Accounts Payable Internal Controls Checklist (SoD and Fraud)

Summary

The checklist has 20 controls across six points in the payment path, each with a test.
Five come first: keeping vendor and bank-detail changes away from payment release, a callback on every bank change, an independent approver, a payment-run check and an independent bank reconciliation.
Seven pairs of duties in the matrix should never sit with one person.
With no receiving record, a named person outside AP confirms services, and the delivery or scale ticket stands in for bulk loads.
LayerNext applies the intake, matching, approval and reconciliation controls on top of the ERP you already run.

The accounts payable internal controls that matter most keep one person from creating a vendor, approving its invoices and releasing its payments, and put someone outside AP in charge of confirming that the goods or work were received. The checklist below has 20 controls, each with a test.

Controls drift in ordinary ways: a permission added for leave cover never comes off, and a branch manager approves an invoice with no receiving record to check it against. In the AFP's 2026 Payments Fraud and Control Survey, 76% of US organizations had attempted or actual payments fraud in 2025, and 74% were affected by business email compromise. In the ACFE's Occupational Fraud 2026, frauds caught within six months had a median loss of $40,000, against $1.115 million for the 5% that ran more than five years.
‍

‍

The Accounts Payable Internal Controls Checklist

Run each test quarterly on your own records and keep each result with its date, which is the evidence an auditor asks for. Set thresholds to your own volumes.

‍

The Five Controls to Put in Place First

Each closes a gap where one person, or one email, could move money alone.

Keep vendor creation and bank-detail changes away from anyone who can release a payment (controls 1, 2 and 13).
Call back on every bank change, to a number already on file (control 2).
Keep the approver apart from the person who entered the invoice (control 11).
Compare each payment run with the approved invoice list before release (control 14).
Have someone with no payment authority reconcile the bank (control 16).

‍

Vendor Master Controls
‍

#	Control	How to test it
1	A second person reviews each new vendor's tax form and bank documentation before the first payment	Each vendor created in the last 90 days has a different creator and reviewer, documents on file and no early payment
2	Every bank-detail change is verified by a call to a number already on file	Each bank change in the last 90 days has a logged call: caller, number, person reached, date. A number from the request email fails
3	The vendor master is compared with employee records	Match vendor address, phone, bank account and tax ID against the employee master. Explain every match in writing

‍

Invoice Intake Controls
‍

#	Control	How to test it
4	Invoices arrive through one logged channel, and only named AP users can enter bills	Every invoice paid last quarter has an intake record, and no approver can enter bills
5	Each invoice is checked against the vendor's full history, with invoice numbers normalized	Export 12 months of invoices, strip leading zeros, dashes and spaces from invoice numbers, and sort by vendor and amount. Explain every repeat and every ticket number on two invoices

‍

Matching Controls
‍

#	Control	How to test it
6	Goods are matched to the PO and receipt, or to the delivery or scale ticket on contract purchases, within tolerances	Invoices paid in the last 30 days that exceeded the PO, receipt or ticket by more than tolerance each have an approved exception
7	Services are confirmed complete by a named person outside AP, with a date, before approval	Ten paid service invoices each have a dated confirmation from a named manager who did not enter the invoice
8	Invoices with no PO go to a named approver outside AP	Every paid non-PO invoice above your threshold has an approver outside AP
9	A change to amount, payee or coding after approval goes back to the approver	For ten paid invoices, compare approved and posted amount, payee and coding. Every difference has a logged reason

‍

Approval Controls
‍

#	Control	How to test it
10	Approval limits by amount, vendor type and cost center are enforced in the system	Each approver of the five largest payments last quarter held authority for that amount on the approval date
11	The approver is never the person who entered the invoice	List invoices where the entrant and approver match. Expect none
12	Backup approvals and invoices just under a limit are reviewed monthly	A backup who approves every month fails. Invoices within 5% below a limit are listed by vendor and reviewed

‍

Payment Release Controls
‍

#	Control	How to test it
13	Release rights sit with named people who cannot edit vendors or bank details, approve invoices or build batches	List everyone who can release payments in the ERP and bank portal. None holds those rights, and the last three runs had a different builder and releaser
14	Each payment run is compared with the approved invoice list before release	A line not on the list, or with a different payee or amount, fails
15	The bank applies dual authorization above a threshold and positive pay or payee validation. Check stock and the check log are kept apart	Get the bank's threshold and positive pay status in writing and compare them with policy. For checks, count stock against a log kept elsewhere

‍

Reconciliation and Oversight Controls
‍

#	Control	How to test it
16	Someone with no payment authority reconciles the bank from a statement obtained directly	The reconciler has no payment rights, and items open more than 30 days over three months are explained
17	The AP subledger is reconciled to the general ledger monthly by someone who does not post invoices, and goods received but not invoiced are accrued	The last three reconciliations are signed and dated, differences are explained, and the received-not-invoiced report ties to the accrual
18	Supplier statements are reconciled to open AP for the largest vendors	Compare statements from your ten largest vendors with open AP. Unexplained differences and unapplied credits fail
19	A manager outside AP reviews vendor changes, reactivated dormant vendors and payments to new vendors monthly	A signed review exists for the last three months. Each vendor reactivated after 13 months without payment has an approver
20	AP staff take mandatory leave, and surprise reviews are run	Each AP user took five consecutive working days away in the last 12 months. The last surprise review is dated on file

‍

Confirming Receipt Without a Receiving Record

Matching controls assume a receiving record exists. Services and bulk loads often have none.

