Approval routing, audit trails, and payment controls
Approval workflows and controls that auditors accept
Anyone can draw a box labeled approved by manager. Building a workflow that enforces segregation of duties, survives a staff change, and produces a defensible audit trail takes more thought. This is how to design one.
The job of an approval workflow
What an approval workflow actually does
An approval workflow decides who needs to see an invoice before it can be paid, and records the decision. At its simplest that is a threshold rule: invoices under a set amount auto-approve, larger ones route to a manager. Real workflows add conditions — department, vendor, account, project code, or whether a purchase order exists. The workflow also sets the sequence, so a large capital purchase might route to the department head first and the CFO second.
When it works, nobody thinks about it. When it is wrong, invoices stall, vendors call, and people start approving things by email to get around the system. That last outcome is the one to design against, because it moves the approval out of your records entirely.
What a routing rule can check
- Dollar threshold on the invoice total
- Department, cost center, or project code
- Vendor and vendor banking status
- Presence or absence of a purchase order
- Approval sequence when two sign-offs are required
Where the risk actually sits
Designing thresholds that people don't game
Thresholds should reflect where the risk actually is, not where it is convenient. A very low auto-approval limit creates a pile of trivial approvals that managers rubber-stamp, which trains everyone to approve without reading. Set it too high and the control stops doing anything. A practical approach is to look at your historical invoice distribution, set the auto-approval limit where the volume is high and the risk is low, then review it after a quarter.
Watch for gaming as well. If a vendor starts splitting invoices to stay under the threshold, that is a signal worth acting on, and split-detection rules can flag the pattern for review instead of leaving it to someone noticing by chance.
Segregation of duties in practice
Segregation of duties means the person who creates a liability is not the person who releases payment for it. In larger finance teams that is straightforward. In small teams it is genuinely hard, because one person may handle entry, approval, and payment.
Where full separation is not possible, compensating controls help. Auditors accept them when they are documented and consistently applied. They do not accept we are too small as a control.
Compensating controls that hold up
- A second reviewer on every payment above a set amount
- A monthly bank statement review by someone outside the process
- A clear record of who did what, on every step
Vendor master data controls
Vendor banking details are a common fraud target. Someone impersonates a vendor, sends updated payment instructions, and the next payment goes to the wrong account. The controls here are specific, and the workflow only covers half of them.
System-side
- Restrict who can edit vendor banking information, and log every change.
- Require a second approval before a banking change takes effect.
- Block payment release while a vendor record has an unapproved change open.
- Keep the old banking details visible alongside the new ones during review.
Human-side
A workflow can enforce the approval step, but it cannot verify that the person requesting the change is legitimate.
Pair the system control with a phone call to a number you already have on file — never the number or address supplied in the change request itself.
Reconstructing a decision
The audit trail and what it needs to contain
Auditors want to reconstruct the decision, not just confirm that a box was ticked. Test the export before you need it, and confirm it includes enough detail to answer a question about a specific invoice from eighteen months ago.
The invoice and its coding
The document itself, the account and cost center it was coded to, and the vendor record it was matched against.
The approver and the timestamp
Which named person approved, when they approved it, and what they saw at the moment they did.
Comments and attachments
Questions asked during review, answers given, and any supporting file attached to the record.
Edits made after approval
If someone changed the coding after sign-off, that edit has to be visible as a separate event, not folded into the original.
An export you can actually use
If your tool stores approvals in a way you cannot export, that becomes a practical problem at audit time.
Who can see and do what
Access controls and roles
A useful structure separates invoice entry, approval, payment release, and system administration. Someone who can edit approval rules can quietly approve their own invoices if the roles are not separated, so administrative access deserves the closest look. For US companies with multiple locations or entities, access also needs to scope by entity so a manager in one division cannot approve another division's spend.
Roles to keep apart
Invoice entry, approval, payment release, and system administration each belong to a different role.
