How to build an AP approval process that survives being handed off

The test of an AP process is not whether bills get paid. It is whether they get paid correctly when the person who normally handles them is on holiday. If the answer depends on one person's memory, you do not have a process: you have a dependency.

The single most important structural rule is this: whoever enters a bill should not be the one who releases the payment. Everything else in this guide is detail. That rule is the point.

Why separation of duties matters even at four employees

The usual objection is that a small business does not have enough people. Fair, and the answer is not to hire someone: it is to make sure the same person does not both create the obligation and discharge it.

One person who can add a vendor, enter an invoice, and release the payment can pay themselves. This is not a theoretical risk; it is the most common small-business fraud pattern there is, and it usually runs for years before anyone notices, because the person committing it is also the person who would have noticed.

Separation also catches ordinary mistakes, which are far more common than fraud. A duplicate invoice, a wrong amount, a bill for something that was never delivered. A second pair of eyes at the release step catches all three.

The minimum viable version at a very small company: the bookkeeper enters and codes bills, the owner reviews the payment run and releases it. Two people, five minutes a week.

Step 1: Route every invoice to one place

Pick a single destination (a dedicated email address such as ap@yourcompany.com is the usual answer) and make it the only one.

Then tell every vendor. Not once; on the next three invoices. And change the billing contact on every online account you have. Half the work of centralising AP is un-teaching vendors the habit of emailing whoever they last spoke to.

The rule that makes this stick: an invoice that arrives in someone's personal inbox gets forwarded to the AP address and is then ignored in its original form. No exceptions, including for the owner. The moment two intake paths exist, duplicate payments follow.

Step 2: Write down who approves what

This is the document that lets someone else run AP without asking.

Set thresholds in dollars and name the roles, not the people:

Those numbers are illustrative. Set your own based on what a mistake actually costs you. What matters is that they exist and are written down, so nobody has to interpret.

Two additions worth making. First, new vendor setup gets approved by someone other than whoever requested it: that is where fake-vendor fraud enters. Second, name a backup approver for every threshold. An approval chain with no backup becomes a rubber stamp the first week the approver is away.

Step 3: Define what "approved" means before it gets coded

Approval is not a signature. It is three confirmations:

1. We ordered this. There is a PO, contract, or a person willing to say they asked for it.
2. We received it. Goods arrived, or the work was done. For services, the person who received the work confirms, not the person who pays for it.
3. The amount is right. It matches the quote, contract, or agreed rate.

Small businesses skip the second one most often, and it is the one that stops you paying for a delivery that never arrived. It does not require a receiving department: it requires the person who wanted the thing to say they got it.

Once those three are confirmed, coding is mechanical: expense account, class or job if you track them, and the correct period. Coding at entry rather than at month end is the difference between a two-hour close and a two-day one.

Step 4: Pay on a schedule

Pick one or two payment days a week and stick to them.

A fixed run does several things at once. It batches the approval review into one sitting instead of twenty interruptions. It makes cash requirements visible in advance. It gives you an obvious place to check the total before releasing anything. And it removes the pressure to pay something immediately because a vendor called, which is exactly the pressure fraud relies on.

Before each run, the approver looks at three things: the total, the vendor list, and anything unusual in amount or timing. That is the control. It takes minutes and it is the reason the whole structure works.

For genuinely urgent payments, define the exception in advance: who can authorize an off-cycle payment, and what gets documented. An undefined exception process means every payment becomes urgent.

Step 5: Reconcile AP monthly and mean it

Every month, tie the AP aging to the AP balance in the general ledger. They should match. When they do not, find out why before closing the period.

Then read the aging rather than filing it:

• Anything over 60 days that you have not deliberately decided to hold is either a dispute nobody resolved or an invoice nobody entered correctly.
• Credit balances usually mean a duplicate payment or a credit memo that was never applied.
• A vendor with an unexpectedly steady stream of similar-sized invoices deserves a look.

Also reconcile the bank. AP that ties to the ledger while the ledger does not tie to the bank tells you nothing.

Step 6: Write it down as a document someone else can follow

The handoff test: could a competent person you hired last week run next Thursday's payment run from this document alone?

It should contain the AP email address and who monitors it, the approval threshold table, the payment days and method for each vendor type, the new vendor setup and verification procedure, who the backup approver is for each level, and the month-end reconciliation checklist.

Two pages is usually enough. A twenty-page procedure manual will not be read, and an undocumented process cannot be delegated, which means you cannot leave, and you certainly cannot hand it to someone new.

Who runs it day to day

Once the structure exists, the entry, coding, chasing and reconciling is steady, unglamorous work that takes real hours and real attention, and it is the part that gets dropped first when the person doing it also has another job.

That is the role we place. A dedicated operator, full time, forty hours a week on US business hours across Eastern, Central, Mountain or Pacific, working inside your process rather than a shared queue. Standard placement is $2,500 per month plus a one-time setup fee, with actual cost depending on the role and scope. Every operator holds a four-year finance or accounting degree, is QuickBooks certified, and has passed role-specific AP testing before you ever meet them. Accounts payable and receivable is one of our eight service areas.

They enter and code the bills. You keep the release. That is the separation of duties working as designed, and unlike hiring locally, it is a role you can fill in 14 to 21 days from the fit call.

There is a 30-Day Right-Fit Guarantee behind it: if the operator is not right within the first thirty days, we re-vet and place someone else at no additional cost, or you exit and we refund the wages you have paid plus a portion of the setup fee. We also check in with both you and the operator at two weeks and thirty days, and the client portal gives you daily reports, live online and offline status, and task visibility. Every operator signs a comprehensive NDA before any access is granted.