Services

Maintenance, repairs and contractor work leave no receipt, and a coordinator usually chases the responsible manager by email. Control 7 asks for a dated confirmation from a named person outside AP, recorded in the system and not in an email thread. In LayerNext, an approval chain by vendor or GL code sends the invoice to that manager, a reminder follows if it sits, and the approval is logged automatically. If the requester is the only possible confirmer, a second person reviews that vendor's services spend monthly.

Bulk loads and blanket contracts

Loads are weighed or counted on arrival, and a scale house, warehouse or dispatch system produces a ticket. Contract pricing means no PO per load and the ticket number may not be on the invoice, so the ticket is the matching document. Control 6 sets a tolerance because origin and destination weights differ legitimately, and control 5 catches one ticket on two invoices.

An Accounts Payable Segregation of Duties Matrix

X means never combine the two duties in one person; if the team is too small, move one duty to the owner or the bank. A ! means combine only with a named compensating control. ok means a later control reviews the pair.

	Vendor edit	Bank change	Enter	Approve	Build batch	Release	Reconcile
Vendor edit	-	!	!	X	!	X	ok
Bank change	!	-	!	!	!	X	!
Enter	!	!	-	X	ok	!	!
Approve	X	!	X	-	!	X	!
Build batch	!	!	ok	!	-	X	!
Release	X	X	!	X	X	-	X
Reconcile	ok	!	!	!	!	X	-

Each X pair allows a specific fraud.

‍

Pair	What one person could do
Vendor edit and approve	Create a vendor and approve its invoices with no PO
Vendor edit and release	Create a vendor and pay it
Bank change and release	Redirect a real vendor's payments to another account
Enter and approve	Pass inflated or duplicate invoices they entered
Approve and release	Change the payee or amount after approval
Build batch and release	Send a payment run no one else has seen
Release and reconcile	Make an unauthorized payment that never surfaces in the reconciliation

In LayerNext, role-based permissions keep the person who submitted an invoice from approving it, which covers the enter and approve pair. Separation means a fraud needs a second person, not that two people cannot collude. In the ACFE's cases, three or more perpetrators had a median loss of $324,000, against $55,000 for one.

‍

Segregation of Duties Across Branches, Plants and Small Teams

Few AP teams reach textbook separation, so split the costliest pairs first and add outside review.

Setup	Split first	Outside AP does	Risk left open
Three to five in central AP, with branches or plants approving	AP enters and builds batches but never approves. One seat that does not enter, approve or release maintains vendors and bank details. Branch approvers cannot create vendors	Treasury or the controller releases each run. The controller reviews the vendor change report monthly and recertifies permissions quarterly	Branch approvers approving without proof of receipt
Six to fifteen across locations or entities	One seat per duty, assigned by role. A second reviewer on every bank change	The controller samples approvals by branch monthly and recertifies quarterly. A yearly surprise review	Permission creep as people cover for each other. Branch approver and vendor collusion

Write each compensating control down: the risk, who performs it, how often, what they examine and the record it leaves.

‍

Checking Real Permissions and Change History

Job titles hide conflicts, so export every user and role from the AP system, the ERP and the bank portal, mark each user against the seven duties, and fix anyone who holds both duties of an X pair first.

System	Who holds which duty	Where vendor and bank changes show
NetSuite	Show Role Differences under Setup, Users/Roles compares roles and exports to CSV or XLSX	System Notes record who changed a field, when, and the old and new value, and no one can edit them. Check that a recent bank change shows the old and new account numbers
SAP Business One	The authorizations window exports a user's or group's rights to Excel. Read Effective Authorization, because the most generous level wins across user and group settings	Tools > Change Log shows who changed a document or master data record and when, and Show Differences compares versions
QuickBooks Desktop Enterprise	The Permission Access by Roles report shows each role's permissions	The Audit Trail report is transaction-based, so export the vendor list each month and compare it with the last one
Dynamics 365 Finance	Segregation of duties rules sit under System administration, Security. Run Verify compliance of user-role assignments and review unresolved conflicts. Roles assigned through Active Directory domain groups are not verified	The database log records inserts, updates and deletes for the tables and fields an administrator sets up, so confirm logging is on for vendor bank accounts
Dynamics SL	Access Rights Maintenance (95.270.00) grants rights to users and groups	Export the vendor list monthly and compare it with the last one

For Epicor and other ERPs, ask your administrator for the same two exports.