Where a team is small, document who holds which role and which compensating controls cover the overlap. Review access lists quarterly — people change roles, and stale permissions are a quiet control gap that never announces itself.
Multi-entity scoping
Scope approval rights by entity or location so a manager in one division cannot release spend in another.
A note worth pinning
Every workflow needs a documented override path, or people will invent one.
Make the override visible and slightly inconvenient. That is exactly the right level of friction — enough that it is used on purpose, not by default.
Handling exceptions and overrides
A legitimate override might be an urgent payment to a critical vendor when the normal approver is unreachable. The override should require a reason, a named approver at a higher level, and a record that it happened. What you do not want is an informal just pay it and we will sort it out later habit, because that is how unauthorized payments happen and how audit findings start.
Spend outside the invoice flow
Controls for card and expense spend
Card spend sits outside the invoice workflow but needs its own controls. The advantage of card programs is that controls apply at the point of spend rather than after the fact. The disadvantage is that a card can be used without a purchase order, so receipt capture and timely categorization matter more.
Merchant category restrictions
Block whole categories of spend at the card level, so the control applies before the transaction clears rather than after.
Per-transaction and monthly limits
Set both. A monthly ceiling alone still allows a single large charge that nobody sees until the statement arrives.
Receipt requirements
Ask for the receipt at the point of spend. Chasing missing receipts three weeks later rarely produces a good one.
A review step above a set amount
Pair card controls with a review step for anything over a set amount, and reconcile the card statement monthly so missing receipts do not accumulate.
Controls drift. Someone leaves, a new person takes over their access, and the separation you designed quietly disappears.
Reviewing controls after a change
A short quarterly review catches most of the drift. Confirm access lists still match the people in the roles. Check that approval thresholds still match current spend. Look at whether override usage has crept up, because a rising override count usually means the standard path is too slow rather than that the team got careless.
If you have added an entity, a location, or a new payment method, review whether the existing controls cover it. This takes about an hour and prevents the kind of finding that takes weeks to remediate.
When controls slow things down
It is possible to over-control. If every invoice over five hundred dollars needs three approvals, your team will find workarounds, and workarounds are worse than the risk you were managing. The fix is usually tiering: light touch for routine spend, more scrutiny for high-value or unusual transactions.
Look at where invoices actually sit in your queue and whether the approval step is adding judgment or just adding delay. A control that nobody understands is a control that will be bypassed the first time it is inconvenient.
Questions finance teams ask
Answers before you rebuild a workflow
Short answers to the questions that come up when a controller, a finance manager, and an IT lead sit down to change how approvals run.
Can a two-person finance team pass an audit on approvals?
Yes, with compensating controls that are documented and applied consistently. A second reviewer on payments above a threshold, a monthly bank statement review by someone outside the process, and a clear record of who did what are the ones auditors tend to accept. What does not work is treating team size as the control itself.
How often should approval thresholds be reviewed?
After the first quarter, then at least once a year and any time spend patterns shift. A threshold set when most invoices were under a thousand dollars behaves differently once the business grows, and an unreviewed limit is often the gap that shows up in a finding.
What belongs in an approval record for payment controls?
The invoice, the coding, the named approver, the timestamp, and any comments or attachments. Add post-approval edits as their own visible event. If your system cannot export that detail, test the workaround long before an auditor asks for it.
Does the tool verify that a vendor banking change is genuine?
No. It can require a second approval and log the change, but confirming that the request came from the real vendor is a human step. Call a number you already have on file rather than the one supplied in the request.
Where to go next
Approval routing rarely stands alone. It picks up coded invoices from capture, feeds the payment run, and has to reconcile against the bank at month end. These two reads cover the ends of that chain.
Talk to the team
Bring your current approval matrix and the awkward cases — split invoices, unreachable approvers, a two-person finance team — and we will walk through how the controls fit together.
- 770 Innovation Way, San Jose, CA 95134, USA
- +1-408-555-9539
- [email protected]
- Mon–Fri: 9:00 AM – 6:00 PM