3. Accounts payable process controls: As previously stated, delegation of authority and segregation of duties are two corporate policy related or foundational controls required for the accounts payable profession. The following controls are specifically related to the accounts payable process and should be evaluated and implemented as appropriate for the organization
3.1. Vendor master controls: Because the accounts payable function is responsible for the proper disbursement of funds to the correct vendor, the accounts payable professional should ensure that the vendor has been validated before setup on the vendor master.
3.2. Invoice processing controls: The accounts payable function is responsible for the timely and accurate processing of invoices adhering to the internal controls. Controls could include but are not limited to those listed below:
3.3. Disbursement controls: Along with payroll, accounts payable represents the largest percentage of disbursements within a company. It is critical to adhere to the following internal process controls to detect and prevent fraud within a timely manner.
- Check requests should be routed to the appropriate personnel for review prior to payment release.
- For audit purposes, disbursement activities should be traceable to the general ledger and bank statement.
- Approved purchase orders, receiving transactions, and invoices must support requests for payment.
- Vendor discounts should be taken according to company policy.
- Disbursements must be recorded in the period the payment was made.
- Expenses must be properly and accurately recorded in the accounting records during the period in which the liability was incurred.
- Blank checks should be properly stored and safeguarded in a secure area.
- Proper accounting should be ensured for void or canceled checks.
- Specific limits of signed authority must be established for bank accounts.
- Banking and disbursement information must be safeguarded from loss or destruction.
- Checking accounts must be provided with a “match pay,” “positive pay,” or “positive payee” control that permits a preview of checks presented to the bank for payment.
- Check requests must be used for the proper purpose and are limited in value.
- Segregation of duties controls are exercised when granting system access to the vendor master file.
- A W-9 form is executed prior to setup on the vendor master when required.
- A vendor profile form is completed when required (i.e. global vendors).
- Vendors are screened against Office of Foreign Asset Control (OFAC) and other government watch lists or according to company’s policy.
- Inactive vendors are flagged or purged on an annual basis or other prescribed frequency.
- Changes to vendor master files are accurate and reported for audit purposes.
- Addresses of vendors are validated as accurate and reported for audit purposes.
- Updates to employees on the vendor master file are accurate and complete.
- EDI vendors are properly set up and appropriately validated.
- Standard vendor naming conventions are applied.
- Duplicate vendor remit to addresses are reviewed with appropriate action taken.
- Segregation-of-duties controls are exercised when granting system access to invoice processing functionality.
- Vendors are paid once and only once.
- Discounts are taken if appropriately approved.
- Vendors are paid at the appropriate price in accordance with the terms and conditions of the contract.
- Payments to contract labor vendors do not exceed the authorized amount.
- Vendor invoices are paid upon validation of goods received and purchase order; blocked three-way match exceptions are not processed and are monitored by AP for clearing.
- Purchases are authorized and in accordance with the company's approval levels. Third party support (invoices/contracts) is sent directly to AP.
- Interface, EDI and spreadsheet upload transactions are accurately and completely transmitted to the ERP.
- Transactions are accurately reflected in the general ledger; AP reconciliations for aging and clearing accounts are timely performed and reviewed.
- Invoices are processed according to invoice payment terms.
- EDI transactions are accurate and completely recorded in the organization’s ERP system.
- ACH accounts should have debit blocking capabilities to ensure that no authorized debits can be placed.