‍

Accounts Payable Fraud Schemes, Prevention and Detection Signals

Each scheme maps to the controls that stop it and a signal to test each month.

Scheme	Controls	Signal to test for
Shell vendor	1, 3, 11, 13	Vendor details match an employee. Paid with no PO or receipt. Invoices just under a limit
Bank-detail change	2, 13, 15, 19	A bank change then a payment within days. A new email domain. An account name that differs from the vendor
Duplicate and inflated invoices	5, 6, 11	Same vendor and amount within 90 days. Prices above the PO
Work or goods never received	6, 7, 8	Services approved with no dated confirmation. Approval by the person who requested the work
Check and payment tampering	13, 14, 15, 16	Skipped numbers in the check sequence. Cleared items that differ from the payment register

‍

LayerNext raises four of these signals as they occur: duplicates, prices above the PO, invoices with no PO and bank-detail changes. The monthly test then confirms the flags were worked. Tips detected 43% of the ACFE's frauds, more than any other method. The largest drops in median loss followed management review (55%), proactive data monitoring (53%), surprise audits (50%) and job rotation or mandatory vacation (49%), which map to controls 19 and 20.

‍

How LayerNext Applies These Controls from Intake to Posting

LayerNext is an AI-powered financial operations platform. Its AI agents take an invoice from intake to posting in the ERP you already run, following rules your finance team writes. These stages are common starting points, and business rules and custom workflows carry any other step you define.

‍

Intake and duplicate checks

Invoices arrive by email, shared folder, cloud storage or phone photo, and the agents read scans and unfamiliar layouts without a template per vendor. The audit trail starts at receipt, which gives control 4 its intake record. Duplicates are flagged at capture, before an invoice reaches the ERP, and control 5's quarterly export is your evidence that the check is working.

Matching to the PO and receipt

Each invoice is compared line by line with its PO, receipt or packing slip and vendor record, against tolerances you define. Price drift, quantity mismatches, missing POs and wrong or closed POs become named tasks before anything posts, each tagged with the invoice, supplier and issue type. A missing PO or receipt prompts a specific question to the right person (controls 6 and 8).

Vendor bank-detail changes

A change to a vendor's bank details is flagged for review. The callback in control 2 stays a person's call to a number already on file, and the flag starts it.

Approval

Approval chains are written in plain English by vendor, amount or GL code, and routing can also use entity, location, department or exception type, so a branch and a plant follow the same logic. Reminders go out on pending approvals, approver turnaround is tracked, and approvers can act from the iOS and Android apps. Role-based permissions limit access to each finance workflow and keep a submitter from approving their own invoice, and nothing posts without human approval (controls 10 and 11).

Posting to the ERP

After approval, the agent enters the invoice in the ERP and confirms it saved. It uses the API where one exists, as with NetSuite and Microsoft Dynamics 365, and the ERP's own screens where it does not, as with QuickBooks Desktop and Dynamics SL, with the same rules and audit trail on both paths. Payment release and bank authorization (controls 13 to 15) keep running in your ERP and bank portal, now fed by invoices that were matched, approved and logged first.

Reconciliation

Supplier statements are reconciled against open AP, with discrepancies flagged and supplier credit memos applied (control 18). A separate bank reconciliation workflow takes a live bank feed or an uploaded statement, matches each line to the ledger as it lands, and sends only exceptions to a person. It also flags anomalous amounts, new payees and duplicate payments. Control 16 asks that whoever reviews those exceptions holds no payment authority.

Audit trail

Every action the AI takes and every decision a person makes, including each approval and human correction, goes into one unified log from receipt to posting, and nothing is deleted or overwritten. Admins and superadmins can export it, which gives control 12 the data to count backup approvals and a surprise review (control 20) a record to sample. Edits to a business rule show who made them and when.

How deployment starts

Deployment starts by mapping your existing process, business rules, approval chains and exceptions, then runs a controlled subset of the workflow with human review before it scales.

‍

FAQ

‍

1. What are the main internal controls for accounts payable?

Vendor master review, a callback on every bank change, PO and receipt matching, an independent approver, separate building and release of payments, and an independent bank reconciliation. The checklist has 20, each with a test.

2. What is segregation of duties in accounts payable?

It splits AP duties so no one person can create a vendor, approve its invoices and release its payments. The seven X pairs in the matrix should never sit with one person.

3. How do you approve a service invoice when there is no receiving record?

Route it to the manager responsible for the work and record that manager's confirmation with a name and date before approval. The confirmer should not be the person who entered the invoice.

4. How do you detect accounts payable fraud?

Run the signal tests in the fraud table each month. Tips detect more fraud than any other method, so also give employees a way to report concerns.

‍

Written by,

Team LayerNext

Team LayerNext is made up of experienced writers with backgrounds in finance, engineering, accounting, data analytics, AI, and business operations, sharing practical insights on AI-powered bookkeeping and smarter financial decision-making.