Accounts Payable Internal Controls: A Checklist for AP Teams

What are accounts payable internal controls?

Accounts payable internal controls are the rules and checks that make sure a company only pays real vendors, for real goods and services, into the right bank accounts. They include segregation of duties, vendor master data controls, bank detail verification, approval limits, three-way match and regular review, so no one person can add a vendor and pay it alone.

This guide walks through each of the core accounts payable controls, who should own them and how to test them, and ends with an AP controls checklist you can use with your team. It starts with vendor master data and bank detail changes.

Why do AP controls matter for fraud?

AP is where money leaves the business, so it's where both outside criminals and dishonest insiders aim. Good controls stop a bad payment before it goes out, which matters because most stolen money is never recovered.

• Fraud is reported at record levels. Victims reported $20.9 billion in internet crime losses to the FBI in 2025 (FBI IC3 2025 Internet Crime Report).
• Spoofed email is the main way in. Among organizations hit by business email compromise in 2024, 79% cited spoof emails, the most common type (AFP 2025 Payments Fraud and Control Survey, key highlights, p. 3).
• Losses grow with authority. In US and Canadian occupational fraud cases, the median loss was $50,000 when an employee committed the fraud, $150,000 for a manager and $528,000 for an owner or executive (ACFE, Occupational Fraud 2026, p. 97).

That last point is why controls have to apply to everyone. A control that a senior person can skip isn't really a control.

What does segregation of duties look like in AP?

Segregation of duties means splitting the steps of a payment so that no one person controls it from start to finish. The COSO framework, the standard most US auditors use, says "segregation of duties is typically built into the selection and development of control activities" (COSO, Internal Control: Integrated Framework, Executive Summary).

In AP, split these four jobs across different people:

• Vendor setup and changes. Adds vendors and edits their details, including bank accounts.
• Invoice approval. Confirms the goods or services were received and the invoice is correct.
• Payment release. Sends the payment run or approves it in online banking.
• Reconciliation. Matches bank statements to payments and reviews the vendor file.

The most important split is between whoever changes vendor bank details and whoever releases payments. If one person can do both, they can redirect money to themselves and no one will see it until the real vendor calls.

Small teams can't always split four ways. COSO allows for that: "where segregation of duties is not practical, management selects and develops alternative control activities." In practice, that means a second approver on vendor changes, an owner or outside accountant reviewing payments, and a monthly review of the vendor file.

How should you control changes to vendor master data?

Your vendor master data is the list of every vendor you pay and where you pay them. Whoever can edit it controls where money goes, so it needs the tightest controls in AP.

• Limit who can edit it. Give edit access to as few people as possible, and never to anyone who can also release payments.
• Require a documented request for every change. Each new vendor or edit should have a reason, a source document and a requester.
• Use a second approver. A different person reviews and approves each change before it takes effect.
• Log every change. Your system should record who changed what, when, and the old and new values. Run a change report every month and have someone outside AP review it.
• Clean it up regularly. Deactivate vendors with no payments in 12 to 18 months, merge duplicates, and flag any vendor whose address or bank account matches an employee's.

New vendors should go through a full vendor onboarding process before they're added, not after the first invoice arrives.

How should bank detail changes be verified?

Treat every bank detail change as high risk, however routine it looks. A request to update a vendor's account is the setup for payment diversion fraud, and it often comes from a real vendor's hacked inbox.

A strong control has four steps:

1. Don't act on the request alone. Email, PDF and phone requests are unconfirmed until verified, even from a known contact.
2. Collect the new details through a secure channel if you have one. If you don't, call the vendor back on a number already in your vendor file or on their website, never one from the request. See callback verification.
3. Verify the account itself. Account validation confirms the account is open. Ownership verification confirms it belongs to your vendor. You need the second to stop a criminal using their own real account.
4. Have a second person approve the change. Then hold or review the first payment to the new account.

Write this into policy, with no exceptions for urgent requests or senior staff. Urgency is a classic pressure tactic.

What approval limits should payments have?

Approval limits decide who can approve a payment based on its size. Set them by dollar amount and payment type, put them in writing, and set them in your AP system and online banking so they can't be skipped.

