Accounts payable framework: who holds which payment gate

A payment framework fails when one person holds every key. That is the commonest arrangement in a small business, and the fix depends on how many people there are, not on buying software.

Money leaves the business at the end of the process, and once it has gone, getting it back depends on the goodwill of whoever received it. The four gates a payment must pass are the supplier exists, the thing arrived, the amount is right, and the payment is released. What matters is who may open each one.

What to take away

Which gates may share a person

Three pairings are ruled out, and everything else is a judgment call. The rule column of the gate table sets the limits: the supplier gate stays apart from release, receipt stays apart from the supplier gate, and the amount gate stays apart from release.

A business with four people can separate all of them. A business with two can separate the pair that matters, gates 1 and 4, and that separation alone removes the most expensive failure available.

Gate 1 and gate 4: the pair to separate first

A person who can open both the supplier gate and the payment gate can send money anywhere. Separating that pair costs almost nothing and removes the most expensive failure in the framework, even where the business has only two people to share the work.

The supplier record fixes where money goes for as long as the relationship lasts, so creating a supplier is a decision, not data entry. The control belongs at creation and at every change afterwards.

Two rules protect the record. A new supplier is created by somebody who is not the person who will release payment.

A change to bank details is verified by calling the supplier on a number you already held, never one supplied in the message asking for the change. The verification is logged beside the change.

That second rule sounds excessive until you consider what a request to update bank details costs if it is honored without a call. It is the only control in this framework whose failure is usually unrecoverable.

Release: what the second person reads

The payment run is a single act that moves money to many places, which makes it the highest value point of failure in the whole process. The second person's job is to read the run before money moves.

A good run is built by due date rather than by entry date. The reviewer reads supplier names against invoice numbers before release. Disputed invoices are excluded automatically, and anything above a threshold you set needs a second approval.

The reviewer is looking for two things specifically: a supplier appearing twice, and a supplier whose bank details changed recently.

A due date is worth seeing defined rather than assumed. The federal prompt payment rules in 5 CFR Part 1315 define a due date as the date on which federal payment should be made, and a discount date as the date by which a discount can be taken.

Receipt: who confirms when you ordered it yourself

The invoice says the supplier believes they delivered something. The second gate is somebody in your business saying they did, and that person is not the one who pays. The form matters much less than that separation.

In a large operation this is a goods received note matched to a purchase order. In a small one it is an email from whoever ordered the thing confirming it turned up, recorded against the invoice.

Services are the hard case, because nothing arrives on a pallet. The workable version is that the person who commissioned the work confirms it was done. For recurring services, somebody reviews the list once a year and asks whether each is still wanted; charges nobody canceled are the most reliable saving available to any small business.

Where the person supplying the service is an individual, there is a separate question about how they should be treated at all. The IRS guidance on independent contractor or employee status says all evidence of the degree of control and independence must be considered. Form SS-8 is the IRS form for asking for a formal determination of worker status.

Amount and coding: kept away from release

The amount gate is the one that gets skipped, and it determines whether the month means anything. The person who checks price, coding and period should not be the person who releases the payment.

A cost recorded when the invoice was keyed rather than when the goods came in produces the cut-off failure described in the expense recording guide.

The coding check depends on there being definitions to check against. Where a supplier's invoices could reasonably land in more than one account, the definition should say which one wins, and that sentence belongs with the chart of accounts rather than in someone's head.

Filling it in for two people

Write the four gates down and put a name against each. The three separation rules leave only one workable split for two people, and the figure shows it as a table.

One person holds gates 1 and 3, creating suppliers and checking amounts. The other holds gates 2 and 4, confirming receipt and releasing payment. Gate 1 never meets gate 4, gate 2 never meets gate 1, and gate 3 never meets gate 4.

It takes no extra time, because both people were already involved. What it removes is the ability of any single person to invent a supplier and pay it.

One person: detection instead of prevention

A sole owner has nothing to separate, so the framework substitutes detection for prevention. It is weaker than separation, and it is not nothing.

The reconciliations that show the split held

Gates are controls at the moment of the transaction. Two monthly checks confirm they held, and they matter most where the team is too small to separate everything.

Neither takes long once the first month is done. The stage-by-stage view of the same controls sits in the accounts payable pipeline.

Common questions