Safety Norms: Accounts Payable Management

1Purpose, Scope, and Safety Principles

These norms set the minimum expectations for anyone who receives, enters, approves, pays, records, or reviews supplier invoices. In this document, safety means protecting the organization from financial loss, protecting people from pressure to bypass controls, and protecting supplier and employee data from misuse.

Scope includes invoice intake, purchase order matching, vendor master maintenance, payment runs, payment method changes, expense reimbursements, credit memos, and the accounts payable data that feeds period-end accruals and the general ledger.

• MANDATORY: Every payment must have documented approval under the organization's delegation of authority.
• MANDATORY: No single person may create a vendor, enter an invoice, approve it, and release payment.
• RECOMMENDED: Treat unusual requests, urgency, and secrecy as warning signs rather than reasons to skip steps.

2Roles, Competence, and Accountability

Accountability must be named in writing. The accounts payable manager owns the process and its controls. The vendor master custodian maintains supplier records. Processors enter and match invoices. Approvers confirm goods or services were received and the spend is budgeted. The payment releaser authorizes bank transfers or check runs. Internal audit and compliance test controls independently and do not perform the transactions they review.

Competence is a prerequisite for system access. Staff must complete role-specific training before posting or approving transactions. Access rights are granted through written approval and removed the same business day when a person changes roles or leaves.

• MANDATORY: Access to vendor creation, bank detail changes, and payment release requires written approval from the accounts payable manager and the finance controller.
• MANDATORY: Staff must not share logins, tokens, or passwords, and must not process transactions on another person's account.
• RECOMMENDED: Re-certify user access at least annually and after any reorganization.

3Course-Specific Hazards and Risk Assessment

The main hazards in accounts payable are financial and informational rather than physical. Common examples include business email compromise, where a fraudster poses as a known supplier and requests a change to bank details; fictitious or duplicate vendors created to receive payments; invoices altered after approval; duplicate payments caused by resubmitted invoices; keying errors that send funds to the wrong account; and collusion between staff and suppliers.

Each hazard should be scored by likelihood and impact using a simple matrix. A high-risk item is any process that can move funds without independent verification. Medium risk applies where errors are detectable but costly. Low risk covers issues that are easily corrected and do not affect payment accuracy. The process owner completes the assessment and reviews it after system changes, new payment methods, or confirmed incidents.

• Vendor bank detail change requests: high risk, frequent target of fraud.
• Duplicate invoice payment: high risk where invoice numbers are not validated.
• Unauthorized vendor creation: high risk, enables fictitious payments.
• Tax form and classification errors: medium risk, creates reporting and compliance exposure.
• Credit memos not applied: medium risk, leads to overpayment and disputes.
• Printed or emailed remittance data exposed to unauthorized readers: medium risk, affects confidentiality.

4Preventive Controls and Safe Work Practices

Preventive controls stop errors before money moves. The core control is the three-way match, which compares the purchase order, goods or service receipt, and supplier invoice. Exceptions beyond agreed tolerances go to a designated reviewer and are not forced through. Matching tolerances are set by policy and must be documented.

Vendor bank detail changes are the most common fraud path, so they require independent verification. The vendor master custodian must confirm any change by calling a telephone number already on file, not a number supplied in the change request or email. The verification, the person who performed it, and the date and time must be recorded before the change is saved. Urgent requests to pay early, to a new account, or without the usual approval are refused and escalated.

• MANDATORY: Verify every bank detail change using a callback to a contact already on file. Record the callback details.
• MANDATORY: Block payment to a new or changed account until verification is complete and approved.
• MANDATORY: Run duplicate checks on vendor name, invoice number, amount, and date before approval.
• MANDATORY: Require dual approval for payments above the threshold set in the delegation of authority. Thresholds are organization-specific.
• RECOMMENDED: Review the vendor master at least quarterly to identify inactive, duplicate, or unusual vendors.
• RECOMMENDED: Compare payment files with the approved batch total before release.
• RECOMMENDED: Do not process payment instructions received only by phone or chat, and do not pay from attachments that show altered bank details.

5Equipment, Environment, Information, and Protective Safeguards

Accounts payable relies on the ERP or accounting platform, the bank payment portal, scanning or invoice capture software, shared mailboxes, and spreadsheets. Each tool needs role-based access, multi-factor authentication where supported, and automatic session timeouts. Spreadsheets containing bank data or payment lists should be stored in controlled locations, not on personal drives or removable media.

