Accounts Payable Process Walkthrough

Step 1: Building and maintaining a vendor master file that controls who gets paid

The vendor master file is your organization's approved guest list. If a name isn't on it correctly, that name shouldn't be getting paid. Simple enough in theory; in practice, this file is often a mess of duplicate entries, stale addresses, and payment details nobody has touched since the original setup.

The file stores everything you need before money ever moves: contact details, tax IDs, payment terms, banking information. The real question it's supposed to answer is blunt: who is actually authorized to receive money from this organization? If you can't answer that cleanly for every active vendor, you have a problem that will follow you through every step that comes after.

Weak controls here are the most common entry point for fraudulent vendors. An unauthorized payee can slip into a poorly managed system without anyone noticing until the damage is already done. The verification steps that actually work:

• Confirm the tax ID independently. Don't take the vendor's word for it.
• Verify banking details through a secondary channel. A phone number pulled from the vendor's own invoice does not count as a secondary channel.
• Treat any mid-relationship request to change payment details with the same scrutiny as a brand-new vendor onboarding. Business email compromise attacks live right here, and they work because people treat these requests as routine.

Ongoing maintenance matters as much as the initial setup. Stale records, duplicate vendors, and outdated payment terms create matching failures downstream, and matching failures slow everything down and put you in an awkward spot with vendors who are, in fact, legitimate.

Step 2: Receiving invoices and capturing the data accurately

A properly formed invoice tells you six things: a unique invoice number, the issue date, a description of what was ordered, quantities, unit costs, and payment terms. If any of those are missing or wrong when the invoice arrives, you're already behind.

Invoices come in from every direction. Email, vendor portals, paper mail, sometimes all three from the same vendor in the same week. Your AP team's job is to funnel all of it into one system so it can be processed consistently.

There are two ways to get data out of an invoice and into your system. Manual keying is error-prone and slow. OCR-based automation reads and extracts the relevant fields without human input, and current systems hit accuracy rates around 98 percent. Add machine learning on top and the system starts learning each vendor's specific invoice format over time, which matters when you're dealing with hundreds of different vendor templates.

About 39 percent of invoices contain errors. A meaningful share of those originate at the capture stage, before the invoice has even reached matching.

Invoice coding is where a lot of people's eyes glaze over, but it matters more than it looks. Every line item needs to be assigned to the correct general ledger account and cost center. You can have a payment that's accurate to the penny and still cause budget reporting headaches if it hits the wrong department. That problem is invisible until someone runs a report and the numbers don't add up.

Step 3: Three-way matching as the central control that prevents overpayment and fraud

Three-way matching is the heart of accounts payable. If you only understand one step in this entire process, make it this one.

The logic is straightforward. You should only pay for what you ordered and actually received. Obviously true; also routinely skipped in organizations that treat this step as paperwork rather than a real control.

Here's how the matching works:

• Two-way matching compares the invoice against the purchase order. Did the vendor bill you what you agreed to pay?
• Three-way matching adds the receiving report, confirming the goods or services were actually delivered. All three documents (the purchase order, the invoice, and the receiving report) need to agree on quantity, price, and terms before payment moves forward.

What matching actually catches: billing errors, quantity mismatches, invoices for goods that never arrived, and outright vendor fraud. Without this step, that 39 percent invoice error rate doesn't get filtered. It translates directly into overpayments, and nobody calls you to let you know you overpaid them.

AP teams can set a tolerance threshold, say a five percent variance, so minor differences don't trigger a manual review on every single invoice. This keeps the workflow moving without abandoning the control entirely. You're looking for problems that are actually worth someone's time.

Step 4: Routing invoices through an approval workflow with the right authority levels

The approval step exists to answer one question: is this expenditure legitimate, within budget, and authorized by someone who is actually accountable for this spend?

For low-value, routine invoices, a single approver is usually enough. For larger amounts, a two-tier structure works better: the employee who worked directly with the vendor approves first, and a senior stakeholder provides a second sign-off. Rule-based routing removes the guesswork. Director approval required above a certain dollar threshold. Automatic escalation if an invoice has been sitting for more than a set number of days. These rules run in the background and keep things moving without anyone having to manually track what's overdue.

