Accounts Payable internal controls: checklist and guide

Accounts payable is where cash leaves your business, so it’s where errors, duplicate payments and fraud hit hardest.

Strong AP internal controls help you reduce that risk, with clear checks on supplier set-up, invoice approval, payment processing and reconciliation.

The right controls make it harder for incorrect or fraudulent payments to slip through and give your finance team clear visibility of where issues start.

Key takeaways:

• AP internal controls help prevent payment errors, fraud and unauthorised transactions
• Controls should cover the full invoice-to-payment process, not just final payment approval
• Segregation of duties, supplier verification and regular reconciliations are core safeguards
• Automation strengthens controls by flagging anomalies and applying the same rules to every invoice and payment

What are accounts payable internal controls?

Accounts payable internal controls are the checks, policies and processes you use to make sure every supplier invoice and payment is legitimate and accurate.

Effective internal controls for accounts payable reduce the risk of fraud, overpayments, duplicate payments, non-compliance and processing errors, and create a clear audit trail along the way.

The key objectives of AP internal controls are to make sure every payment is:

• Valid: The supplier, invoice and underlying purchase are genuine
• Accurate: Invoice values, tax coding and payment information are correct
• Authorised: The right people have approved the purchase and payment
• Timely: Invoices are paid within the agreed terms
• Paid once: Duplicate invoices or repeat payments are identified and prevented
• Compliant: Payments follow your internal policies and relevant accounting, tax, regulatory and GDPR rules

Why AP controls matter: risk, fraud and regulation

Accounts payable controls do more than prevent the occasional payment mistake.

Because AP sits at the point where supplier data, invoices, approvals and cash intersect, weak controls can create financial, operational and compliance risks across your business.

The cost of weak controls

Weak AP controls let duplicate or incorrect payments slip through unnoticed, especially when invoice volumes are high or the process relies on manual review.

Weak supplier onboarding and bank-detail controls can also increase exposure to supplier impersonation, payment diversion and internal fraud.

The impact goes beyond the cash you lose. Control failures can also lead to inaccurate financial reporting, audit findings and extra remediation work.

And if legitimate invoices are paid incorrectly or late, supplier relationships suffer too.

In more serious cases, weaknesses in AP can contribute to financial misstatements.

The regulatory picture: UK and US

In the US, Section 404 of the Sarbanes-Oxley Act (SOX) requires management at in-scope companies to assess how effective their internal control over financial reporting is.

AP processes form part of that control, because supplier liabilities, expenses and cash payments all feed into financial reporting. So AP controls need to be properly designed, documented and operated wherever they address a financial reporting risk.

In the UK, Provision 29 of the 2024 UK Corporate Governance Code asks boards to monitor and review the company’s risk management and internal control framework, and to declare whether their material controls were effective as at the balance sheet date.

The revised provision applies to financial years beginning on or after 1 January 2026. Separately, the Economic Crime and Corporate Transparency Act 2023 introduced a failure to prevent fraud offence for large organisations. It took effect on 1 September 2025 and puts more emphasis on having reasonable fraud prevention procedures in place.

Mapping AP controls to COSO

The Internal Control-Integrated Framework from COSO (the Committee of Sponsoring Organizations of the Treadway Commission) organises internal control around five interconnected components.

Key risks in the accounts payable cycle

Accounts payable sits within the wider procure-to-pay (P2P) cycle, which covers the full process from identifying a purchasing need and raising a purchase order to receiving goods or services, processing the supplier invoice and making a payment.

Because AP is where money leaves your business, weaknesses earlier in P2P can surface here as duplicate payments, unauthorised spend, fraud or reconciliation issues.

The main risks typically arise where supplier data, invoice processing, approvals and payment controls are weak or inconsistently applied.

Types of AP internal controls: preventive, detective and corrective

Accounts payable internal controls fall into three categories. Preventive controls stop errors or fraud before they happen.

Detective controls find issues during or after processing. Corrective controls help you recover losses or fix problems once they’ve been found.

A strong AP control framework uses all three, not just a single checkpoint.

Core accounts payable controls explained

Strong accounts payable controls reduce the risk of fraud, payment errors and inaccurate financial reporting.

No single control eliminates risk, so the most effective AP teams layer several checks across supplier onboarding, invoice processing, approvals and payments.

Segregation of duties

Segregation of duties means dividing key AP responsibilities between different people. Ideally, the same person shouldn’t handle supplier set-up, invoice processing, invoice approval and payment release.

Separating these tasks makes it harder for one person to create a fraudulent supplier, submit or approve an invoice and release payment without anyone else getting involved.

What good looks like: set-up, processing, approval and payment sit with different people, and system permissions enforce the split. Smaller team? Add compensating controls, such as an independent review of every payment run.

Watch out for: access rights that quietly expand over time, leaving people with conflicting permissions. Review user access at least once a year.

