation report and a case with a corrected value. Run a five-case pilot before the full sample and revise any field that two reviewers interpret differently. Define who may change a coded value and how the change is logged. Record this decision in the study log with the case key, the review date, and the person who approved the classification.

Record the version or date of the journal memo and the the bank feed value so a later reviewer can see what was known at the first action. Use a controlled list for exception reasons; do not let free text become the analysis category. Keep the original evidence reference next to the coded value so the reviewer can verify the classification. Use a separate field for reviewer notes so the coded values stay comparable. Keep the evidence reference beside the coded value so a reviewer can test the same case without rebuilding the queue.

Each case needs the source, the observation time, the field supported, the owner, and the reviewer. Version the dictionary and report which version was used for each observation period. Store sensitive evidence in the approved repository and keep only the reference in the analysis file. Record the source location, not just the file name, so a reviewer can reopen the exact evidence. If the source changes after the observation, preserve the earlier value and add a dated note instead of replacing it.

Sampling and collection

Stop expanding the sample only when the review question is answered, not when the result starts to look favorable. Collect the case from the bank feed, the journal memo, and the approval record, and stop at the verified close. If a stratum has fewer cases than planned, report the smaller count instead of replacing it with a convenience case. A case that is difficult to access is still part of the frame; report the access failure rather than replacing it silently. At QBO Assistant, the reviewer should be able to explain this step to vendor from the case record alone.

A convenience sample of recently closed cases will overrepresent easy work and underrepresent the tail that needs attention. Record the time of each observation so a later reviewer can distinguish a late entry from a changed decision. A sample of recent closures can miss the oldest unresolved work, which is often the most informative. If a selected case is out of scope, replace it only with the next case in the same stratum and record the substitution. Use the same note in the case file and the study extract; do not create a second version in a personal document.

Use consecutive vendor record cases where possible, then stratify by owner, channel, and risk class. Use the same collection form for every case and keep the original record linked to the extracted fields. Stratify by risk, channel, and owner so the sample is not dominated by the easiest queue. Use a random start and a fixed interval when the frame is ordered, and record both. When a case needs an exception, record the reason, the owner, and the date before continuing the review.

Analysis and reporting

Report the eligible count, the sample, the missing-field rate, the exception rate, and the unresolved count at the close of the window. Compare periods only after checking the case mix, the definitions, and the queue rules. Use a simple before-and-after comparison only when the definitions and observation window are the same. Report the number of cases that drive a small-sample result and the direction of the effect. Keep the measurement note short enough to read with the case and specific enough to support the reported duplicate bill count.

Report the eligible count, the sample, the missing-field rate, the exception rate, and the unresolved count at the close of the window. For vendor record, report the age distribution and the share of cases waiting on a named owner. Write the finding in plain language and separate what was observed from what the team believes caused it. End with the decision the evidence supports and the decision it does not support. If two reviewers disagree, preserve both classifications until the definition or the evidence is resolved.

Limitations

The record may be incomplete, delayed, or maintained outside the team, so the method cannot infer missing work from a clean summary. The cited sources describe recordkeeping, privacy, security, or control practice; they do not supply a local benchmark. Name the follow-up evidence that would reduce the largest uncertainty. If the queue changed during the window, explain how the change affects the denominator. Link the observation to the exact field in the receipt inbox and to the bill image that supports it.

The cited public sources frame recordkeeping, privacy, security, or control practice; they do not provide a local result. Selection bias remains when the team chooses cases that are easy to open or owners who are likely to cooperate. Do not treat a missing record as proof that the work did not happen; it is evidence about the record. If the reviewer performed the work, use a second reviewer for a subsample and report the disagreement. Do not let a summary written later replace the evidence that was available at the first decision.

Review and next action

Name the owner who will read the result and set a review date before the sample is collected. Keep the review note with the vendor record evidence so the next owner can see why the process changed. Choose a measure that can move within one cycle and a second measure that checks for unintended effects. Link the action to the case evidence that prompted it, not only to the meeting notes. If the case moved between owners, include both owner periods in the review note and name the handoff time.

Repeat the protocol after the change with the same definitions, window, and exclusions. Choose one change and one measure to test it; a long action list is hard to evaluate. Report the action result even if the change did not work; a failed test is still evidence. Record the owner, due date, and exact change that will be tested at the next review. Keep the review note with the case so the next sampler does not have to reconstruct the decision from memory.

Sources