Skip to main content
Accounstone
Accounts Payable

AP Process Controls: Fraud Prevention, Software Workflows and Cost Factors

Fraud controls, software permissions and quote components for a controlled U.S. accounts-payable handoff.

What is accounts payable outsourcing?

Accounts payable outsourcing hands the recurring invoice cycle — capture, coding, routing for approval, scheduling payment and reconciling vendor statements — to an external team working inside the business’s own accounting and approval software. Payment release and vendor authority stay with the business; the outsourced team prepares and reconciles rather than moving money.

AP problems usually start with the invoice pile — unprocessed bills, approval queues no one monitors, vendor statements unreconciled for months. By the time cash flow is affected, the backlog has been building for a while.

Outsourcing AP solves the most consistent problem: no one is entering invoices, routing them, and reconciling vendor balances on a predictable schedule.

What the AP Team Handles vs. What Stays With You

The outsourced AP team handles agreed preparation work — invoice entry, matching, routing and reconciliation. Payment execution, vendor approval and banking access stay with you; the AP team does not initiate transfers or access banking credentials. See our accounts payable guide for the full breakdown of what's handled and what stays in-house.

The Invoice’s Journey, From Inbox to Reconciled

Most AP proposals describe a service. What a firm actually needs to know is what happens to one invoice, and where it stops moving without a decision from someone on your side.

  1. Arrival. The invoice lands in a dedicated payables address or is pulled from a vendor portal, and it is logged the day it arrives whether or not it is ready to code. Nothing sits unrecorded in an inbox.
  2. Validation. Vendor, invoice number and amount are checked against what is already entered. This is the step that catches the duplicate — the same bill emailed twice, or a statement re-sent as an invoice.
  3. Coding. GL account, department or class, entity, and tax treatment, including use tax and 1099 status where applicable. Coded to your conventions, not to a generic chart.
  4. Matching. Against a purchase order and receiving record where you use them; against the approved quote, contract or timesheet where you do not.
  5. Routing. Sent to your named approver on your threshold rules. This is where the queue stops. Nobody outside your organisation approves anything.
  6. Payment preparation. An approved batch is prepared in the platform and left ready. Your authorised person releases it from your bank.
  7. Reconciliation. The AP subledger is tied to the GL control account and vendor statements are reconciled on a set day — the same day each month, so a variance has a known age rather than an unknown one.

Two of those seven steps need someone with authority in your organisation. The other five are the ones that consume a bookkeeper’s week, and they are the ones that can be handed over.

Fraud Controls That Must Be in Place

Duplicate invoice checks — comparing vendor, invoice number, date and amount before entry — reduce the risk of accidental duplicate payments. A restricted vendor master helps reduce unauthorized payee changes, but it should be combined with independent verification, approval separation and review of unusual payment requests.

Three-Way Matching, and When It Is Overkill

A three-way match compares the purchase order, receiving evidence and vendor invoice before approval. It is useful where the business uses purchase orders and receiving records; it is not appropriate for every service invoice or expense. Define which invoice types require the match and how differences are escalated.

It also assumes you raise purchase orders. Plenty of practices, agencies and professional-services firms do not — the spend is subscriptions, subcontractors, rent and professional fees, and there is no receiving event to match against. Imposing a three-way match there produces a process everyone routes around within a quarter.

The more useful question is not “do we have three-way matching?” but “what is the second, independent piece of evidence?” A contract or engagement letter, a signed-off timesheet, an approved quote, a delivery note. One invoice plus one independent confirmation is the control. Three documents is that same control, in the form businesses that buy goods need.

How It Works in Each Platform

QuickBooks Online: Confirm how bills are entered, which approval features are enabled in the actual company, where approval evidence is stored and who can mark bills ready for payment. If approvals take place outside the platform, maintain a clear record before the bill moves to the payment queue. Payment initiation remains with the authorized client person.

Xero: Confirm the draft and approval stages available in the organisation, the permissions to edit supplier records, and whether payment batches or files are part of the configured workflow. Document capture tools and integrations should be checked in the client's actual setup rather than assumed.

NetSuite: Confirm the subsidiary and department scope, role permissions, configured approval routing and the controls around any payment file. Do not assume a workflow rule or payment module is active simply because the client uses NetSuite.

What an AP Team Needs Access To, and What It Must Never Have

This is usually the question behind the question, and it deserves a specific answer rather than a reassurance.

What the work requires: a named user in your accounting platform with permission to enter bills and run AP reports, access to the payables inbox, the vendor list, and your approval matrix so routing reaches the right person at the right threshold.

What it does not require, and what we do not ask for: your online banking credentials, payment release rights, the ability to add a vendor or edit a vendor’s bank details, or authority to approve a bill. Creating a new vendor should stay with your internal team. Vendor-master restrictions are one important control, but they do not replace independent verification, duplicate checks or internal approval of payee changes.

