Introduction
Accounts payable moves more money out of your business than any other process — and in most small and mid-sized companies it runs on habit rather than documentation. An accounts payable SOP turns that habit into a controlled process: every invoice captured once, matched before approval, approved within defined limits, and paid on a schedule that someone can defend to an auditor.
The cost of leaving it undocumented is measurable. Industry analysts such as Ardent Partners consistently benchmark the cost of manually processing a single invoice at around 10 dollars once labor, errors, and rework are counted, while best-in-class automated teams pay a fraction of that. The Association of Certified Fraud Examiners estimates organizations lose about 5% of revenue to fraud each year, with billing schemes among the most common — and AFP's annual Payments Fraud Survey finds a large majority of organizations report attempted payments fraud, with business email compromise the leading vector. Every one of those risks is addressed by a control that belongs in this SOP.
Why Every Finance Team Needs an Accounts Payable SOP
Without a written process, AP knowledge concentrates in one or two people, approvals happen by hallway conversation, and controls exist only as good intentions. The predictable results: duplicate payments (industry studies routinely find 0.1–0.5% of disbursements are duplicates), invoices approved by whoever answered email first, vendor bank details changed on the strength of a single spoofed message, and a month-end close that starts with hunting for unentered invoices.
An SOP fixes this by defining one path for every invoice and one owner for every control. It is also the fastest way to make AP resilient to staff turnover and vacation coverage.
Key Procedures Every Accounts Payable SOP Needs
1. Invoice Receipt and Capture
Define a single intake channel — one AP email inbox or portal, no invoices accepted via personal email — and capture standards: entry into the AP system within one business day, with vendor, invoice number, date, PO reference, amounts, and due date recorded. Duplicate invoice numbers should be blocked at entry, not discovered at payment.
2. Three-Way Matching
The core control: match invoice to purchase order to goods receipt before approval. Specify tolerance thresholds (for example, within 2% or 50 currency units, whichever is lower), what happens on a match exception (route to the PO owner, not straight to payment), and which invoice categories are legitimately non-PO (utilities, rent, subscriptions) with their alternative approval path.
3. Approval Matrix and Delegation Limits
A written table of who approves what: role, category, and monetary limit — for example, department managers to 5,000, directors to 25,000, CFO above that, with two approvers over a defined threshold. Include delegation rules for absence (formal, time-limited, logged) so approvals never route around the matrix informally.
4. Payment Runs
Define the payment schedule (for example, weekly runs on Thursdays), the proposal-review-release sequence with different people proposing and releasing, supported payment methods, and how urgent off-cycle payments are authorized — always as a documented exception with a named approver, never as a habit. The SOP should also state how the release approver reviews the proposal: sample new vendors, check any first-time bank details, and compare the run total against a normal week before releasing funds.
5. Vendor Master Data Management
Onboarding requirements (tax details, banking verification, sanctions screening where relevant), who may create or edit vendor records — someone who cannot also process payments — and a periodic cleanup that deactivates vendors with no activity in 18–24 months. A tight vendor master prevents both fraud and duplicates at the source.
6. Duplicate Payment Prevention
Layered controls: system-level duplicate checks on vendor plus invoice number plus amount, entry standards that stop the same invoice arriving via two channels, a rule against paying from statements or copies, and a periodic duplicate review of paid items. Recovering a duplicate a year later costs many times what preventing it would have.
7. Fraud Red Flags and Bank-Change Verification
The control that stops business email compromise: any request to change vendor bank details is verified by calling the vendor on a phone number from the existing vendor record — never a number from the email requesting the change. List additional red flags: new vendors with PO-box-only addresses, invoices just under approval thresholds, urgency pressure, and changed remittance details on an otherwise normal invoice. Specify who investigates and how suspicious items are escalated.
8. Month-End AP Cutoff
Define the cutoff date and time, the accrual process for goods and services received but not yet invoiced, the GRNI (goods received not invoiced) review, unmatched invoice aging review, and AP subledger-to-GL reconciliation. A clean AP cutoff is what keeps the month-end close on schedule — and it is the section auditors test first, so include who signs off each reconciliation and where the evidence is filed.
9. Key Controls and Segregation of Duties
Summarize the segregations the whole SOP depends on: the person who creates vendors does not process payments; the person who enters invoices does not approve them; the person who proposes a payment run does not release it. In small teams where full segregation is impossible, define compensating controls — such as owner review of the monthly payment register and all vendor master changes.
Step-by-Step: Building Your Accounts Payable SOP
- Map the current invoice-to-pay flow honestly. Follow five real invoices end to end, including the ones that went wrong.
- Fix the intake first. One channel, one system of record, entry within a day. Half of AP chaos is invoices nobody knew existed.
- Write the approval matrix and get it signed. Limits, categories, delegation rules — approved by leadership so it carries authority.
- Document the controls as steps, not principles. "Verify bank changes by callback to the number on file" is a control; "be vigilant about fraud" is not.
- Define the payment run calendar. A predictable rhythm eliminates most urgent-payment exceptions on its own.
- Review quarterly against actual exceptions. Every duplicate, late payment, or near-miss is telling you which section of the SOP needs sharpening.
Common Mistakes to Avoid
Accepting invoices anywhere. Invoices arriving via personal inboxes and desk drops guarantee duplicates and missed accruals. One channel, no exceptions.
Approval by seniority instead of matrix. If anyone senior can approve anything, you do not have an approval control — you have a courtesy.
Trusting email for bank changes. BEC succeeds precisely because the email looks routine. The callback-to-known-number rule must be absolute.
Ignoring the vendor master. Duplicate and dormant vendor records are where duplicate payments and fictitious-vendor fraud hide.
Writing the SOP and skipping the calendar. Cutoffs, payment runs, and reconciliations are calendar events. If they are not scheduled, the SOP is aspirational.
How AI Accelerates SOP Creation
WorkProcedures generates a complete accounts payable SOP from a plain-language description of your invoice-to-pay process — approval matrix, matching rules, fraud controls, and month-end cutoff included. Build it into a training handbook for new finance hires, export a branded PDF for auditors, and track acknowledgements so every control has a documented owner.
Conclusion
An accounts payable SOP is the cheapest financial control you will ever implement: one document that prevents duplicate payments, blocks the most common fraud vector, and takes the drama out of month-end. Visit WorkProcedures to build your accounts payable SOPs today.