About 60 percent of companies in a recent study lacked automated invoice approval workflows. Those teams handle every escalation by hand, which means delays stack on delays, and someone is constantly chasing down a VP who is traveling.

One structural principle that is not optional: segregation of duties. The person who approves an invoice should not be the same person who set up the vendor in the master file or who releases the payment. This single rule closes the most common fraud pathway in accounts payable. It's also the one rule that organizations quietly let slide when they're short-staffed.

Approval delays carry a direct dollar cost. Late payment penalties, strained vendor relationships, missed early-payment discounts. All of it traces back to workflows designed for control but not for speed. You need both.

Step 5: Handling discrepancies and disputes without letting them stall the payment queue

Disputes happen. Pricing doesn't match the contract. Quantities are wrong. Goods arrived damaged. The invoice showed up before the service was even rendered. These are all normal; what's not acceptable is letting them sit in someone's inbox for two weeks while the payment queue backs up around them.

Ad hoc dispute handling is where vendor relationships quietly deteriorate. Untracked disputes become invisible liabilities, the kind that surface at the worst possible time.

A structured resolution process looks like this:

• Log the exception in the AP system immediately. Not in email. Not on a spreadsheet where only one person knows it exists.
• Communicate with the vendor in writing so there's a paper trail.
• Assign clear ownership. One person responsible until it's closed.
• Document the resolution and update the invoice record before releasing it for payment.

A vendor who keeps resubmitting the same invoice after a dispute has been raised is a fraud signal, not just an administrative nuisance.

The tolerance threshold from the matching step applies here too. Minor variances that fall within your defined range get auto-approved and never become disputes in the first place. That keeps volume manageable and focuses human attention where it actually belongs.

Step 6: Executing payment through the right method and on the right timeline

Paying too early is not a virtue. Paying too late is not strategy. The goal is deliberate timing, and there's a real dollar figure attached to getting it right.

The governing metric is Days Payable Outstanding. The point isn't to maximize or minimize it; the point is to use your full credit terms and capture early-payment discounts when the economics justify moving faster. A two percent early-payment discount on a fifty-million-dollar payables base is one million dollars annually. That only gets captured if invoices clear the queue within roughly ten days of receipt. Most don't.

Payment method matters for fraud exposure. According to the AFP's 2025 Payments Fraud and Control Survey, 63 percent of organizations experienced check fraud attempts in 2024. Checks remain the most targeted payment method by a significant margin. ACH transfers and virtual cards are faster, cheaper, and produce a digital audit trail that paper checks simply don't. They also eliminate the physical steps that add unnecessary days to check-based cycles; printing, signing, and mailing all take time, and time in AP has a price.

Dual authorization on outbound payments is not negotiable. The person who schedules a payment should not be the same person who releases it.

Step 7: Reconciling payments and maintaining records that hold up under audit

Reconciliation is where you close the loop. You're comparing payments made against the AP ledger and the bank statements to surface anything that slipped through earlier in the process.

What reconciliation finds:

• Duplicate payments
• Unapplied credits
• Payments posted to the wrong period
• Mismatches between your records and the vendor's statement

The record-keeping side of this step is what makes or breaks an audit. Every document in the chain (the purchase order, the receiving report, the invoice, the approval, the payment confirmation) needs to be stored and linked in your system, so that when an auditor asks for the full chain on a specific transaction, you pull it up in seconds, not hours.

Clean AP records also feed directly into cash flow forecasting. AP aging reports, DPO trends, and payment timing data are the inputs your finance team uses to project short-term cash needs. When that data is reliable, CFOs can use it for spend visibility, vendor negotiation leverage, and real-time fraud detection. When it isn't, they're forecasting with noise.

Where the process breaks down: the cost and time gap between high and low performers

The performance gap in AP is wider than most people expect, and the numbers make it hard to argue with.

According to APQC benchmark data from roughly 1,500 organizations, the median cost to process a single invoice is $5.83. Top-quartile performers bring that down to $2.07. Bottom-quartile performers push toward $10. Manual processing, depending on the organization, runs anywhere from $12 to $40 per invoice; end-to-end automation brings it into the one-to-five-dollar range.