Where your platform supports role-based permissions — Xero, NetSuite, Sage Intacct and Sage 50 all do — those limits can be enforced in the software rather than agreed in an email. Ask for the permission set in writing during onboarding. A provider unwilling to work inside one has answered a different question.

What a Quote Should Separate

Compare the full task list rather than a single per-invoice figure. Ask providers to separate recurring invoice intake and coding, approval routing, vendor-statement reconciliation, urgent or off-cycle work, historical cleanup, software charges and any additional entity or reporting requirements.

Also confirm what the price excludes: vendor creation or bank-detail changes, approval authority, payment release, tax advice, purchasing decisions and resolution of commercial disputes should not be assumed to transfer with invoice processing.

How to Review Whether the AP Handoff Is Working

An AP arrangement that is going wrong looks fine for about six weeks. The invoices get entered; the problems surface later, in the reconciliation and in the approver’s inbox. Four signals show it early:

  • Age of the oldest unposted invoice — not the average. Averages hide the one bill stuck for five weeks because nobody knew who owned it.
  • Share of invoices entered without a follow-up question. Review the trend alongside invoice volume, complexity and changes in the coding rules; investigate recurring questions rather than treating a single percentage as proof of quality.
  • Unreconciled vendor statement lines at month-end. A number that rises is a queue being processed faster than it is being tied out.
  • Time your approver spends per invoice. The point of delegating preparation is that review gets shorter. If approving takes as long as it used to, the preparation is not arriving in a reviewable state.

Agree those four at the start rather than after a bad month. They also give you the language for a corrective conversation that is about the process rather than about the people.

Share this article:
Accounts Payable questions

Frequently Asked Questions

What access does an outsourced accounts payable team need?

A named user in your accounting platform with permission to enter bills and run AP reports, access to the payables inbox, the vendor list, and your approval matrix so routing reaches the right person at the right threshold. It does not require online banking credentials, payment release rights, the ability to add a vendor or edit vendor bank details, or authority to approve a bill. Where the platform supports role-based permissions, those limits can be enforced in the software rather than agreed by email.

Who approves and pays invoices when accounts payable is outsourced?

Your own authorised people do both. The outsourced team prepares the batch and leaves it ready in the platform; releasing payment happens from your bank, by someone in your organisation. Approval is routed to your named approver on your threshold rules. Approval and payment release remain with authorized people inside your organization.

How should a dedicated payables inbox be set up?

Set up a dedicated address, such as ap@, that both your team and the payables team can reach, and have vendors send invoices there. Mixing invoices into general inboxes is what causes bills to sit unrecorded, because nobody owns the inbox they arrived in.

How are disputed invoices handled by an outsourced AP team?

They are flagged and escalated, not resolved. Whether to withhold payment, renegotiate or accept a charge is a commercial judgment about a supplier relationship, so it stays with you. What the payables team can do is make sure the dispute is visible, dated and attached to the invoice rather than discovered at reconciliation.

Does outsourced accounts payable require three-way matching?

Only where you raise purchase orders and receive goods. A three-way match compares the purchase order, the receiving document and the vendor invoice, and it is the right control for businesses that buy physical goods. Where spend is subscriptions, subcontractors, rent and professional fees there is no receiving event to match against, and the useful question becomes what the second independent piece of evidence is: a contract, an approved quote, a signed timesheet or a delivery note.

Can an outsourced AP team handle multiple entities?

Invoice entry and coding can be run per entity, including intercompany coding, in platforms that support multi-entity payables. Consolidation eliminations are a reporting judgment and sit with your controller or your CPA rather than with the payables team.

How should a business control changes to vendor bank details?

Treat changes to payment details as an approval-controlled exception. Verify the request through the business’s established independent process and have an authorized employee approve the vendor-master change; an AP preparer should not authorize or redirect payments based only on an emailed request.

How should duplicate invoices be identified and resolved?

Compare vendor, invoice number, amount, date, purchase order and available statement history, while allowing for legitimate credit notes or split billing. Flag suspected duplicates with supporting references; the authorized reviewer decides whether to reject, reverse or otherwise resolve the item.

Which AP measures help show whether the process is working?

Useful measures include invoice backlog and age, time from receipt to entry, unmatched or disputed items, duplicate exceptions, invoices waiting for approval and payments prepared by the agreed cutoff. Interpret them with volume and process changes rather than treating one metric as proof of quality.

How should invoice cutoffs and late submissions be handled?

Set a cutoff for each payment cycle, a channel for urgent invoices and an escalation process for late source documents. Late items should be made visible with their due date and approval status; the workflow should not bypass controls to force an invoice into a planned batch.

Free consultation

Talk to Us About Your Payables Queue

If invoice coding, approval chasing and vendor records are where the month goes, tell us the volume and the systems and we will scope what a reviewable payables queue would take.

The consultation and the call are always free. We will agree the workflow, handoffs and deadlines during onboarding.

Discuss Your Accounting Support Needs

Tell us about the accounting work, systems and review process you already use.