Accounts payable internal controls, stage by stage
AP & P2P Analyst
In Brief
- Accounts payable internal controls are easier to test one stage at a time than as a single checklist.
- IDC says enterprise AP is becoming a control layer, and describes SoftCo’s architecture as treating each payables stage as a discrete control point feeding verified data into the next.
- Answer one control question per stage, mark each answer as evidenced or assumed, and fix the assumed ones first.
Accounts payable internal controls are the checks that make sure a business pays only valid invoices, to the right supplier, for the right amount. They are often written down as a checklist: approval limits, segregation of duties, a three-way match. A checklist tells you which controls exist. It does not tell you whether each one still works at the point where the money moves, which is the question an auditor asks.
This post sets out why a stage view works better, what IDC says about the control layer in enterprise AP, and nine questions you can use to test your own accounts payable internal controls.
Accounts payable internal controls need a stage view
Each control in a checklist can pass on its own and still leave a gap between stages. A contract can look valid, the supplier can pass onboarding and the invoice can match, yet the bank details may have changed after approval. Accounts payable internal controls break where one stage hands data to the next.
The Supplier Control Framework (SCF) makes the same point as its seventh principle: connect the controls. A stage view asks one question at each point where money, data or responsibility changes hands. It also prepares you for the question the SCF page puts first: could you explain every payment to an auditor?
Internal control as a discipline follows frameworks such as the COSO Internal Control framework, first issued in 1992 and refreshed in 2013. A stage view does not replace them. It applies the same thinking to the path an invoice and a payment take.
What IDC says about the AP control layer
IDC describes a related shift, from AP as processing to AP as control. In its IDC MarketScape: Worldwide AI-Enabled Accounts Payable Automation Software for Large Enterprise 2026 Vendor Assessment (document #US54134226, September 2026), IDC says a control plane is emerging. As AP environments become more distributed, enterprises need a consistent layer for deciding what should happen next.
“Enterprise AP is becoming a control layer for financial operations. The leaders will be the platforms that can coordinate complexity across systems while giving finance confidence that every automated action remains visible, governed, and accountable.” Kevin Permenter, Research Director, IDC, in the IDC MarketScape synopsis
IDC also describes the architecture of SoftCo’s AP automation platform. It says the architecture treats each stage of the payables life cycle as a discrete control point feeding verified data into the next. That is IDC’s description of one platform, not a standard for every AP team.
The link to the nine stages below is our reading. IDC does not refer to the SCF. We see a parallel: control is exercised at each stage, and each stage depends on the data from the one before it. We covered the assessment when IDC published it.
Nine stages, nine control questions
The framework follows a supplier from first commitment to reconciliation. It has nine stages, grouped in four acts, and each stage poses one question that a controlled process must answer. The questions below are the SCF’s own.
Commit: contract, supplier and purchase
The business commits money before any invoice exists.
- Contracting: Is there a valid, current contract for this supplier and spend?
- Supplier onboarding: Is this supplier verified, with bank details confirmed to belong to them?
- Purchasing: Was this purchase authorised and placed with an approved supplier and contract?
Process: receipt, capture and approval
Work arrives, and the team checks it against what the business set upstream.
- Receipt: Were the goods or services actually received, and confirmed by someone authorised?
- Invoice capture and validation: Is this a valid, original invoice from a verified supplier?
- Matching and approval: Can this invoice be approved on a basis you could explain to an auditor?
Settle: payment and reconciliation
Cash leaves, and the books have to agree with what the business paid.
- Payment release: Is this payment going to the right supplier and account, with nothing changed since approval?
- Post-payment and reconciliation: Did we pay the right amount, once, for everything we owed?
Sustain: supplier lifecycle management
Control continues as suppliers change.
- Supplier lifecycle management: Is this supplier still valid and compliant today, not only on the day it was approved?
How to test your AP internal controls
Answer each of the nine questions for your own accounts payable internal controls. Then mark each answer as evidenced or assumed. An evidenced answer is one you could show an auditor today: a record, a log or a report. An assumed answer is one you believe holds because it held when your team set up the control.
Assumed answers are the gaps. A supplier checked at onboarding is not necessarily verified today, and an approval rule written two years ago may not match how the business buys now. The framework’s third principle is to validate, do not assume. Controls that are not re-tested are not controls.
Controls that are not re-tested are not controls.
Fix the assumed answers at payment release first, because that is the last point where anything can still be stopped. Then work upstream, because the framework’s first principle is to fix problems at source. SoftCo also publishes an AP control checklist that you can use alongside the nine questions.
Where automation can hide control gaps
In SoftCo’s view, automation can make accounts payable internal controls look stronger than they are. A high automation rate shows how many invoices skip a person. It does not show whether the data behind each approval was still valid at the moment of payment. IDC advises technology buyers to follow the exceptions, not the automation percentage, and we set out what that means in practice.
Supplier data is a common way for this to happen. In SoftCo’s view, bank accounts get recycled, sanctions status changes and domiciles shift, so a record that was right at onboarding can be wrong by the next payment run. Our posts on master data drift and on the duplicate payment that gets through cover two ways it plays out.
What to do with the framework
Use the nine questions as the agenda for your next control review. Pick the stage where your answers are most assumed, and read what good looks like there. The framework sets out, for each stage, what good looks like and where it usually breaks. It also covers six control types and seven principles.
None of this needs new software to start. It needs nine honest answers.
Check your own process against the framework.
Nine stages, one control question each.
Frequently askedquestions
Accounts payable internal controls are the checks that make sure a business pays only valid invoices, to the right supplier, for the right amount. They cover approvals, supplier verification, matching and payment release.
The Supplier Control Framework names nine: contracting, supplier onboarding, purchasing, receipt, invoice capture and validation, matching and approval, payment release, post-payment and reconciliation, and supplier lifecycle management. Each has one control question that a controlled process must answer.
An AP control layer coordinates AP work across systems and decides what should happen next, so every automated action stays visible, governed and accountable. IDC describes a control plane as emerging in enterprise AP, and says enterprise AP is becoming a control layer for financial operations.
Ask for evidence, not assurance. For each control, mark your answer as evidenced if you can show a record today, or assumed if you believe it holds because it was set up that way. Treat the assumed answers as the gaps.
Ownership depends on the organisation, but a stage view makes it easier to assign. In SoftCo's view, each of the nine questions can go to the person closest to that stage, with the Financial Controller or CFO reading the combined answers.