Approvals and controls

The three things that decide where an invoice goes

• Amount sets the level of authority needed. For example, invoices over a set amount also need the controller.
• Department or cost center decides whose budget it is, so who approves.
• PO status decides whether the spend was already approved. A PO invoice that matches within tolerance can skip a second approval, because the spend was approved when the PO was raised.

Vendor, GL account and entity rules handle the special cases: legal fees always to the general counsel, capital expenditure accounts to the controller, a subsidiary’s invoices to its own finance lead.

Designing an approval matrix

An approval matrix is your delegation of authority applied to invoices, written precisely enough that a system or a new AP clerk can follow it without asking. Write it with roles, not names, and keep a separate list of who holds each role, so when someone changes jobs you update one list instead of every rule.

Keep approvers to as few as your controls allow, usually one or two. Every extra approver adds delay and makes each one assume someone else checked the details. Code the invoice before routing it, because the cost center decides the approver; if the cost center is unknown, send the invoice to AP or the controller to code, not to a guessed approver.

Steps to build it

1. 1

   List your invoice types

   PO-backed goods, PO-backed services, non-PO operating expenses, recurring contracts and one-off capital purchases.

2. 2

   Set amount bands

   Three or four bands that match your delegation of authority, not one per manager.

3. 3

   Assign a role to each band and cost center

   Budget owner, department head, controller, CFO.

4. 4

   Decide how matched PO invoices are handled

   No further approval, or a single confirmation by the requester.

5. 5

   Plan for absence and delay

   Name a delegate with at least the same authority, set reminders, an escalation path after a deadline, and a fallback approver for invoices no rule covers.

6. 6

   Test it

   Run last month’s invoices through the matrix on paper before you publish it, then review it at least once a year.

Segregation of duties

Segregation of duties splits vendor setup, invoice entry, invoice approval and payment release between different people, so no one person can create and pay a fraudulent or mistaken invoice alone. The key separations in AP:

• The person who adds or changes vendors should not approve invoices or release payments.
• The person who approves an invoice should not release the payment.
• The person who requested a purchase should not be the only approver of its invoice. Block self-approval in the system, not just in policy.

Small teams that cannot fully separate roles use compensating controls, such as the owner reviewing every payment run and every change to vendor bank details. Record every decision: who approved, when, at what amount and under which rule. Auditors test this trail, and approvals by email are hard to find, easy to forge and leave no reliable record.

Checks that stop duplicate payments

Duplicates get paid when the same bill enters the process twice and the second copy does not look exactly like the first: a supplier emails and posts the same invoice, a reminder is keyed as a new bill, or the supplier exists twice in the vendor list. APQC benchmarking, published by CFO.com, found duplicate or erroneous payments at 0.8% of annual disbursements for top performers and 2% for bottom performers.

Review flagged items before each payment run and record why each was released or rejected. Remember that recurring charges, such as rent, look like duplicates but are not.

Doing it in software

QuickBooks Online offers a Bill Multi-Condition Approval workflow, which Intuit says is available to Bill Pay Elite customers. Xero’s built-in approval is a submit-and-approve step controlled by user role. In Aequo AP, Settings › Approval Rules routes by amount, vendor and department, with delegation and SLA-based reminders and escalation; when no rule matches, it suggests an approver based on who approved similar past invoices, and a person decides whether to assign it. The bill approval workflows walkthrough has the steps for each.