AP Automation Controls: From Invoice Approval to Reconciliation

AP automation should make an unauthorized or duplicate payment harder to release and a legitimate invoice easier to explain. The controller’s job is to define those controls across purchasing, receiving, invoice review, treasury and close, then prove that each handoff preserves the decision.

This guide proposes controls for a US commercial business paying domestic suppliers in dollars through an ERP and a payment provider. It covers ordinary goods and services procurement, not payroll, government disbursements or a bank’s AML program. Approval amounts, response times and examples are illustrative internal policies that must fit the business’s contracts and applicable law.

Define separate invoice and payment states#

Keep these states linked by stable invoice and obligation identifiers. An approved invoice is not a submitted transfer; a submitted transfer is not confirmed receipt; confirmed payment is not proof that every ERP entry has posted. Make each unanswered question visible with an owner and next action.

Work an invoice through PO and receipt matching#

Assume an authorized PO orders 100 units at $50 each, for $5,000 before any applicable tax. Receiving confirms 80 accepted units, while the supplier invoices all 100. AP detects the $1,000 quantity variance and does not silently approve the full invoice.

The buyer confirms that the remaining 20 units are canceled. The supplier agrees in writing and issues a $1,000 credit note, leaving a $4,000 net invoice. AP links the original invoice, receipt, approved PO amendment and credit. The budget owner approves the revised amount; an independent reviewer handles the exception under the example policy.

An unresolved variance needs a deadline and escalation before the contractual due date. Paying only the received portion requires the actual agreement or an authorized resolution; the automation cannot unilaterally rewrite a $5,000 contractual obligation. For a services invoice, use the agreed milestone acceptance or other evidence rather than inventing a goods-receipt requirement.

Assuming the entity’s inventory policy calls for recognition of these accepted goods, finance records $4,000 inventory and $4,000 AP. This is illustrative accounting: a different purchase or policy may require expense, accrual or other accounts. Recognition follows the underlying transaction, not the payment provider’s callback.

Prevent duplicate invoices before posting and release#

Normalize supplier identity and invoice numbers while retaining the originals. An exact candidate key can combine legal entity, supplier and normalized invoice number. Supplement it with amount, currency, date, PO lines and document similarity so a reissued invoice with a slightly different number is also flagged.

A flag is a review candidate rather than automatic proof of fraud. Recurring invoices can have identical amounts, and credit notes must link to the original invoice without being mistaken for new bills. The reviewer records why a candidate is distinct or marks it as a duplicate with a reference to the surviving record.

Repeat the obligation check at release. Look for already-paid amounts and submitted or unresolved attempts, not just invoices marked paid. Use an atomic reservation or equivalent concurrency control so a support resend and scheduled batch cannot both claim the same outstanding $4,000.

Verify supplier bank changes through an independent channel#

A changed bank account is a separate high-risk instruction even when the invoice matches cleanly. IC3 recommends secondary-channel verification for requests to change account information. The following procedure makes that recommendation operational for the proposed AP process. Source: IC3 business email compromise.

• Capture the change request, proposed account, supplier and requester identity without replacing the active beneficiary.
• Contact the established supplier representative using a telephone number already in the verified supplier record or independently obtained from a trusted source. Do not use the new number supplied in the change email.
• Confirm the request and account details through the approved independent channel; retain the verification date, verifier and evidence reference.
• Require a second authorized person to approve the new beneficiary version. Separate that person from the requester and the payment preparer.
• Reapprove any affected payment instruction against the exact new beneficiary version before release. A later master-data edit must invalidate a stale release approval.

For the worked invoice, suppose a last-minute email asks for a new account. Until verification is complete, the requested account remains inactive. If the supplier independently confirms the change, two authorized actors complete verification and approval before the $4,000 is scheduled. If the request proves fraudulent, preserve the prior verified account and escalate the incident; confirm the legitimate payment route with the supplier.

A successful small transfer can test a route but does not prove that the person requesting the account owns the supplier’s payment authority. Bank formatting checks and account-name matching supplement the procedure; they do not replace independent verification.

Separate preparation, approval and release permissions#

The proposed role model separates supplier maintenance, invoice entry, budget approval, beneficiary approval and treasury release. Prevent a person who creates or changes a beneficiary from solely approving and releasing its first payment. Give system administrators no routine payment authority merely because they manage software access.

