How do I maintain segregation of duties in an automated AP approval workflow?
Keep three roles distinct in the workflow itself: who can create or edit a vendor record, who can enter or submit a bill, and who can approve it for payment. Institutional guidance is explicit that authorizing a payment and the person who executes it shouldn't be the same individual — automation makes it easy to collapse these into one click, which is exactly the risk to design against.
By Zuny Fester, Head of Operations and MarketingPart of the accounts payable and invoice processing guide.
| Core principle | "No one person should initiate, authorize, record, and reconcile a transaction" (Cornell University) |
|---|---|
| Specific AP example | "Authorizing payments to vendors and mailing the payments" is named as an incompatible duty pair (FAU) |
| Three roles to keep separate | Vendor master maintenance, bill entry/submission, payment approval |
| Automation-specific risk | A single admin role with edit-create-approve permissions collapses all three into one identity |
| Compensating control | Where full separation isn't possible (small team), increase review/oversight of the combined role |
Why this principle predates any specific software
Segregation of duties is an internal-control concept, not a feature of any AP tool. Cornell University's own internal controls guidance states the principle directly: "No one person should initiate, authorize, record, and reconcile a transaction." Florida Atlantic University's segregation-of-duties guidance names the AP-specific version of the same idea explicitly, listing "authorizing payments to vendors and mailing the payments" as a combination of duties that shouldn't sit with one person.
The three roles a workflow needs to keep apart
Translated into workflow permissions, that's three distinct capabilities: who can create or edit a vendor's record (including bank details — the exact target of vendor-impersonation fraud), who can enter or submit a bill for approval, and who can approve a bill for payment. A person who can do all three unilaterally — create a vendor, enter a bill for that vendor, and approve it — has, in effect, the ability to both create and approve a fraudulent payment to an account only they control.
What automation makes easier to get wrong
A manual, paper-based process has natural friction that enforces separation — a form has to physically move between desks. A single automated workflow, by contrast, can technically let one role click through vendor creation, bill entry, and approval in one session unless the permission structure explicitly blocks it. Cornell's guidance addresses exactly this gap for smaller teams that can't fully separate roles: "unit management should increase review and oversight functions" as a compensating control — a second person spot-checking rather than a third person doing the approval themselves.
Next step
Map the finance workflow with the most exposure and prove the automation path.
Bring the invoice, contract, payment reconciliation, or customer finance workflow you have to defend at audit. Loopfour can map the trigger, controls, integrations, and approval loop.
Field mapping
Three AP duties and who should hold each
| Duty | What it controls | Risk if combined with approval |
|---|---|---|
| Vendor maintenance | Creating/editing vendor records, including bank details | Can plant a fraudulent bank account before a bill ever exists |
| Bill entry | Creating/submitting a bill for a vendor | Can submit a bill for a vendor they also control |
| Payment approval | Releasing a bill for payment | Combined with either of the above, one person controls the full path from creation to payment |
Frequently Asked Questions
Sources
Related
Topic
AP & Invoice Processing
Accounts payable and invoice processing is the set of steps a vendor bill goes through between arriving at a company and turning into a payment: capturing what the vendor sent, checking it against wha…
Read moreDiagnostic
What causes a three-way match failure between the PO, receipt, and invoice?
A three-way match compares the PO, the receipt (what was actually delivered), and the invoice on quantity, price, and charges. A failure means one of those three disagrees beyond tolerance — usually because the invoice bills a quantity that isn't fully receipted yet, the unit price differs from the PO, or the invoice adds a charge, like freight, the PO never included.
Read moreDiagnostic
Why does one vendor show two different balances in AP aging?
The vendor almost certainly exists as two separate records in your vendor master file — created under slightly different names (a typo, a rebrand, a merger, a re-onboarding) — so bills and credits are split across both. AP aging reports by vendor record, not by real-world vendor, so it shows two partial balances instead of one true balance.
Read moreDiagnostic
What is business email compromise vendor payment fraud, and how do I prevent it?
A fraudster impersonates a real vendor — often by spoofing their email domain — and requests a change to bank account or payment details, redirecting a legitimate payment to an account they control. The FBI's IC3 calls this the single most reported category of cybercrime loss and recommends verifying any account-change request through a secondary channel, not the email that made the request.
Read more