One Person Should Not Control Every Stage Of A Business Payment Without Independent Review.
A well-controlled payment process separates five important stages:
- Prepare — Assemble the payment request and supporting documents
- Verify — Confirm the supplier, amount and bank details
- Approve — Obtain approval from an authorised person
- Release — Submit or release the payment through online banking
- Reconcile — Independently match the payment to the bank and accounting records
If one person can prepare a payment, change supplier details, approve it, release it and review the bank reconciliation, an error or unauthorised transaction may pass through without being noticed.
Separating duties creates checkpoints. The person verifying a payment should review the invoice, supporting documents, supplier identity, amount and bank-account details rather than relying only on information entered by the preparer.
The approver should understand what is being paid and confirm that the expenditure is valid, properly supported and within the person’s authority. Online-banking access and approval limits should reflect these responsibilities.
A small team may not be able to assign five different people. It can still use practical safeguards such as approval limits, bank alerts, dual authorisation for larger payments, restricted access to supplier master data and an independent review of bank reconciliations.
The objective is clear accountability at each stage. Avoid giving one person control over every stage of the payment.