Good control does not mean more approval
Accounts payable often acquires controls one incident at a time. A duplicate payment leads to another reviewer. A fraudulent bank-change request leads to a new form. An invoice charged to the wrong engagement leads to an extra coding check. Eventually, routine invoices pass through several people, while urgent payments find informal routes around the process.
The result is slower work without stronger control.
A well-designed AP process places specific controls at the point where each risk enters. Vendor identity is controlled during vendor setup. Invoice validity is controlled at intake. Business approval is obtained from the person who received the service. Payment release is separated from payment preparation. Adding the same senior approver to every stage rarely addresses the underlying weakness.
Protect the vendor master first
The vendor master determines where money goes. Changes to bank details therefore deserve tighter treatment than ordinary invoice edits.
A bank-change request received by e-mail should be verified through a contact method already held in the firm’s records. Calling the number printed on the change request does not provide independent confirmation; an attacker controls the document and may control that number. The verifier should use a previously recorded contact or another trusted source, document the confirmation, and retain the evidence with the change.
The person entering new bank details should not be the only person approving them. This is a targeted segregation of duties. It does not require a large department. In a lean team, one person prepares the change and an authorised manager reviews the supporting evidence before activation.
Periodic vendor-master review also matters. Inactive vendors, duplicate records, incomplete tax or payment fields, and unexplained recent changes increase the chance of error. The review should focus on exceptions rather than require every vendor to be rebuilt from scratch.
Control invoice intake
Invoices entering through individual inboxes are difficult to track. They may be approved twice, forwarded without attachments, or left unread during an absence. A defined intake channel gives Finance Operations a complete queue and a reliable received date.
At intake, the team checks whether the vendor exists, whether required invoice details are present, and whether the document appears to be a duplicate. Exact matching on vendor name, invoice number, date, and amount catches obvious repeats. It does not catch every duplicate.
A more useful review normalises common variations. Invoice references may contain spaces, slashes, leading zeros, or prefixes that differ between a PDF and a vendor portal. Vendor records may also exist under a trading name and a legal name. Duplicate detection should compare those variants and flag close matches for review rather than relying only on identical text.
Credit notes need the same discipline. If a credit sits in a separate e-mail thread or under a second vendor record, the firm may pay the gross invoice and leave the credit unused. Matching available credits before payment selection is a small control with an immediate operational effect.
Match approval to what was purchased
Professional services firms do not always have physical receipt records. A software subscription, subcontractor invoice, or specialist advisory fee cannot be matched to a delivery note. The approval must instead confirm that the service was ordered, received, and charged to the correct engagement or business area.
This confirmation should come from someone close enough to the purchase to know. A senior finance leader can approve an amount without knowing whether the supplier completed the work. Their approval adds hierarchy, not evidence.
For recurring invoices, the control changes. The reviewer compares the charge with the agreement, expected frequency, authorised users or units, and prior-period amount. An unexplained change enters an exception queue. Automatically routing an unchanged recurring charge through the full first-time approval path wastes attention that belongs on variations.
Separate payment preparation from release
Invoice approval and payment approval answer different questions. Invoice approval confirms that the obligation is valid and correctly coded. Payment approval confirms that the proposed batch contains authorised items, uses approved bank details, and is appropriate for release.
The person preparing the payment file should not release it alone. The releaser needs a batch summary tied to the AP ledger, together with a clear view of additions or changes made after the batch was first prepared. If a payment is inserted after review, the batch should return for approval.
One overlooked reconciliation is the link between the approved payment batch, the bank’s executed transactions, and the entries posted to accounts payable. Matching only the total is weak. Two errors can offset each other. The reconciliation should compare payee, amount, and payment reference, then investigate rejected or altered transactions separately.
Give urgent payments their own controlled route
Urgent payments will occur. Pretending otherwise encourages people to bypass the process through messages and verbal requests.
An exception route should require a reason, named business approver, verified banking details, and post-payment review. The payment is recorded in an emergency log and examined for root cause. Repeated urgency from the same source usually indicates late invoice submission, unclear purchasing responsibility, or poor payment-calendar management.
The objective is not to prohibit exceptions. It is to stop exceptions from becoming invisible.
Use a managed team with clear authority
A Dedicated Team can operate invoice intake, coding, approval routing, vendor maintenance, payment preparation, and reconciliation within the client’s environment. Offshore delivery does not remove the need for control design. It makes role clarity more important.
The operating procedure should state who prepares each activity, who approves it, what evidence is retained, and which exceptions return to an onshore manager. Access rights should reflect those responsibilities. A person responsible for invoice processing does not automatically need permission to change vendor bank details or release payments.
Transformation & Advisory work provides the diagnostic layer. It traces delays and control failures to their source, then sets a practical sequence for remediation. Some firms need cleaner master data first. Others need a revised authority matrix or a reliable payment-batch reconciliation before changing the broader workflow.
If AP feels both slow and difficult to supervise, an Elim Financials consultation can identify where the control chain is missing evidence, duplicating effort, or relying on informal approval.