What Accounts Payable Actually Is

Accounts payable is the complete lifecycle of buying on credit: from someone asking to spend money, through proving the goods or services arrived as ordered, to paying the invoice and accounting for every step. It sits at the intersection of cash, controls, and vendor relationships — get it right and suppliers extend trust and terms; get it wrong and you bleed cash to duplicates, fraud, and late fees while failing audits.

This guide covers the operational workflow end to end. For the automation layer, see AI-Powered AP Automation; for the fraud lens, see AP Vendor Fraud Prevention and Procurement Fraud.

The AP Lifecycle at a Glance

flowchart TD
    A["Purchase requisition\n(requester)"] --> B["PO issued\n(buyer)"]
    B --> C["Goods/services received\n(operations)"]
    C --> D["Invoice captured\n(AP)"]
    D --> E{"2-way or 3-way\nmatch?"}
    E -->|Clean| F["Approved for payment"]
    E -->|Mismatch| G["Exception queue:\ninvestigate & resolve"]
    G --> F
    F --> H["Scheduled payment\n(treasury/AP)"]
    H --> I["Reconcile & archive\n(month-end close)"]

Each handoff below gets its own controls — because every handoff is where money leaks when it is informal.

1. Purchase Requisitions and Purchase Orders

Everything starts before money is committed. A requisition states what is needed, why, which budget it hits, and who requested it. Approval converts it into a purchase order sent to the supplier — and that PO becomes the baseline every later check compares against.

Rules that prevent most downstream pain:

  • No PO, no pay as the default for spend above a threshold (e.g., $1,000), with a documented emergency path — not an informal bypass culture.
  • Standard terms on every PO: price, quantity, delivery date, billing instructions, and tax treatment.
  • Blanket POs for recurring services (rent, SaaS, retainers) with period caps and periodic re-validation, so they do not become permanent unmonitored spend.

2. Goods Receipt and Invoice Verification

Receiving is the moment reality is recorded: quantities counted, condition noted, services confirmed against the statement of work. The receiving report — signed, dated, system-entered promptly — is the доказательства that later matching depends on.

Invoice capture should centralize all entry points (email inbox, portal uploads, EDI, paper scans) into one queue with same-day logging. Stamp or record three dates separately: invoice date, date received, and date entered. Payment-clock disputes are almost always date disputes, and the company that cannot prove when an invoice arrived always loses them.

3. Two-Way vs Three-Way Matching

This is the control heart of AP:

Check Two-Way Match Three-Way Match
Invoice vs purchase order (item, price, terms) Yes Yes
Goods/services receipt confirmed No Yes — receiving report required
Typical use Services, subscriptions, low-risk recurring spend Inventory, materials, any quantity-sensitive purchase
What it catches Price creep, unauthorized vendors, duplicate invoices All of the above plus short shipments, substitutions, and billing for undelivered goods

Set tolerance bands explicitly: exact match auto-approves below threshold (e.g., variances under max($25, 2%)); anything beyond routes to exception handling, never to manual override by the same person who entered the invoice.

Worked Three-Way Match Example

Purchase order #4821: 50 laptops at $1,200 each = $60,000, delivery by March 5.

  • Receiving report: 50 laptops received March 3, serials logged, no damage noted.
  • Supplier invoice #INV-9921: 50 laptops at $1,200 = $60,000, terms Net 30.
  • Match result: item, quantity, and price all agree → approved for scheduled payment.
  • Contrast — the mismatch case: invoice shows 50 units but receiving logged 46 with 4 backordered. The $4,800 difference parks in an exception queue; AP pays $55,200 on schedule and holds the balance pending the completion shipment — with the dispute, owner, and follow-up date logged rather than living in someone’s inbox.

4. Invoice Approval and Exception Management

Approval authority lives in a matrix, not in habits:

Invoice band Approver Additional control
Under $1,000 (policy threshold) Budget owner Monthly sample review by finance
$1,000–$25,000 Budget owner + department head Three-way match evidence attached
Over $25,000 Above plus CFO/controller sign-off Contract cross-check for first-time vendors
Any amount, any red flag Held — see exception path No “urgent” overrides without dual approval

Exceptions — mismatches, missing POs, price variances, duplicate-invoice warnings — go to a visible queue with aging, ownership, and SLAs (e.g., resolve or escalate within 5 business days). Stale exceptions are where duplicate payments and fraud hide; review the queue weekly and report aging to the controller.

5. Recording Supplier Invoices

Book promptly and book correctly: invoice date drives the liability period, not the approval date. Use GR/IR-style clearing (goods-received-not-invoiced) so cut-off is right even when invoices lag receipts — see Month-End Close. Code to the correct GL account and cost center at entry; reclassification later is a symptom of a broken chart of accounts or untrained coders, both fixable upstream. Every entry needs preparer identification — anonymous bulk uploads with no owner fail every audit walkthrough.