Vendor master data management

Vendor master controls govern how supplier records are created, changed, reviewed and deactivated.

Supplier bank details are a common target for fraud, while duplicate or outdated supplier records can contribute to payment errors.

So check new suppliers before you activate them, and independently verify any request to change sensitive details like bank accounts.

The safest approach is to call the supplier on contact details you already hold, never the ones included in the change request.

What good looks like: every new supplier and every change to sensitive data is independently verified and logged.

Watch out for: bank detail changes accepted on the strength of an email alone. Email requests are easy to fake.

Xelix Vendors helps you keep your vendor master clean and spot risky changes to supplier data before you pay.

Invoice approval workflows and delegated authority

An approval workflow determines who can authorise invoices and at what financial thresholds.

A documented approval matrix makes sure higher-value or unusual spend gets the right level of scrutiny. Rules can vary by invoice value, department, spend category or legal entity, but no one should ever approve their own spend.

What good looks like: approval limits are documented, enforced automatically where possible and updated whenever responsibilities change.

Watch out for: invoices routinely approved outside the workflow because the usual approver is away. Set up formal delegation instead.

PO matching

Purchase order matching compares invoice information with purchasing records before payment. In a three-way match, the invoice is checked against both the purchase order and evidence that the goods or services were received.

PO matching helps confirm that an invoice relates to an authorised purchase, that the agreed quantities and prices are correct and that the organisation received what it is being charged for.

For a full walkthrough, read our guide to 2-way and 3-way PO matching.

What good looks like: material discrepancies are automatically routed for investigation, not manually overridden.

Watch out for: matching exceptions so frequent that overrides become routine. That often points to data extraction errors at intake, which Xelix Capture, our invoice intake layer, is built to reduce.

Duplicate payment prevention

Duplicate payment controls identify invoices that may already have been entered or paid.

Basic ERP duplicate checks usually rely on exact fields like supplier, invoice number and amount. That can leave gaps when the same invoice is entered using slightly different invoice-number formats, under duplicate supplier records or with small changes to the amount or reference.

More advanced AP controls can identify these less obvious, or “fuzzy”, matches before money leaves your business.

That’s where we come in. Xelix Transactions adds an AI-powered control layer over ERP data, checking invoices across multiple data points to help you catch near-identical duplicates before they’re paid.

What good looks like: duplicate payment checks run across multiple data points, not just exact matches, before every payment run.

Watch out for: assuming an ERP’s exact-match duplicate check catches everything. A reformatted invoice number can be enough to slip through.

Payment controls

Payment controls govern how payments are reviewed, approved and released to suppliers.

A payment run review checks proposed payments against approved invoices and identifies unusual transactions, while dual authorisation requires two authorised individuals to approve releases.

Bank file protection, including restricted access and secure transmission, helps prevent changes to payment details. In the US, Positive Pay services can provide additional protection by allowing banks to compare presented cheques against an approved payment list.

What good looks like: independent payment run reviews, dual authorisation and securely controlled bank files.

Watch out for: payment files that can be edited or released after approval without further checks.

Supplier statement reconciliation

Supplier statement reconciliation means comparing supplier statements against your accounts payable ledger to find missing invoices, unrecorded credit notes and other discrepancies.

It helps you keep balances accurate, recover outstanding credits and resolve disputes before they escalate.

Manual statement reconciliation takes time, especially at high volumes. Xelix Statements automates supplier statement reconciliation, comparing statement data with your ledger and flagging discrepancies for review.

What good looks like: supplier statement reconciliation on a regular schedule, with discrepancies prioritised and resolutions documented.

Watch out for: only reviewing statements when a supplier raises a dispute. By then, missing credits may have gone unnoticed for months.

Purchasing cards and expenses

Purchasing cards, corporate cards and employee expense reimbursements require controls to prevent unauthorised or excessive spending.

These typically include transaction limits, merchant category restrictions, spending policies and receipt matching. Expense claims should also be checked against supporting documentation and approved independently.

These processes sit alongside traditional accounts payable, but weak controls here expose you to similar financial risk.

What good looks like: purchasing cards with clear spending limits, restricted merchant categories, receipt verification and independent approval.

Watch out for: card transactions or expense claims approved without supporting evidence.

Audit trail and documentation

An audit trail provides a record of every significant transaction, approval and change within the accounts payable process.

It should show who acted, when and what changed. Supporting documents, including invoices, purchase orders and approval records, should be stored securely and easy to retrieve.

This helps you investigate discrepancies, demonstrate compliance and provide evidence during internal or external audits.

What good looks like: a complete, searchable audit trail of every transaction, approval and change, retained in line with your policies.

Watch out for: decisions made over email or in conversation and never recorded, leaving gaps in your audit trail.

Accounts payable internal controls checklist

A strong AP control framework helps you minimise payment errors, prevent fraud and keep accurate financial records. But controls only work when they’re consistently applied, monitored and reviewed.

