vaayaa Inclusive Education
Finance risk assessment

Accounts Payable Management Risk Assessment: Payment Fraud, Controls and Reporting Risks

A worked example of how an accounts payable team finds, scores and controls risks to supplier payments, from duplicate invoices and bank detail fraud to access, withholding duties and cash timing.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Accounts Payable Management course

Executive summary

This assessment shows how an accounts payable team can find, rate and control the risks that affect supplier payments and the accuracy of liabilities. Eight hazards were chosen because they are plausible in everyday payables work, including duplicate payments, bank detail fraud, weak access, accrual timing, withholding errors, cyber driven payment diversion, cash timing and conflicts of interest. Bank detail fraud carries the highest inherent score, which is Critical, because one unverified change can send a large payment to the wrong account. Each risk is scored before controls and again after existing and added controls. Every risk falls to Medium or Low once added controls are in place, but bank detail fraud stays at Medium because its impact remains serious. The first actions are a call back rule for bank changes, a split of entry and release duties, a duplicate invoice check and a tested backup. The business is a teaching example, so every score illustrates method, not a real organization.

Focus area
Accounts payable and supplier payments
Setting
Accounts payable function of a small to mid-sized business that pays suppliers through a regular bank payment run
Method
Five by five likelihood and impact payables risk register

Scope

This assessment covers the accounts payable process from supplier onboarding and invoice receipt through approval, payment, reconciliation and reporting. It looks at risks to the accuracy of liabilities, cash, supplier relationships and legal duties. It does not cover procurement strategy, payroll or the tax position of any real business. Jurisdiction, systems, payment volumes and the supplier base are assumptions made for teaching.

Context

The team has an accounts payable supervisor, two clerks and a payments approver who reports to the finance director. Invoices arrive by email and through a scanning tool, and are matched to purchase orders and goods receipts in the accounting system. Payments are released in a weekly bank run, and supplier details are kept in a vendor master file. Each risk is scored before controls to show its natural level, then again after existing controls and the additional controls that should be added.

Objectives, assets and stakeholders

The objective is to pay the right suppliers the right amount on time, keep liabilities accurate, protect cash and bank details, meet tax and reporting duties, and keep the trust of suppliers, managers and auditors. The assets in scope are cash and the payment account, the vendor master file, invoices and supporting records, approval workflows, the accounting system and supplier relationships. Stakeholders include the accounts payable team, the payments approver, finance management, the internal auditor, the external auditor, suppliers, staff who raise purchases and the tax authorities. Every risk has one owner role, and the accounts payable supervisor keeps the register current and reports to the finance director each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 4, score 16, high: H01 H06 Likelihood 4, impact 5, score 20, critical: H02
3 Possible Likelihood 3, impact 3, score 9, medium: H04 H07 Likelihood 3, impact 4, score 12, high: H03 H05
2 Unlikely Likelihood 2, impact 4, score 8, medium: H08
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible
2 Unlikely Likelihood 2, impact 2, score 4, low: H04 H07 Likelihood 2, impact 3, score 6, medium: H01 H03 H05 H06 Likelihood 2, impact 4, score 8, medium: H02
1 Rare Likelihood 1, impact 3, score 3, low: H08
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Duplicate or incorrect supplier payments 16 High 6 Medium Accounts payable supervisor
H02 Fraudulent change of supplier bank details 20 Critical 8 Medium Payments approver
H03 Weak access control and segregation of duties 12 High 6 Medium Finance director
H04 Accrual and cut-off misstatement 9 Medium 4 Low Financial controller
H05 Withholding tax and filing errors 12 High 6 Medium Tax manager
H06 Cyber attack and payment diversion through email 16 High 6 Medium IT manager
H07 Cash timing and liquidity mismatch 9 Medium 4 Low Treasury lead
H08 Conflict of interest in supplier selection and gifts 8 Medium 3 Low Compliance officer
H01

Duplicate or incorrect supplier payments

Financial Before 16 After 6

The same invoice is keyed or scanned twice, or an invoice is paid at the wrong amount or to the wrong supplier record, so cash leaves the business without a valid reason.

Who or what is affected: Accounts payable team, finance director and suppliers

Causes

Manual keying of invoices, scanned copies sent twice and suppliers that resend statements as invoices.

Consequences

Cash lost, supplier balances wrong and staff time spent recovering funds.

Existing controls

  • Invoices are matched to purchase orders before approval.
  • The payments approver reviews the payee list before each run.

Control gaps

Duplicate checks depend on invoice numbers, which suppliers sometimes change or omit.

Additional controls

  • Prevent: Block payment of any invoice number already recorded for the same supplier.
  • Detect: Run a weekly report of matching amounts, dates and invoice numbers before each payment run.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Accounts payable supervisor Target: Within 45 days Early warning: Duplicate invoice numbers or matching amounts found in the same supplier account.
H02

Fraudulent change of supplier bank details

Financial Before 20 After 8

A request to change a supplier bank account is accepted without proof, so the next payment for that supplier goes to an account controlled by a fraudster.

