Your card platform is solved.
Your bill-and-receipt mess isn't.

They do. The audit is downstream of the card layer. Cards stay where they are; the audit handles bills that arrive as PDFs in your inbox, receipts submitted via Slack, credit-notes that nobody reconciled, classification drift across the long tail. The card platform is a peer, not a competitor.

Those are full AP platforms — they bundle audit with bill-pay execution, vendor onboarding, and approval workflows. If you want all of that as one product, they're the right shape. The blueprint is the audit half on its own, in your stack, in your repo. The pay-execution stays where you already run it.

That's the actual work. The audit reads the receipt-and-bill inbox, matches incoming PDFs against open bills in the GL, flags bills that arrived without a receipt and receipts that arrived without a bill, runs the classification scoring on every new line. The long tail is where the Friday went; the audit is where it stops going.

Your bookkeeping team owns the taxonomy. The audit flags; the human decides. A classification drift gets surfaced with the vendor's prior history attached — the resolver confirms or reclassifies, and the resolution feeds the next month's baseline. The audit doesn't override your accountant; it gives them a ranked list to work.

The audit reads vendor history per entity. A bill paid by entity A that historically belongs to entity B surfaces as a multi-entity misrouting in tier 1. Intercompany reimbursement candidates flag with the matching pair. The audit doesn't execute the reclassification — your bookkeeping team does — but the candidate pair is named, not searched-for.

The audit reads tax categorization on each line and flags mismatches against vendor history and against the line's classification. A [CapEx] line marked tax-exempt where vendor history says taxable flags for review. The audit isn't a tax-preparation tool — it surfaces the kind of categorization mismatch that becomes a tax problem six months later.

If your bookkeeping discipline includes vendor-name conventions (Amazon as 'Amazon (Office)' vs. 'Amazon (CapEx)', for example — many mature teams do something like this), the audit observes the convention and flags entries that drift. The audit doesn't enforce a naming style; it tells you when the team's own discipline is slipping.

Every exception, every resolver, every disposition committed to a durable store — git repo or shared drive — and linked back to the original bill or receipt by ID. The trail reads forward (here's what we found) and backward (here's why this line was reclassified six months ago). Auditor reads the same artifacts the bookkeeping team does.