The speed gap is just as striking. Manual processing averages 14.6 days from receipt to payment approval; best-in-class teams are under three days.

Staffing tells the same story. Bottom performers need around 14.4 full-time employees per billion dollars in revenue to run AP. Top performers manage the same volume with about 3.3. In raw throughput, a fully manual AP function processes roughly 6,082 invoices per FTE annually; a fully automated one processes more than 23,000.

That gap isn't mainly about headcount decisions or budget; it's about where errors accumulate and how long they sit before anyone catches them. Every exception that goes unlogged, every dispute that lives in an inbox, every invoice that gets re-keyed incorrectly compounds the problem over time.

A slow AP function doesn't just cost more to run. It misses early-payment discounts, generates late-payment penalties, and produces unreliable data that turns cash flow forecasting into a guessing game with real money on the table.

The fraud exposure that lives inside a poorly controlled AP process

The scale of payments fraud is not what most people expect when they first see the numbers.

According to the AFP's 2025 Payments Fraud and Control Survey, 79 percent of organizations experienced attempted or actual payments fraud in 2024. The ACFE's 2024 Report to the Nations puts the median fraud loss per case at $145,000, a 24 percent increase from 2022. When the fraud originates specifically in the accounting department, the median loss exceeds $190,000 per incident.

Detection lag makes it significantly worse. Most fraud schemes go undetected for approximately 12 months; schemes that run five or more years produce a median loss of $875,000. By the time someone notices, the damage has compounded well beyond what the early red flags suggested.

The most exploited vulnerabilities in AP come down to three things:

• Weak vendor master file controls. Fraudulent vendors added without verification. This is Step 1 failing.
• Business email compromise. In 2024, BEC was the leading avenue for both attempted and successful payments fraud. A convincing email asking you to update a vendor's banking details is often all it takes, especially if your team has been trained to be helpful and responsive.
• Single points of control. One person who can create a vendor, approve an invoice, and release a payment. This structural condition is what makes most AP fraud possible in the first place.

Organizations without automated controls experience fraud losses that are, on average, 50 percent higher than those with them.

The controls that cut fraud risk most: segregation of duties across vendor setup, invoice approval, and payment release. Dual authorization on every outbound payment. Independent verification of any banking detail change, every single time, through a channel you control, not one the vendor provided.

The KPIs that tell you whether each stage of the process is actually working

Metrics don't manage a process; they tell you where the process is quietly failing before the failure becomes visible or expensive.

Five metric families cover the full AP workflow: cost, speed, accuracy and exception control, touchless processing rate, and productivity.

Cost per invoice. Best-in-class target is under three dollars. Calculated as total AP processing costs divided by invoices processed. A rising cost per invoice without a rising invoice volume is worth investigating.

Invoice cycle time. Average days from receipt to payment approval. The manual average is 14.6 days; best-in-class teams operate around 3.1 days. If your number is closer to the manual average, the approval workflow, the exception handling, or both are the likely culprit.

Invoice exception rate. Target below 10 percent. A high rate points upstream: poor vendor data, weak PO discipline, OCR failures at capture. The fix isn't managing exceptions faster; it's cutting what's generating them in the first place.

Touchless processing rate. The share of invoices that move from receipt to payment without a human touching them. A high rate means your matching rules, approval routing, and vendor data quality are working together; a low rate means one of those three is broken, and you won't know which one until you look.

DPO. The goal is alignment with your credit terms and strategic use of early-payment discounts when capturing them makes financial sense. Maximizing it for its own sake is not the point.

Early-payment discount capture rate. Invoices that sit longer than about 10 days typically miss the discount window; this metric tells you whether the front end of your process is fast enough to actually unlock the savings available to you.

Invoices per FTE. Used to right-size staffing and evaluate whether automation investments are changing throughput. If you've invested in automation and this number hasn't moved, the automation isn't working the way you think it is.

Reading these together matters. A low cost-per-invoice paired with a high exception rate may just mean exceptions are going undetected, not that the process is clean. No single metric tells the whole story; the picture they paint together is what you're actually after.