An example approval matrix (adjust the amounts to your company's size):

Payment amount	Who approves
Under $5,000	AP manager
$5,000 to $50,000	AP manager and controller
Over $50,000	Controller and CFO
Any wire, or any first payment to a new or changed account	Two approvers, whatever the amount

Wires deserve extra care. In 2024, wire transfers were the payment type most often targeted by business email compromise, reported by 63% of organizations hit by it (AFP 2025 Payments Fraud and Control Survey, key highlights, p. 3).

Watch for invoices just under a limit, or one large invoice split into several smaller ones. Both are signs someone is working around the matrix.

How do three-way match and invoice review help?

A three-way match checks that three documents agree before an invoice is paid:

• The purchase order: what you agreed to buy, and at what price.
• The receiving record: what actually arrived or was delivered.
• The invoice: what the vendor is billing you for.

If the quantity, price or vendor doesn't match, the invoice is held for review. This stops fake invoices for goods you never ordered, overbilling by real vendors, and billing schemes run by insiders. Set a small tolerance, such as 2% or $100, so minor differences don't jam the queue.

Add these invoice review checks alongside it:

• Duplicate check on invoice number, amount and vendor.
• Vendor check: pay only vendors already approved in your vendor master data.
• Bank detail check: the bank account on the invoice must match the vendor file. If it doesn't, stop and verify.
• Non-PO invoices such as utilities and subscriptions need a named budget owner to approve them.

Three-way match won't catch a changed bank account on a real invoice. That's why bank detail controls come first.

How do you audit and test AP controls?

A control only works if people follow it, so test it. COSO lists monitoring activities as one of the five components of internal control, alongside the control activities themselves (COSO).

Ways to test your AP controls:

• Sample vendor changes. Pull 10 to 25 changes from the last quarter. Check each had a request, a verification record and a second approver.
• Review access. List who can edit vendors and who can release payments. Anyone on both lists is a gap.
• Run data checks. Look for duplicate payments, vendors that share a bank account or address with an employee, and invoices just under approval limits.
• Do surprise audits. Unannounced reviews change behavior.

Many companies skip these. Among US and Canadian organizations in the ACFE's study, only 49% used proactive data monitoring and just 39% ran surprise audits (ACFE, Occupational Fraud 2026, p. 97). Speed matters too: of organizations that lost money to payments fraud in 2024, only 35% uncovered it in under a week (AFP 2025 key highlights, p. 13).

AP internal controls checklist

Use this AP controls checklist to check where your team stands. Owners are typical; small teams can combine roles as long as no one both changes vendor bank details and releases payments.

Control	Owner	Frequency
Verify new vendors before adding them to the vendor file	AP specialist, approved by AP manager	Every new vendor
Verify bank detail changes by secure channel or callback, plus account ownership	AP specialist, approved by a second person	Every change
Second approval on all vendor master data changes	AP manager or controller	Every change
Separate vendor setup from payment release	Controller	Set once, review quarterly
Three-way match on PO invoices	AP specialist	Every invoice
Duplicate invoice check	AP system or AP specialist	Every payment run
Approval limits in AP system and online banking	Controller	Set once, review yearly
Dual approval on wires and first payments to new accounts	Treasury or controller	Every payment
Vendor change report reviewed outside AP	Controller	Monthly
Bank reconciliation	Accounting, not AP	Monthly, or daily for high volume
Vendor file cleanup (inactive, duplicate, employee matches)	AP manager	Quarterly
Access review for AP and banking systems	Controller or IT	Quarterly
Positive pay on checks and ACH debit filters	Treasury	Set once, review yearly
Surprise audit of AP	Internal audit or outside accountant	At least yearly

How does Coffr support AP internal controls?

Coffr covers the two controls where most losses start: new vendor bank details and bank detail changes. Instead of collecting details by email or PDF, vendors share them through Coffr's secure channel. Coffr verifies the person sharing them and confirms the bank account belongs to them before the details reach your team.

Each verification is recorded on an immutable blockchain ledger, so you have an audit trail that can't be edited and any later change stands out.

See how Coffr can strengthen your accounts payable internal controls. Book a demo.