A small team may need a compensating independent review, such as an authorized owner reviewing the exact instruction before bank release. Document the limitation, reviewer and evidence. Emergency approval must be explicit, time limited and reviewed afterward rather than implemented through a shared login.

GAO’s Green Book is a federal internal-control standard, effective in its 2025 revision from fiscal year 2026. It can inform a chosen control framework, but this commercial-business model does not assume that federal agency requirements apply automatically. Source: GAO Green Book scope.

Resolve tax treatment without inventing a blanket payment block#

Collect appropriate supplier tax information during setup and maintain the classification used for reporting. Form W-9 requester instructions explain obtaining the correct payee name and TIN and the relevant backup-withholding and remittance process. Determine payment type, payee status and exemptions before assigning a tax action. Source: IRS W-9 requester instructions.

A missing profile field or incomplete year-end reporting export does not automatically authorize an indefinite hold on an otherwise due invoice. The tax owner must distinguish a reporting-data exception, legally required withholding, a genuine legal restriction and a contractually permitted hold. Record the actual basis, amount, owner and resolution deadline.

For applicable 2026 reportable payments under sections 6041 or 6041A, IRS Publication 15 describes the increase in the aggregate threshold from $600 to $2,000 and the 24% backup-withholding rate. Apply the current-year rules to the actual category rather than imposing one threshold on every supplier invoice. Source: IRS 2026 threshold and withholding.

The Form 1099 instructions distinguish nonemployee service compensation from categories and payees with exceptions, including payments for merchandise and the general corporate exception with specified carveouts. The goods example must therefore be classified separately from a reportable service invoice. Source: IRS reporting categories.

For a separate illustrative $10,000 service payment where the tax owner has established that 24% backup withholding applies to the entire amount, payee cash is $7,600 and withholding payable is $2,400. Neither component disappears from the $10,000 obligation. Remit and report the withheld amount under the applicable process; it is not a processing fee or a reason to retain the entire invoice.

Release a versioned instruction and recover unknown outcomes#

Immediately before submission, verify approved net amount, due date, current beneficiary version, unresolved exceptions and available funding. Prepare one external attempt, preserve the provider account and idempotency key where supported, and retain the submitted request and response. Release permission must apply to that exact instruction, not an editable batch label.

In the goods example, assume a $2 fee borne by the payer. The supplier receives $4,000 and total payment funding is $4,002. Finance records the fee separately from the supplier liability. Where cash first moves into provider clearing, use the entity’s appropriate clearing accounts and recognition policy rather than equating funding with supplier payment.

If submission times out, mark the attempt unresolved, retrieve the original status and inspect callback and reconciliation records. Do not resubmit with a new key or different provider while the first attempt may still pay. A documented terminal failure or cancellation that prevents payment can authorize a replacement linked to the same obligation.

A partial batch failure requires item-level recovery: confirmed items remain paid, unresolved items remain blocked from replacement, and confirmed failures follow the approved correction path. Duplicate or out-of-order callbacks update the existing attempt once. Preserve originals and append reversals or adjustments rather than deleting history.

Reconcile the payable, payment and bank records#

Match the invoice and credit to the approved $4,000 liability, the external attempt to its $4,000 recipient amount, and cash records to the $4,002 funding and $2 fee. Use external identifiers rather than a batch total alone. A returned payment reopens the relevant obligation under the accounting policy and requires controlled recovery.

At close, list unpaid invoices, submitted attempts, unresolved principal, provider clearing balances and ERP posting failures separately. Assign each difference a cause, age, owner and next action. An approved but unpaid invoice can remain a recognized liability; an ERP sync error cannot justify losing the underlying transaction.

Measure whether the controls work#

Use invoice-processing speed alongside these outcomes. A lower exception count may mean missed detection rather than better control. Record suspected duplicates separately from confirmed duplicate payments, and do not infer a savings percentage from an unattributed industry error rate.

Before expanding, exercise invoice variance, credit note, duplicate document, changed bank details, stale approval, timeout, partial batch failure and ERP replay with expected results. The controller signs the accounting and evidence decision, AP signs the operating recovery path, and treasury signs release permissions. Keep the exact policy and evidence version with the approval.