Accounts Payable Internal Controls: Best Practices + Free Manual (2024)

The main objective of accounts payable internal controls is to reduce the risk of error and fraud that may proliferate in the accounting information system if not detected, prevented, and corrected on time. Having controls in place helps the A/P team deliver on their responsibilities and maintain independence in reviewing and approving all A/P transactions.

The best way to enforce accounts payable internal controls is to establish an internal controls manual—and we took the liberty of making a template for you. Download our sample, and modify it to your liking.

1. Obligation to Pay Controls

An obligation arises the moment a purchase has been approved and made. Even if the goods have not yet been received, the company already has a future obligation to pay for these services. One of the accounts payable internal controls best practices is ensuring that obligation to pay controls are in place.

Individual Document Review

The A/P team must exercise extreme caution in reviewing all kinds of documents that they receive. They must review and assess the authenticity of the documents to the best of their abilities. When in doubt, it’s always a good and conservative practice to reach out to high-level managers for guidance.

In reviewing individual documents, good internal controls dictate the following:

1. Reviewing for duplicates: The A/P team must always check if the document in front of them is not a duplicate. For instance, vendors may erroneously or intentionally send another invoice. When vendors intentionally send a duplicate invoice, it’s possible that they’ve not yet received payment. In reviewing duplicates of invoices, you need to:
   • Identify duplicate indicators, such as the invoice number, amount, and date
   • Check accounting data for similar entries
   • Mark the document as duplicate if proven to be one
   • Inform the A/P manager of other issues, such as near matches
2. Assessing document integrity: It’s hard to determine the integrity of the document right away. It requires scrutiny and knowledge of the company policies. The A/P team must assess document integrity by ensuring that all submitted documents are:
   • In pristine condition (i.e., not mutilated or damaged even in part only)
   • Complete (i.e., no missing pages, missing attachments, incomplete information)
   • In the proper format or form version
   • Clean and in good form (i.e., not tampered with or marked up without approval unless the changes have been countersigned by the person responsible
   • Approved by the duly authorized person

Three-way Matching

Performing a three-way match is a best practice in A/P controls. This procedure ensures the accuracy and completeness of the invoice, purchase order (PO), and receiving report (RR). It is performed by comparing the:

• Items, quantities, and descriptions of items received per RR and per PO
• Items, quantities, and descriptions of items ordered per PO and per vendor invoice
• Price and terms in the vendor invoice and in the PO

Voucher Package

After three-way matching, the A/P staff assembles the voucher package, which includes the following documents:

1. Invoice
2. PO
3. RR
4. Payment Voucher

The main focus of the voucher package is the payment voucher because the details in the invoice, PO, and RR vouch for the amount stated in the payment voucher.

2. Data Entry Controls

Accounting is a recording function. In proper segregation of duties, the A/P team—those in charge of recording A/P transactions—should not be given tasks governing authorization (e.g., approving the purchase of goods) or custody (e.g., payment of vendor invoices). The scope of the A/P team’s responsibilities is to approve all transactions for payment and maintain the A/P records.

Methods of Data Entry

There are two methods to choose from when recording approved vendor invoices. The A/P team’s main concern is the recording of the invoice in the vendor’s subsidiary ledger (SL) account.

GL Updates and Corrections

It is best practice to delegate GL updates to the A/P manager only. The A/P manager should also approve all the proposed SL adjustments made by the A/P staff. In general, the data entry controls in the A/P department should look like the following:

1. The A/P staff and A/P manager must only have read-only and write-only permissions in the system, i.e., they’re not allowed to edit or delete existing records.
2. The A/P manager, aside from the access level granted above, will have the approver role for approving transactions entered by the A/P staff in the system.
3. The A/P manager may request, in writing, changes in the records—subject to the approval of the chief accountant. The A/P manager must clearly outline to the chief accountant why the change is necessary.
4. Once approved, the chief accountant will make the changes themselves. The written request must appear on the record so that there’s a documentary trail for changes within the system.

3. Payment Controls

Payments are outside the scope of the A/P team’s responsibilities. Since payments require the disbursem*nt of cash, the person who has access to the business’s bank accounts, credit cards, and checks must not be within the A/P team. Ideally, another person must make the payment to the vendor to ensure proper segregation of duties.

For small businesses, the admin team may have only a few employees who handle multiple roles. In this case, the small business owner must have complete oversight of payments to compensate for the missing internal control. It would be better if the owners would send payments, especially if they have access to the business credit card, bank account, or checks. Otherwise, the small business owner may delegate this responsibility to another person—as long as they authorize the payment.

Why You Need Internal Controls in A/P

Internal controls establish rules and procedures that everyone in the company should follow. In the case of A/P, they can help:

1. Minimize errors in payments: The possibility of overpaying or underpaying vendors and suppliers is never zero. At some point, the A/P team may overlook some transactions or misread the details or numbers in the invoice. With internal controls, you can establish checkpoints within the workflow so that different sets of eyes can verify and review the payment requests.
2. Organize work: Part of good internal control in a business is having standard operating procedures (SOPs). SOPs provide specific instructions about the roles and responsibilities of all A/P team members and show the procedures for how payment requests are accepted, reviewed, approved, and rejected.
3. Establish a document and audit trail: A good internal control system will always have an established document trail. This means that anyone in the company can follow the process by simply looking at the document trail.
4. Prevent fraud: A/P involves the authorization of payments. If there are no established internal controls or proper segregation of duties in accounting, unscrupulous employees may engage in fraudulent activities, like check tampering and forgery.
5. Enforce accountability: Employees requesting payment can be held accountable for transactions that the A/P team may flag. For example, if the company’s allowable fund for entertainment expenses is only $200, anything in excess of that amount will be charged against the employee.

Frequently Asked Questions (FAQs)

The accounts payable internal controls framework centers around minimizing the risk of fraud, errors, and incompliance within the business. Internal controls ensure that all errors and omissions are prevented, detected, and corrected promptly.

The A/P manager takes responsibility and full ownership in maintaining A/P controls. They uphold and enforce the internal controls at all times.

Bottom Line

Accounts payable internal controls ensure that all A/P records are correct, complete, and legitimate. They help the A/P team in reviewing, approving, and rejecting transactions based on company policies. Ultimately, internal controls in A/P are there to detect, prevent, and correct errors, omissions, and even fraud so that the business’s interests are not affected or compromised.