Accounts Payable Controls: The Standard List, and the Gap It Misses

Accounts payable controls, the internal controls governing how AP approves, records, and pays invoices, stop a process from paying the wrong amount, the wrong vendor, or the same invoice twice. Most lists cover the same five or six: segregation of duties, matching, approval hierarchies, vendor master management, and reconciliation.

What most don't say: a control built on sampling only controls for what it checks, and at real volume, that's rarely everything.

‍

Key Takeaways

• Accounts payable controls are the checks built into an AP process to prevent fraud, error, and duplicate or unauthorized payment, typically segregation of duties, 3-way matching, approval hierarchies, vendor master management, and reconciliation.
• Segregation of duties and 3-way matching are the two controls every framework leads with, since they address the two biggest risk categories: one person controlling an entire payment, and paying for something that wasn't actually ordered or received.
• Most AP-controls frameworks describe what to check, not how much volume actually gets checked. A control run on a 20% sample is still a control, just one with an 80% blind spot built in.
• Coverage percentage belongs on the controls list itself, not just the process list, since a control that only runs on a fraction of invoices leaves the uncovered fraction with no control at all.
• Freehand runs the standard controls (3-way and 4-way matching, approval routing, duplicate detection) at 100% of invoice volume, so coverage isn't a separate conversation from which controls exist.

‍

What are accounts payable controls?

Accounts payable controls, sometimes called accounts payable internal controls, are the checks and process safeguards built into an AP function to prevent fraud, error, and unauthorized or duplicate payment before money leaves the business.

They exist because AP sits at a specific point of risk: it's the function that actually moves cash out the door, based on documents (an invoice) that originate outside the company and aren't automatically trustworthy.

A control isn't the same as a process step. Receiving an invoice is a process step. Checking that invoice against a purchase order before approving it is a control.

‍

What are the categories of accounts payable internal controls?

Seven controls sort into three categories, each protecting a different stage of the payment lifecycle: confirming the obligation is real, recording it accurately, and safeguarding the actual disbursement.

‍

For how the matching control specifically works in practice, see our guide to invoice reconciliation.

‍

Why do segregation of duties and matching get the most attention?

Segregation of duties and matching address the two failure modes that cause the most damage: one person having unchecked control over a payment, and paying for something that isn't real.

Segregation of duties is the classic fraud control, no single employee should be able to add a vendor, approve an invoice, and release payment without another person touching the transaction somewhere in that chain.

Matching is the classic error control. A 3-way match (invoice, purchase order, and receipt) confirms the business actually ordered and received what it's being billed for, before price and quantity are checked. Most fraud and most simple billing errors show up in one of these two places, which is why nearly every framework leads with them.

‍

Why is a sampled control still a gap, even if it's documented?

A control that runs on a sample of invoices is still a real control, but the coverage percentage is part of what the control actually protects against, and most AP-controls frameworks never put a number on it.

A documented 3-way matching process that only runs on 30% of invoice volume, because the rest clears under a dollar threshold or through a workflow exception, is a real control with a real, known hole. The invoices outside that 30% aren't being controlled for at all.

That gap is invisible in a controls audit that checks whether a process exists, since the process does exist, it just doesn't reach every invoice. It's only visible when someone asks what percentage of volume the control actually touches.

‍

Worked example

A Fortune 500 home appliance manufacturer ran into exactly this. Its freight audit process auto-approved any invoice under a $3,000 threshold, a documented control on paper. Carriers learned exactly where that threshold sat, and systematic overcharges concentrated in the sub-threshold band the control was never built to check. The control existed. The coverage didn't.

‍

Where do accounts payable controls typically break down for freight invoices?

Freight invoices are the category most AP-controls frameworks quietly exclude, since they don't carry a purchase order the way a standard vendor invoice does. The 3-way matching control that anchors most AP frameworks has nothing to check a freight invoice against: no PO, no simple receipt record, just a rate agreement, a shipment, and a set of accessorial charges that shift week to week.

That gap doesn't show up as a missing control on paper. It shows up as freight invoices routing around the standard matching control entirely, cleared on a reasonableness check instead of an actual match.

Freehand's invoice audit agent closes it by matching freight invoices against the carrier contract, fuel index, and shipment data, the same rigor a PO gives a standard invoice, at 100% of volume rather than a sample.

{{blue-cta}}

‍

How is automation changing internal controls in AP?

Automation doesn't add new controls to the list. It changes how much of each control actually runs, from a documented process that touches a sample to one that touches everything.

Segregation of duties, matching, approval hierarchies, none of these change conceptually when AI runs them. What changes is that a matching control built to review 20-30% of volume, because that's what a team could realistically check by hand, no longer has to make that tradeoff.

That shift matters most for the controls that were always coverage-limited by design. Duplicate detection run by a person scanning invoice logs catches what a person can reasonably scan. Duplicate detection run continuously across every invoice, every vendor, and every payment run catches all of it, the same control, just without the sampling compromise built into the manual version.

The controls of the future aren't different controls. They're the same list, run at coverage levels a manual or lightly automated process was never built to reach.

‍

What should you check when evaluating your own AP controls?

• What percentage of invoice volume does each control actually reach? A control description without a coverage number is incomplete, ask for the percentage, not just the process.
• Where do invoices bypass matching entirely? Dollar thresholds, workflow exceptions, and no-PO categories like freight are the places controls quietly stop applying.
• Does segregation of duties hold at every step, including exceptions? A clean approval hierarchy that gets overridden during a manual exception process isn't actually segregated.
• Is vendor master data locked down, or editable by the same people who approve payments? That combination is a common, specific fraud vector auditors look for.
• Does reconciliation catch what individual controls miss? A strong reconciliation step is what catches the pattern no single invoice-level check was built to see.

Every item on a standard AP-controls list is worth having. None of them controls for the invoices that never actually pass through it. Coverage is what turns a documented control into one that actually holds, and it's the question most controls frameworks leave unasked.

{{brown-cta}}

‍

Frequently Asked Questions

What are accounts payable controls?

Accounts payable controls are the checks built into an AP process, segregation of duties, matching, approval hierarchies, vendor master management, and reconciliation, that prevent fraud, error, and duplicate or unauthorized payment.

What are the 5 main internal controls in accounts payable?

Segregation of duties, 3-way (or 2-way) matching, approval hierarchies based on payment size, vendor master management, and reconciliation. Most frameworks build around these five.

Why is segregation of duties considered the most important AP control?

Because it addresses internal fraud directly: no single person should be able to create a vendor, approve an invoice, and release payment without another person's involvement somewhere in the chain.

What is a ghost vendor, and how do AP controls catch it?

A ghost vendor is a fake or duplicate vendor record set up to receive payments for goods or services that were never actually provided. Vendor master controls catch it by requiring a separate reviewer to approve any new vendor or bank-detail change, so the person who could benefit from a fake vendor isn't the one approving it.

Can a documented control still have a coverage gap?

Yes. A control that only runs on a sample of invoices, due to a dollar threshold or workflow exception, is still a real, documented control, but the invoices outside that sample have no control applied to them at all.

Why do freight invoices often fall outside standard AP controls?

Because freight invoices don't carry a purchase order the way standard vendor invoices do, so the matching control most AP frameworks rely on has nothing reliable to check them against, and they often clear on a reasonableness check instead.