Who or what is affected: Accounts payable team, suppliers, finance director and lenders

Causes

Compromised email accounts, convincing requests that imitate known suppliers and pressure to pay urgently.

Consequences

Large direct loss, supplier disputes, legal exposure and damage to trust.

Existing controls

  • Bank detail changes must be approved by a second clerk in the system.
  • Payments to a newly changed account are listed separately in the payment run.

Control gaps

Call back contacts on file are sometimes out of date or missing altogether.

Additional controls

  • Prevent: Verify every bank change by call back to a contact already held on file, never one given in the request.
  • Respond: Freeze payments to the changed account and notify the bank and the finance director the same day.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Payments approver Target: Within 30 days Early warning: Supplier bank detail changes made without a confirmed call back to a known contact.
H03

Weak access control and segregation of duties

Operational Before 12 After 6

One person can create a supplier, approve an invoice and release a payment, or has wider system access than the role needs, so error and misuse go unseen.

Who or what is affected: Accounts payable team, finance director and internal auditor

Causes

A small team, rights added to cover absence and access that is never removed.

Consequences

Undetected error or misuse, failed audit testing and loss of funds.

Existing controls

  • Each user signs in with an individual account.
  • Payments above a set limit need a second approval.

Control gaps

Access is reviewed only when someone leaves the team or complains.

Additional controls

  • Prevent: Remove any user who can both create a supplier and release a payment.
  • Detect: Review user access rights each quarter and record the outcome for audit.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Finance director Target: Within 45 days Early warning: Users who hold both entry and release rights for supplier payments.
H04

Accrual and cut-off misstatement

Financial Before 9 After 4

Goods or services received before the period end are not accrued, or accruals are left in place after the liability has been settled, so liabilities and expenses are wrong.

Who or what is affected: Financial controller, finance director and lenders

Causes

Late invoices, receipts not recorded on time and rushed period ends.

Consequences

Misstated liabilities and expenses, and restated management reports.

Existing controls

  • Goods received notes are checked at each month end.
  • Accruals are listed and reviewed by the financial controller.

Control gaps

Services that have no goods receipt are often left off the accrual list.

Additional controls

  • Detect: Compare invoices received in the first days of the next month with the accrual list.
  • Recover: Reverse or rebook accruals that prove wrong within the next reporting cycle.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Financial controller Target: Within 60 days Early warning: Accrued invoices not matched to a receipt or approved within 60 days of the period end.
H05

Withholding tax and filing errors

Legal and compliance Before 12 After 6

Tax withholding is applied at the wrong rate, or returns are filed late or incomplete, because supplier tax status is not recorded before payment.

Who or what is affected: Tax manager, suppliers, finance director and tax authorities

Causes

Rules that differ by country, incomplete supplier forms and last minute preparation.

Consequences

Penalties, interest, over or under deduction and loss of trust with the tax authority.

Existing controls

  • A tax status code is held on each supplier record.
  • A calendar lists the main filing dates.

Control gaps

Jurisdiction is assumed and current rules are not confirmed before each return.

Additional controls

  • Prevent: Require a tax status check on every new supplier before the first payment is made.
  • Respond: Correct any filing error through the agreed route and inform the affected supplier in writing.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Tax manager Target: Within 60 days Early warning: Withholding or filing duties due within 10 days with no named preparer or reviewer.
H06

Cyber attack and payment diversion through email

Technology and data Before 16 After 6

A compromised mailbox or spoofed invoice sends false payment instructions, or malware locks the accounting system or vendor master file until a ransom or manual rebuild is paid.

Who or what is affected: Accounts payable team, suppliers, IT staff and the bank

Causes

Phishing, reused passwords and invoices sent as email attachments.

Consequences

Stolen data, false payments, system downtime and a notice to the regulator.

Existing controls

  • Accounting software requires a password and is backed up daily.
  • Staff are trained to report suspicious invoice emails.

Control gaps

Shared mailboxes do not have the same protection as individual accounts.

Additional controls

  • Prevent: Enable multi-factor sign in for all payables and banking system users.
  • Recover: Test restoring the vendor master file from backup and keep a written recovery plan.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: IT manager Target: Within 30 days Early warning: Repeated phishing reports or invoices received from a sender whose address has changed.
H07

Cash timing and liquidity mismatch

Financial Before 9 After 4

Large invoices fall due together or early payment terms are taken without checking cash, so the business cannot meet payments on time or must draw on expensive credit.

Who or what is affected: Finance team, suppliers and lenders

Causes

Large invoices falling due together, forecasts that are rarely updated and terms agreed without checking cash.

Consequences

Late payments, lost supplier trust and higher borrowing cost.

Existing controls

  • Payment runs are scheduled against a weekly cash forecast.
  • Early payment discounts are approved by the finance manager.

