What metrics and criteria should I use to evaluate AP controls and AP automation tools?

The core set: approval cycle time (median and tail - the tail is where late fees and close delays hide); touches per invoice (how many human interventions an invoice requires - lower is better-controlled and cheaper); first-pass approval rate (share clearing on first assignment without reminder, reassignment, or question - a high rate signals clean routing and good context); exception/rejection rate (what share fails matching or gets rejected - too high means upstream problems, near-zero may mean rubber-stamping); and escalation rate (how often SLAs breach). Read them together: fast cycle time with a high touch count, for instance, means you're paying in labor for the speed.

Run a controls-lens evaluation, then prove it hands-on. The checklist: does it enforce segregation of duties (can the same user enter and approve?), is the audit trail immutable and exportable (can anyone, including an admin, edit history?), does it configure to your DOA (amount + dimension routing, enforced authority limits), does it capture approval context (what the approver saw), and does the vendor provide a SOC 1/SOC 2 report? Then run proof-of-concept tests that try to break it: attempt to approve an invoice you entered, try to edit or delete a log entry as an admin, try to bypass the workflow or change a routing rule without a trace, and try to push an unapproved invoice into a payment run. A tool that resists those attempts strengthens control; one that allows any of them weakens it regardless of its feature list.

It depends on PO discipline and risk appetite, but well-run high-PO environments can route a large share (often a majority) through matching-based skip logic, with the rest - new vendors, exceptions, non-PO spend - getting human approval. The right number is whatever leaves human judgment on the invoices that genuinely need it; chasing 100% touchless past your control comfort is the wrong goal.

Varies by process maturity and PO coverage, but persistently high exception rates (a large fraction failing match or bouncing in approval) signal upstream problems - poor PO discipline, bad vendor data, loose coding. A very low rate can mean controls aren't really examining anything. Track the trend against your own baseline more than any external number.

Sum the direct costs: late-payment fees and interest, missed early-payment discounts, and the labor of chasing approvals. Add the indirect: delayed close (and its downstream effects), strained vendor relationships, and the risk premium of paying under time pressure without proper review. The discount and late-fee math alone often justifies fixing cycle time.

Audit trail (immutable, complete, exportable), SoD enforcement (can't combine conflicting duties), DOA configuration (multi-dimensional routing and enforced limits), approval context capture, change management over rules, access controls and review support, and a current SOC 1/SOC 2 report. Score tools on enforcement and evidence, not just feature presence.

Evaluate on the controls checklist rather than brand: flexibility means multi-dimensional, configurable routing that fits your matrix without workarounds; audit readiness means an immutable, exportable trail and enforced SoD. The strongest tools mirror your ERP structure so controls run on real financial dimensions, and they prove their claims in a hands-on POC.

Ask: how did the tool perform in their last external audit - did auditors accept its audit trail and rely on its automated controls? How easy was producing an approval evidence package for a sample? Did they ever find a way to bypass the workflow or edit history? How is change management over workflow rules handled? References' audit stories reveal more than feature demos.

Auditors don't endorse products, but a platform with a clean, well-understood SOC 1, an immutable audit trail, and enforced controls is easier to rely on - which can reduce testing effort versus a tool they must scrutinize from scratch. Familiarity and a strong control design lower friction; the brand itself doesn't.

Frame it beyond headcount: reduced fraud and duplicate-payment exposure, faster and cheaper audits (retrieval vs reconstruction), fewer control deficiencies and their remediation cost, SOX/IPO readiness, and the avoided cost of a material weakness. Controls and audit benefits are often larger and more durable than the labor savings, especially for companies facing audit or investor scrutiny.

Try to break the key controls: approve an invoice you entered (SoD), edit or delete an audit-log entry as an admin (immutability), change a routing rule with no record (change management), and add an unapproved invoice to a payment run (the approval-to-payment gate). A tool that prevents all four enforces control by design; any it allows is a gap you'd inherit.

Evaluated against that checklist, Stampli is built to pass: segregation of duties is enforced by role-based permissions (no self-escalation, separate invoice and payment approval gates), the audit trail is immutable for every action with field-level before/after history and clean export, routing configures to the DOA on ERP-aligned dimensions with enforced authority limits, and approval happens on the invoice so context is captured as evidence. The honest framing for buyers: automation strengthens control when it moves enforcement into the system and captures evidence as a byproduct of work - which is the design intent. Stampli AI performs on average 87% of finance work across 2,700+ unique fields, with all suggestions subject to human review and approval before posting, so throughput improves without removing the human judgment auditors expect.