Workspaces should support confidentiality and ergonomics. Screens displaying bank data should face away from public areas, printers holding payment files should be in secured locations, and documents containing supplier tax identifiers or bank details must be locked away or shredded when no longer needed. Retention periods for invoices and payment records are set by legal and tax requirements that vary by jurisdiction and must be confirmed with qualified advisors.

• MANDATORY: Send bank or tax data only through approved, encrypted channels. Do not use personal email or messaging apps.
• MANDATORY: Lock workstations when unattended and follow the clean desk rule for payment documents.
• MANDATORY: Report lost tokens, suspected credential exposure, or unexpected system prompts immediately to IT security.
• RECOMMENDED: Mask account numbers in reports, showing only the last four digits where the system allows.
• RECOMMENDED: Use ergonomic seating, adjustable screens, and regular breaks during high-volume invoice entry to reduce strain.

6Incident, Near-Miss, Emergency, and Escalation Procedures

Suspicious activity must be escalated quickly and without investigation by the person who noticed it. If a request looks like fraud, stop processing, do not alert the requester in a way that could tip off a suspected actor, preserve the email, invoice, and system logs, and notify the accounts payable manager and the compliance or fraud contact on the same business day. Investigation is performed by trained fraud or internal audit staff.

If funds have been sent in error or to a suspected fraudulent account, contact the bank's fraud or payment recall team immediately using the number on the bank agreement, not a number in the suspicious message. Record the time of contact, the reference numbers, and the names of the people spoken to. Escalate to legal, finance leadership, and law enforcement as the organization's response plan requires. Call emergency services only for an immediate threat to people.

• MANDATORY: Report all suspected fraud, duplicate payments, and control overrides to the accounts payable manager and compliance the same business day.
• MANDATORY: Protect whistleblowers. Retaliation against anyone who reports a concern is prohibited.
• RECOMMENDED: Log near misses, such as a blocked fake bank change, so trends can be analyzed.
• RECOMMENDED: Maintain a current contact sheet for banks, IT security, legal counsel, and the fraud response lead.

7Records, Training, Inspection, and Review

Accurate records are both a control and evidence. Each payment should be traceable to an approved invoice, a matched receipt, an authorized approval, and a bank confirmation. Audit trails must be preserved and changes to posted records must be made through documented correction entries, never by overwriting history. Records must be retained according to the organization's policy and applicable legal requirements.

Training should cover invoice fraud indicators, the callback procedure, data handling, and the escalation path. New staff complete training before system access, and all users complete refresher training at least annually. Simulated phishing exercises help staff recognize fake supplier requests. Internal audit or a qualified reviewer should test controls periodically, and the process should be reviewed after incidents, system upgrades, and changes in payment methods.

• MANDATORY: Keep an evidence file for every bank detail change and every exception approval.
• RECOMMENDED: Track duplicate payment rate, exception aging, and blocked fraud attempts, and review them with management.
• RECOMMENDED: Sample completed payments each period-end to check approvals, matching, and vendor legitimacy.
• RECOMMENDED: Update these norms after each incident and record the change and reason.

8Practical Checklist and Conclusion

Safe accounts payable work depends on consistent application of simple controls. The norms above are designed to prevent financial loss, protect confidential data, and ensure that suspicious activity is escalated before funds leave the organization. Local procedures must align with the delegation of authority, applicable tax and payment rules, and guidance from qualified auditors and legal advisors, all of which should be verified against current versions in your jurisdiction.

Implementation checklist

• Confirm that every payment has documented approval within the delegation of authority.
• Verify every vendor bank detail change by callback to a contact already on file.
• Run duplicate checks on vendor, invoice number, amount, and date before approval.
• Confirm no one person created, approved, and released the same payment.
• Hold any payment with altered bank details, urgent demands, or unusual secrecy.
• Send bank and tax data only through approved, encrypted channels.
• Lock workstations and clear payment documents from the desk when away.
• Report suspected fraud to the accounts payable manager and compliance the same business day.
• Preserve evidence such as emails, invoices, and logs without investigating alone.
• Keep complete approval and verification records for every exception.