Use this accounts payable internal controls checklist as a practical internal control questionnaire to assess your existing processes, identify potential weaknesses and highlight areas for improvement.

Governance

• Is there a documented AP policy that's reviewed at least annually?
• Is there a clear approval matrix with defined spending thresholds?
• Are duties appropriately segregated, with potential conflicts identified and reviewed?

Vendor master management

• Are new suppliers verified before their first payment is processed?
• Are changes to supplier bank details independently verified through a trusted communication channel?
• Are dormant or inactive supplier accounts regularly reviewed and deactivated?
• Is access to vendor master data restricted, monitored and logged?

Invoice processing

• Are invoices accurately captured, including individual line-item details?
• Is purchase order (PO) matching applied according to the type of expenditure?
• Are non-PO invoices approved by employees with the appropriate authority?
• Are duplicate invoice checks performed before payments are processed?

Payments

• Are payment runs independently reviewed and subject to dual authorisation?
• Are payment files protected against unauthorised changes or manual editing?
• Do urgent, exceptional or manual payments require additional approval?

Monitoring and reconciliation

• Are supplier statements reconciled against AP records on a regular schedule?
• Are exceptions, discrepancies and control overrides investigated and documented?
• Are key AP control metrics, such as duplicate payment rates and outstanding exceptions, reported monthly?
• Are internal controls formally tested at least once a year?

Manual vs automated AP controls

Manual AP controls rely on people to review invoices, verify supplier details, spot duplicate payments and reconcile accounts.

These checks can work, but they can be time-consuming, inconsistent and hard to maintain as invoice volumes grow.

Manual reviews are also performed periodically or on a sample basis, meaning errors or suspicious transactions may only be identified after payments have been processed.

Automated AP controls use software to monitor transactions continuously, flag anomalies and enforce the same rules throughout the accounts payable process.

So you can catch potential issues before payments are made, rather than relying on retrospective checks.

That’s the approach behind Xelix. Transactions checks invoices before payment, Statements reconciles supplier statements and Vendors monitors changes to supplier data. Xelix Capture, our invoice intake layer, sits in front of the ERP and extracts invoice data with 99% extraction accuracy.

Testing and auditing AP controls

Regular testing and auditing helps you find weaknesses, verify compliance and make sure your AP processes are working as intended.

Even with automated controls in place, periodic reviews are essential to confirm that checks remain effective as business processes, suppliers and transaction volumes change.

An accounts payable internal audit typically assesses whether appropriate controls exist, how consistently they’re applied and whether they effectively prevent or detect errors, duplicate payments and fraudulent activity.

Internal control vs internal audit

An internal control is a specific check or procedure designed to prevent or detect errors, fraud or non-compliance within the AP process.

An internal audit is an independent assessment of whether those controls are appropriately designed, consistently followed and working as intended.

Preparing for an AP audit

Effective audit preparation starts with clear documentation of the AP process, from invoice receipt and approval through to payment and reconciliation.

This allows auditors to understand where controls operate, who is responsible and how exceptions are managed.

Key documentation to prepare includes:

• Process narratives: Written descriptions of each stage of the AP workflow, including responsibilities, approval requirements and control activities
• Process flowcharts: Visual representations of how invoices and payments move through your business, highlighting key control points and potential risks
• Control matrix: A structured record linking identified AP risks to specific controls, control owners, testing frequency and supporting evidence
• Evidence of operation: Records showing that controls have been performed, like approval histories, reconciliation reports and system-generated audit trails
• Exception logs: Documentation of flagged transactions, investigation outcomes, corrective actions and how issues were resolved

KPIs for monitoring AP controls

Tracking key performance indicators (KPIs) helps you assess how effective your accounts payable internal controls are, identify potential risks and measure improvements over time.

Monitor them regularly and you’ll spot weaknesses early, fix recurring issues and keep your controls working as transaction volumes grow.

The following KPIs provide a useful starting point for evaluating AP control performance.

Building an AP internal control policy

A clear accounts payable internal control policy helps you standardise processes, establish accountability and reduce the risk of errors or fraudulent payments.

It also gives AP managers a framework for reviewing and improving controls as business needs evolve.

An effective AP internal control policy and procedure template should cover the following areas:

• Scope: Define which AP activities, entities and employees the policy applies to, from invoice receipt through to payment
• Roles and responsibilities: Establish who is responsible for processing invoices, approving payments, managing supplier information and monitoring compliance
• Approval matrix: Set clear authorisation limits and approval requirements based on transaction value and risk
• Vendor master rules: Outline procedures for creating, updating and verifying supplier records, particularly changes to bank details
• Payment rules: Specify payment authorisation procedures, segregation of duties requirements and checks to prevent duplicate or incorrect payments
• Exception handling: Document how suspicious transactions, discrepancies and control failures should be flagged, investigated and resolved
• Review cycle: Establish how often controls and policies should be reviewed, tested and updated