What this audit checks
Authentication & access
- OAuth refresh token mints an access token against the correct data-centre accounts server (.com / .eu / .in / .com.au / .jp / .ca / .sa) and is not revoked/expired
- API domain matches the org’s data centre and GET /books/v3/organizations returns the organization_id without a 401 (bad token) or domain mismatch
- Granted scope covers ZohoBooks read access to Invoices / Contacts / Items / Bills / Bank Transactions
- Org not over its plan’s daily API call budget (reads not throttled to 429)
Order-to-cash & AR health
- Invoices past due_date with outstanding balance above the overdue-AR threshold (collections risk)
- AR aged 60+ days above 15% of total outstanding receivable
- Days Sales Outstanding (DSO) above 60 days
- Sent invoices with no payment recorded after the payment-terms window (slipping collections)
AP & cash health
- Bills past due_date with outstanding balance (late-payment / supplier-relationship risk)
- AP aged 60+ days above 30% of total payables
- Recurring bills failing to generate (broken AP automation)
Bank reconciliation & tax-base integrity
- Uncategorised bank transactions backlog above threshold (books drift, tax base unreliable)
- Days since last bank reconciliation above the cadence (>7d on operating accounts)
- Current GST/VAT/BAS return period nearing or past filing deadline with uncategorised cash still open
- Invoices/expenses missing a tax rate on taxable lines (tax-return base understated)
Cross-channel: Zoho Books vs ecommerce reconciliation
- Storefront order has no matching Zoho Books invoice after the sync window (sibling = bigcommerce.order / shopify.order / adobe_commerce.order, by reference_number)
- Zoho Books available_stock drifts >5% from storefront available qty on stock-tracked SKUs with active orders (sibling = bigcommerce.product / shopify.product / adobe_commerce.product, by sku) - inventory-tracking items only
- Ecom customer with completed orders absent from Zoho Books contacts after 7d (sibling = bigcommerce.customer / shopify.customer, by email)
- Customer with AR aged 60+ days still placing new ecom orders (credit risk compounding, sibling = ecommerce customer by email)
Data sources
GET https://accounts.zoho.com/oauth/v2/token- OAuth2 access-token refresh on the data-centre accounts serverGET /books/v3/organizations- Auth / data-centre / organization_id validation probeGET /books/v3/invoices- Invoices - AR balance, overdue value, aging, DSO, order-to-cash matchingGET /books/v3/contacts- Contacts - outstanding receivable, payment terms, tax reg, master driftGET /books/v3/items- Items - sku, stock_on_hand / available_stock for inventory parityGET /books/v3/bills- Bills (AP) - overdue value, payables agingGET /books/v3/banktransactions- Bank transactions - uncategorised / unreconciled backlog, recon freshness