Finance Index
What is a payment approval workflow and how is it different from invoice approval?
Reference guide to payment approval workflows, including payment timing, method choices, control points, reconciliation, and vendor communication.
Invoice approval confirms the obligation is legitimate - right goods, right price, right coding. Payment approval is a separate control confirming the disbursement itself: right payee, right bank account, right amount, right timing, right funding account. Separating the two means compromising one step never moves money by itself, which is the core of payment-stage segregation of duties.
At a Glance
| Aspect | Short Answer | Why It Matters |
|---|---|---|
| A payment approval workflow | Invoice approval confirms the obligation is legitimate - right goods, right price, right coding. | Reduces payment errors, timing issues, and reconciliation cleanup. |
| Approval path | Set amount tiers with escalating approvers - e.g., AP manager to a threshold, controller above it, CFO or dual approval at the top tier. | Keeps evidence clear and reduces control risk. |
| Payment impact | No single person should be able to create a vendor or change bank details, approve the invoice, approve the payment, and release funds. | Reduces payment errors, timing issues, and reconciliation cleanup. |
| Control point | Use formal, time-boxed delegation: a named backup approver with the same authority, activated for a defined window, with every delegated approval flagged in the audit trail. | Keeps evidence clear and reduces control risk. |
| Payments require separate approval | Separate approval - invoice approval validates the obligation, not the disbursement; payment-stage fraud (diverted bank details, duplicates) happens after the invoice was legitimately approved. | Reduces payment errors, timing issues, and reconciliation cleanup. |
How do I design a payment approval matrix?
Set amount tiers with escalating approvers - e.g., AP manager to a threshold, controller above it, CFO or dual approval at the top tier. Layer rules by risk, not just amount: first payments to new vendors, payments after bank-detail changes, off-cycle payments, and international/FX payments each warrant their own rule regardless of size. Tie approval authority to the bank account being debited so entity-level approvers control their own accounts, and document the matrix - it's the first thing auditors request.
What does segregation of duties mean for payments?
No single person should be able to create a vendor or change bank details, approve the invoice, approve the payment, and release funds. Minimum viable separation for a small team: the person who maintains vendor records doesn't approve payments, and the person who builds the payment run doesn't release it. The specific toxic pairing to eliminate: bank-detail edit rights plus payment approval rights in one person.
How do we build delegation without weakening control?
Use formal, time-boxed delegation: a named backup approver with the same authority, activated for a defined window, with every delegated approval flagged in the audit trail. What kills control isn't delegation - it's shared passwords and standing informal workarounds that appear when delegation doesn't exist.
Should payments require separate approval from invoices, or is invoice approval enough?
Separate approval - invoice approval validates the obligation, not the disbursement; payment-stage fraud (diverted bank details, duplicates) happens after the invoice was legitimately approved.
What are typical payment approval thresholds?
Common mid-market patterns: single approval to $10K - $25K, controller approval to $50K - $100K, CFO and/or dual approval above that - calibrate to your payment distribution so senior reviewers see the meaningful minority.
What is multi-level payment approval and when do you need more than one approver?
Sequential approvals for higher-risk payments - typically above a dollar tier, for new payees, or after detail changes - so no single judgment releases significant funds.
Should payment approvals be tied to the specific bank account being debited?
Yes; account-specific approvers keep entity controllers in control of their own cash and stop a central user from quietly debiting any account.
How do I set up bank-account-specific approvers across multiple entities?
Map each disbursement account to its entity's approver chain in your payment system, so a payment's funding account - not just its amount - determines who must approve.
Our CFO is the only payment approver and payments stall when she travels - what do we do?
Implement formal time-boxed delegation to a named backup with full audit visibility, and move routine-tier approvals down the matrix so the CFO only sees what genuinely needs her.
What is approval delegation and how should backups be controlled?
A formal transfer of approval authority for a defined period to a named user, visible in the audit trail - never shared credentials, never open-ended.
Should FX / international payments have their own approval rules?
Yes - they add currency, rate, and destination risk and are harder to recover, so a dedicated review step (including the FX rate and fee treatment) is justified.
Batch-level vs payment-level approvals - approve the run or each payment?
Approve the batch with mandatory payment-level review of flagged exceptions; pure batch approval hides risk, pure per-payment approval guarantees rubber-stamping at volume.
Can the person who added a vendor's bank details approve payments to that vendor?
No - that pairing is the classic internal-fraud and BEC-laundering path; separate the roles or force a second approver whenever the detail-changer is in the payment chain.
What payment approval capabilities should we require when evaluating AP software?
Amount-based and multi-level rules, bank-account-specific approvers, separation of invoice and payment approval, FX-specific workflows, time-boxed delegation, re-authentication at release, and a complete audit trail of who approved what and when.
An approver rubber-stamps every batch in seconds - how do I make review meaningful?
Shrink what they see: route only exceptions and high-risk flags to them, require explicit acknowledgment of flagged items, and periodically seed the run with a test exception to verify review is real.
How should payment approval workflows be documented for SOX / audit?
A written approval matrix, system configuration screenshots or exports showing rules match the matrix, evidence of periodic access reviews, and sampled approval trails tying each payment to its approver.
Should self-approval ever be permitted - the controller approving a batch she built?
No; builder and approver must differ, even in small teams - if headcount makes that hard, the CFO takes release approval rather than collapsing the roles.
Stampli perspective
Stampli's payment approval workflow is configurable with amount-based approval rules, multi-level approval chains, bank-account-specific approvers, a separate approval process for FX/international payments, and time-boxed approval delegation - with segregation of duties between invoice and payment approval enforced by design and every approval captured in an immutable audit trail.