Accounts Payable Internal Controls: A Practical Checklist

Accounts payable internal controls are the rules and checks that make sure you only pay genuine suppliers, for goods and services you actually ordered and received, at the agreed price, once. The core of them is segregation of duties: the person who sets up or edits a vendor should not be the person who approves that vendor's bills or the person who releases the payment.

AP is where a business's cash leaves the building, so it attracts both honest mistakes (duplicate entries, wrong amounts) and deliberate fraud (fake vendors, altered bank details, inflated invoices). The checklist below is organised by the stages of the purchase-to-pay process, followed by a worked example of how a three-person team can split duties, and a section on what tends to go wrong.

The principle: no one person controls a payment end to end

Internal control frameworks such as COSO's Internal Control – Integrated Framework describe five components: the control environment, risk assessment, control activities, information and communication, and monitoring. For AP, the control activities are the practical part, and they rest on separating four incompatible duties:

• Authorising a purchase or a bill
• Recording the bill and maintaining vendor records
• Custody of cash, meaning the power to release a payment from the bank
• Reconciling the bank and the payables ledger afterwards

If one person holds two of these, they can create a problem and hide it. If they hold three, they can commit and conceal fraud without anyone else touching the transaction.

AP controls checklist by stage

1. Vendor master file

• New vendors are set up only from a written request by someone other than the person entering them, with a tax registration number and a company document checked against an official register where one exists.
• Changes to vendor bank details are verified by calling the supplier on a phone number already on file, never a number given in the email requesting the change.
• The person who can edit vendor records cannot approve bills or release payments.
• A report of vendor master changes is reviewed every month by someone independent of AP.
• Dormant vendors are deactivated so they cannot be reused for a fictitious invoice.

2. Purchasing

• Purchases above a set value need a purchase order approved before the order is placed.
• Approval limits are written down by role and by amount.
• Splitting one purchase into several smaller orders to stay under a limit is prohibited, and someone looks for it.

3. Receiving

• Goods are checked in against the purchase order and a goods received note is recorded by someone who is not the buyer.
• Shortages and damages are recorded at the time of delivery, not remembered later.

4. Invoice processing

• Bills for goods are matched to the purchase order and the goods received note (three-way matching), with price and quantity tolerances defined in advance.
• Variances above tolerance go to an approver rather than being overridden by the clerk.
• Bills for services without a PO are approved by the budget holder who received the service.
• Every bill is checked for a duplicate (same vendor, invoice number and amount) before entry.
• The original invoice is attached to the bill record.

5. Payment

• Payments are prepared from approved bills only, never from an email or a phone call.
• Release of the payment batch in online banking needs a second approver for amounts above a threshold.
• Payment runs happen on a fixed schedule; urgent off-cycle payments are rare, documented and approved at a higher level.
• Cheques, if you still use them, are pre-numbered and blank stock is locked away.

6. Review and reconciliation

• The bank is reconciled monthly by someone who did not prepare or release payments.
• Major supplier statements are reconciled to the payables ledger each month, so unrecorded bills and credit notes surface.
• The AP aging is reviewed for debit balances, very old items and vendors you do not recognise.
• Periods are locked after close so posted bills and payments cannot be quietly edited.
• The audit trail is reviewed for back-dated entries and edits made after approval.

Worked example: segregation of duties with a three-person team

A regional courier company runs its finance function with three people: an accounts assistant, a finance manager and the managing director. It pays about 180 supplier bills a month, mostly fuel, vehicle maintenance, subcontracted drivers and rent. Its owner wants AP controls that stop a single person from paying a fake invoice, without hiring anyone.

Here is how it splits the work.

• Accounts assistant — enters bills, attaches invoices, performs the duplicate and three-way checks, and prepares the payment batch. Cannot create or edit vendors. Cannot release payments.
• Finance manager — creates and edits vendors after a call-back check, approves bills up to $5,000, and reconciles the bank. Cannot release payments.
• Managing director — approves bills over $5,000 and releases every payment batch in online banking. Reviews the monthly vendor-change report and bank reconciliation.

Now test it. In March, the accounts assistant receives an email that appears to come from the company's main tyre supplier, saying its bank has changed and asking that the attached invoice for $18,400 be paid to a new account.

1. The assistant cannot change the vendor's bank details, so she forwards the request to the finance manager.
2. The finance manager calls the tyre supplier on the number stored in the vendor record from two years ago. The supplier's accounts team says it has not changed banks.
3. The finance manager refuses the change, reports the email as a phishing attempt and records the incident.
4. Separately, the $18,400 invoice would have needed the managing director's approval because it exceeds the $5,000 limit, and the MD releases payments to the bank details held in the system, not those printed on an invoice.

Three independent controls stood in the way: restricted vendor editing, the call-back on a known number, and a release step held by someone else. Any one of them would probably have stopped the fraud; together, they make it very hard.

The weak point is the finance manager, who edits vendors, approves smaller bills and reconciles the bank, a combination the checklist above would normally separate. The company compensates with the MD's monthly review of the vendor-change report, which shows every bank detail edit and who made it.

What to watch for

• Shared logins. If two people use one account, the audit trail cannot tell you who did what, and segregation of duties exists only on paper.
• Approval by habit. An approver who clicks through 60 bills in two minutes is not controlling anything. Keep approval queues small and give approvers the invoice and PO on screen.
• Override culture. Tolerances exist for a reason. If variances are routinely forced through, ask why: the PO prices may be wrong, or someone may be exploiting the gap.
• Controls that stop at entry. Many teams check bills carefully but never review the bank file that leaves the building. The payment release is the final, most important control.
• One-off exceptions becoming the norm. The urgent supplier who "must be paid today" is a classic pressure tactic used in fraud attempts.

hellobooks< / a > -supports-ap-internal-controls">How HelloBooks supports AP internal controls

HelloBooks lets you set user roles so that, for example, the person entering bills cannot approve them, and approval workflows route bills to the right approver. Purchase orders and goods receipt notes feed 3-way matching, and when a bill's price or quantity differs from the order or the receipt, the variance goes to an approver rather than straight through.

Approved bills can be scheduled to pay on their due date. The audit trail records who created, edited and approved each bill and journal, period locking stops changes to closed months, and bank reconciliation and AP aging give the reviewer the evidence they need. The software enforces the workflow you design; your people still make the approval decisions.