Control gaps

The forecast is compared with actual cash only once a quarter.

Additional controls

  • Prevent: Set a cash floor and hold non-urgent payments when cover falls below it.
  • Detect: Update the cash forecast each week against actual bank balances.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Treasury lead Target: Within 60 days Early warning: Days of cash cover fall below the agreed floor for the period.
H08

Conflict of interest in supplier selection and gifts

People Before 8 After 3

A staff member approves or favors a supplier with a personal or family link, or accepts gifts that weaken independent judgment in choosing and paying suppliers.

Who or what is affected: Accounts payable team, purchasing staff, suppliers and management

Causes

Long supplier relationships, personal ties and unclear limits on gifts.

Consequences

Overpayment, loss of independence, disciplinary action and damage to reputation.

Existing controls

  • A gifts and hospitality register is kept by the finance team.
  • Staff sign a conduct statement each year.

Control gaps

Declarations are collected but never compared with the approved supplier list.

Additional controls

  • Prevent: Require a written declaration before a staff member approves a new supplier linked to them.
  • Respond: Investigate any declared or reported link and remove the staff member from approval where needed.
Likelihood 2 x impact 4 before; 1 x 3 after Owner: Compliance officer Target: Within 90 days Early warning: A declared interest linked to a supplier that is onboarded or paid without a second approver.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from 1, rare, to 5, almost certain, and impact runs from 1, minor, to 5, severe. Impact is judged on money lost, time to correct, the effect on reported liabilities and harm to supplier trust. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. Inherent risk is the score before any controls. Residual risk is the score after existing and added controls, and it must never be higher than the inherent score. Where inherent is 10 or more, residual must be lower. Low risks are accepted and watched, Medium risks need routine controls with a named owner, High risks need senior attention and a dated plan, and Critical risks need immediate action before further payments of that type are released. A payment risk is never rated down only because it has not yet happened. The payables team should challenge each rating in a short review, and scores are revisited whenever an indicator reaches its escalation threshold.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Supplier bank detail changes made without a confirmed call back to a known contact.Escalate to the payments approver at once and hold the affected payment until it is confirmed. Report to the finance director if any change remains unconfirmed after one run.
Duplicate invoice numbers or matching amounts found in the same supplier account.Escalate to the accounts payable supervisor when any duplicate is found, and to the finance director if more than three occur in one month.
Users who hold both entry and release rights for supplier payments.Escalate to the finance director when any such user is found, and remove one of the two rights within a week.
Accrued invoices not matched to a receipt or approved within 60 days of the period end.Escalate to the financial controller when any accrual is older than 60 days, and to the finance director if the total exceeds the agreed floor.
Withholding or filing duties due within 10 days with no named preparer or reviewer.Escalate to the tax manager at once, and to the finance director if the duty is still open after three days.

Contingency arrangements

If a suspected fraud or misdirected payment is found, the payments approver stops the payment run for the affected supplier, preserves the invoices, bank records and emails, and informs the finance director the same day. The IT manager disables any changed bank details and restores the vendor master file from the latest tested backup. The bank is contacted at once to request recall of funds, and the internal auditor leads the review. Legal, tax and audit contacts are made through the finance director as required in the relevant jurisdiction, and suppliers are told plainly what they need to do.

Prioritized action plan

  1. Apply a call back rule to every new supplier and bank detail change before payment, owner accounts payable supervisor, within 30 days.
  2. Enable multi-factor sign in and test a restore of the vendor master file, owner IT manager, within 30 days.
  3. Split entry, approval and release of payments and review user access rights, owner finance director, within 45 days.
  4. Add a duplicate invoice check to each payment run, owner accounts payable supervisor, within 45 days.
  5. Set a withholding and filing calendar with a backup owner for each duty, owner tax manager, within 60 days.

Conclusion

Reliable payables depend on a few steady habits: call back checks on every bank change, split duties for entry and release, duplicate checks before each run, accrual reviews at close, tax status checks on new suppliers and tested backups. The highest scores sit with bank detail fraud, cyber driven payment diversion and duplicate payments, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified advice for any real tax, legal or cyber security question.

Assumptions and limitations

Assumptions

  • The business pays suppliers by bank transfer in a scheduled weekly payment run from one main account.
  • Jurisdiction is not specified, so withholding and filing duties are described in general terms only.
  • The accounting system holds the vendor master file and an approval workflow, and staff use managed computers.

Limitations

  • The scores are examples for learning and do not describe any real business, supplier base or audit.
  • Tax, withholding and payment rules differ by country and change over time, so specialist review is needed.
  • This is educational content and is not financial, tax, legal or cyber security advice.

Related frameworks to study

  • Internal control framework with control activities and monitoring
  • Three lines model of risk ownership
  • Hierarchy of controls
  • Segregation of duties principle

Finance Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Accounts Payable Management course Read the best practices for this course

More Finance risk assessments

Hourly Active: 40,745 Learners