What do you actually test on subcontractor payment certificates?

I do internal audit in construction and manufacturing, and subcontract payments are the area where I consistently find the most money. Most audit programmes I've seen cover it in about one line, which isn't a test.

Three things I look at, for what it's worth:

The certificate against the measurement, not against the application. Subcontractor applies for 60% complete, the certificate says 60%. I ask for the measurement record behind it. Often there isn't one — the QS agreed the application rather than measuring the work. Ask for three and get none, and you've got something.

Back-charges that were logged and never deducted. Site incurs cost on the subcontractor's behalf, records it somewhere, and commercial produces the certificate without ever seeing the log. Nobody reconciles the two. This one has paid for the whole audit more than once.

Retention never released. Everyone tests early release. Almost nobody tests the balance sitting there that should have gone back at defects liability expiry, which is a liability nobody has recognized.

The back-charge one surprises people every time, but I've only worked in a handful of companies so I don't know how typical it is.

What do you test here? Anyone found something in this area I'm not looking at?