Accounts Payable Internal Controls Best Practices Checklist

Most accounts payable control guidance is written for companies with an AP department. If your AP department is you and one other person, the standard advice about segregation of duties reads as impossible, so it gets ignored entirely. That is how small businesses lose money to duplicate payments, fictitious vendors, and invoices nobody authorized.

The controls below work at small scale, ordered by how much loss they prevent per unit of effort.

The controls that matter most

1. Separate who approves from who pays

The single highest-value control, and achievable with two people. One person enters and prepares; the other releases payment. If you are the owner, keep payment release yourself even if you delegate everything else. If you are genuinely alone, review the payment register after the fact, every cycle, without exception.

2. Three-way match on anything physical

Purchase order, receiving record, invoice. All three agree before payment. For service businesses without POs, the equivalent is matching the invoice to an approved quote or contract, and to evidence that the work happened.

3. Control the vendor master file

New vendors and changes to vendor bank details are where losses concentrate. A common vendor-payment fraud scenario: an email arrives, apparently from a known supplier, asking you to update remittance details. It works because it looks routine. Verify any bank detail change by phone, to a number you already hold on file, never to a number supplied in the request itself.

4. Collect tax documentation at vendor setup

Collect a W-9 during vendor setup for any vendor whose payments may be subject to information reporting, rather than chasing it in January. Note that for payments made on or after January 1, 2026, the 1099-NEC and 1099-MISC reporting threshold rose from $600 to $2,000, indexed thereafter. Collecting at setup costs nothing and removes the year-end scramble; deciding reportability later is what creates it.

5. Check for duplicate invoice numbers

Duplicate payments are ordinary, not exotic. They come from the same invoice arriving twice through different channels, or a statement being paid alongside the invoices it summarizes. Enable duplicate vendor invoice number warnings in your accounting software, and actually stop when one appears.

6. Reconcile AP to the general ledger monthly

The AP aging total must equal the AP control account. When it does not, something is posted wrong, and the gap is where errors hide. A short check that catches a category of problem nothing else will.

The full checklist

• Tax documentation is collected at vendor setup for vendors potentially subject to information reporting
• New vendor setup is performed by someone other than the person who approves payments
• Bank detail changes are verified by callback to a previously known number
• Invoices are matched to a PO, quote, or contract before entry
• Invoice approval is documented, even if it is an email reply
• Duplicate invoice number warnings are enabled and enforced
• Payment release is separated from payment preparation
• The payment register is reviewed by the owner every cycle
• Payment methods are limited, ideally one bank account and one card, with cash and personal accounts excluded
• AP aging is reconciled to the general ledger control account monthly
• Vendor statements are reconciled on a defined schedule, prioritized by spend
• Voided and reversed payments require a documented reason
• Access to the accounting file is by named user, never a shared login
• Potentially reportable vendors are flagged at setup, not chased in January
• Credit balances and unapplied payments are cleared, not left to age

If you only have two people

Real segregation of duties needs three roles: authorize, record, custody. With two people you cannot have all three, so compensate with detective controls instead of preventive ones. The owner reviews the full payment register every cycle, receives bank statements directly rather than through the bookkeeper, and reviews new vendors added during the period. None of that prevents an error, but all of it catches one quickly, and speed of detection is most of the value.

Document the full control in the approved accounts payable procedure and test it with current evidence.

Define requirements and ownership

Map vendor master, invoice intake, purchase evidence, approvals, payment methods, bank access, credits, and close. Name who prepares, reviews, approves, releases funds, reconciles, changes configuration, and resolves exceptions. Keep management authority and specialist tax, legal, or compliance decisions explicit.

Test complete workflows

Run representative normal, credit, reversal, duplicate, late, and failed-integration cases. Reconcile vendor changes, invoices, approvals, payment batches, bank activity, aging, and the ledger. Give every exception a reason, owner, evidence requirement, due date, and escalation path.

Protect access and history

Use named accounts, multifactor authentication, minimum privileges, approval limits, periodic access review, backups, incident contacts, and offboarding. Preserve original records and approved corrections rather than overwriting history.

Selection and exit checklist

• Requirements are tested with current vendor documentation
• Opening balances and source totals reconcile
• Reports tie to supporting schedules
• Sensitive changes require independent verification
• Pricing and change triggers are documented
• Data, attachments, and history export completely
• Transition and access removal are proven