6. Payment Processing and Reconciliation

Run payments on a schedule, not on squeaky wheels: weekly payment runs with a locked proposal list, dual release for wires and large ACH batches, and positive-pay files to the bank. Capture early-payment discounts deliberately (2/10 net 30 is a ~36% annualized return on cash — take it when liquidity allows) and track capture rate as a KPI rather than leaving money in approvers’ inboxes.

After each run: reconcile disbursements to the AP subledger and bank, investigate outstanding checks over 30 days (stale checks are either uncashed liabilities or fraud signals), and void-and-reissue through the same approval path as the original payment — never as a shortcut.

7. AP Internal Controls That Auditors Actually Test

Map each control to an owner, frequency, and evidence artifact:

  • Segregation of duties: requester ≠ approver ≠ payer. No single user can create a vendor, approve its invoice, and release payment. Test it with a quarterly access review, not a policy statement.
  • Vendor master integrity: new vendors verified (callback to a known number for bank details), changes dual-approved, dormant vendors deactivated on schedule.
  • Approval discipline: thresholds enforced by the system, not by trust; out-of-policy approvals logged with business justification and a second signature.
  • Duplicate detection: system blocks on invoice-number-plus-vendor-plus-amount, plus a monthly exception report reviewed — never auto-deleted.
  • Period-end cut-off: GRNI accruals supported by receiving logs, subsequent-disbursement testing tied to the close binder.

Coordinate with Internal Controls documentation and have internal audit walk through one full cycle annually — see Q1 Audit Prep for evidence standards.

8. Common AP Errors and How to Prevent Each One

Error Cost Prevention
Duplicate payments Double cash out, painful recovery System duplicate check + monthly exception review
Paying without receipt Paying for undelivered goods Three-way match discipline; no-pay lists for unmatched invoices
Wrong GL coding Distorted reporting, restatement risk Coder training + chart simplification + monthly coding review
Missed early-pay discounts Real yield left on the table Approval SLAs aligned to discount windows; capture-rate KPI
Stale unapplied credits Overstated liabilities, missed offsets Monthly vendor-statement reconciliations for top vendors
Fraudulent vendor + invoice Direct theft Vendor verification callback + SoD + whistleblower channel per Audit Committee

9. AP Performance Metrics That Matter

Track monthly, trend quarterly, benchmark annually (APQC publishes peer benchmarks for cost per invoice, cycle time, and error rates — use them to set targets, not to admire):

  • Cost per invoice processed: total AP cost ÷ invoices processed. Automation’s ROI lives or dies here.
  • Invoice cycle time: receipt-to-scheduled-payment days. Target: within discount windows, not just within terms.
  • First-time error-free rate: invoices clearing matching without exception on first pass. Below ~85% signals master-data or receiving problems upstream of AP.
  • Early-payment discount capture rate: discounts taken ÷ discounts offered. Anything under 90% with available cash is a process failure, not a treasury decision.
  • Exception aging: exceptions open >30 days should trend to zero; each one is cash or risk sitting idle.

Report these to the controller monthly and to the CFO quarterly — alongside Expense Management benchmarks when evaluating tooling upgrades.

10. Improving the Workflow Without Boiling the Ocean

Sequence improvements by payback: (1) centralize intake and kill side-channel approvals this month; (2) enforce the approval matrix in-system next quarter; (3) add duplicate detection and vendor verification callbacks; (4) pilot OCR/AI capture on the highest-volume vendor set before expanding — see Automating AP with AI. Measure cost-per-invoice before and after each phase; if a phase does not move the number, find out why before funding the next one.

FAQ

Should small businesses do three-way matching?

For inventory and quantity-sensitive purchases, yes from day one — the discipline scales down fine. For pure services and low-value recurring spend, a documented two-way match with approval thresholds is proportionate. Match the control to the risk, not to company size mythology.

How do we handle invoices with no purchase order?

Route them through an explicit after-the-fact approval with business justification, then fix the root cause (why was there no PO?). Track no-PO rates as a KPI; a rising trend means the requisition process, not the invoices, is broken.

What is the single highest-ROI AP control?

Vendor bank-detail verification by callback before first payment plus segregation of vendor setup from payment release. Two cheap controls that stop the most expensive frauds.

Next Steps

  1. Document your current workflow against sections 1–6 above; every undocumented handoff is a finding waiting for an auditor.
  2. Implement the approval matrix and exception-aging review this month — these two controls catch the majority of errors and fraud.
  3. Pick one KPI to move this quarter (usually discount capture or cycle time), baseline it, and report progress monthly until it holds.