Accounts Payable Process: Steps, Flow Chart, and Internal Controls

The accounts payable process steps

Here is the full accounts payable cycle, step by step. The order is the point: each step unblocks the next, and payment is deliberately last.

STEP 1. RECEIVE AND CAPTURE THE INVOICE. The invoice arrives, by email, portal, or paper, and gets logged into your accounting system with its key fields: vendor, invoice number, date, amount, and line items. Two things matter here. First, capture the invoice number exactly, because it is your primary defense against paying the same invoice twice. Second, route every invoice to one intake point rather than to whichever employee the vendor happens to email, or invoices will sit in personal inboxes until they are late.

STEP 2. CODE AND CLASSIFY. Assign the invoice to the correct general ledger account, cost center, and, where relevant, the project or department that will bear the cost. This is what makes your financial statements mean anything: miscoded expenses quietly distort every budget report that follows. Confirm the vendor already exists in your system and that you are not about to create a duplicate vendor record, which is the most common mess in an AP file.

STEP 3. MATCH AGAINST THE PURCHASE ORDER AND RECEIPT. For anything bought on a purchase order, run the three-way match described below: the invoice, the PO, and the receiving record all have to agree on what was ordered, what arrived, and what is being billed. For low-value or PO-exempt spend, a two-way match against the PO or a documented approval is the proportionate version. This is the single most important control in the whole process.

STEP 4. ROUTE FOR APPROVAL. Send the coded, matched invoice to the person authorized to approve that spend level. The approval is not a formality; it is the point at which a named human confirms the goods or services were actually received and the amount is right. Set approval thresholds in writing so a $200 office supply order does not need the same three signatures as a $50,000 contract, and so the large ones genuinely get a second look.

STEP 5. SCHEDULE AND PAY, THEN RECONCILE. Schedule the payment to capture early-payment discounts where they beat your cost of cash and to avoid late fees otherwise. Release it through your verified payment method, record it against the invoice so the obligation is cleared, and reconcile the payment run against the bank statement. The invoice is only closed when it is paid, recorded, and reconciled, not when the check is cut.

That is the accounts payable process in five steps. Everything else on this page, the three-way match, the controls, the metrics, is about doing those five steps in a way that does not lose money.

• Capture: log every invoice at one intake point with the exact invoice number
• Code: assign the right GL account and cost center, and check for a duplicate vendor
• Match: three-way match against the purchase order and receiving record
• Approve: route to the authorized approver against written thresholds
• Pay and reconcile: schedule for discounts, pay by verified method, reconcile the run

The three-way match, explained

The three-way match is the control that stops you paying for things you did not order, did not receive, or were overcharged for. It compares three documents before an invoice is approved: the purchase order (what you agreed to buy and at what price), the receiving record or packing slip (what actually arrived), and the supplier invoice (what you are being asked to pay). When all three agree on quantity, price, and terms, the invoice is cleared for payment. When they do not, the invoice is held and the difference is investigated before any money moves.

A worked example makes it concrete. Your PO says 10 monitors at $180 each, so $1,800. The receiving record says 8 monitors arrived. The invoice bills for 10 at $180. The three-way match catches that you are being billed for two monitors you never received, and the invoice is held at $1,440 until the supplier ships the rest or issues a corrected invoice. Without the match, that $360 is simply paid, and it is found, if it is ever found, in a year-end review nobody enjoys.

Not every purchase needs a three-way match. Recurring services with no physical delivery, like a software subscription or a utility, have no receiving record to match against, so a two-way match of invoice to PO or to a documented approval is the right level. The judgment is to apply the full three-way match where goods are received and the dollars justify it, and a lighter check everywhere else, rather than forcing every $40 invoice through a control designed for a $40,000 one.

Accounts payable internal controls

Controls are what separate a process that pays the right amount to the right party from one that leaks money quietly. Four of them carry most of the weight for a US small or mid-sized business.

Segregation of duties. The person who sets up or changes a vendor should not also be the person who approves the payment, and neither should be the only person who reconciles the bank account. When one person controls the whole chain, a mistake has nothing to catch it and fraud has nothing to stop it. In a small office where the same person genuinely does most of AP, the compensating control is that a second named person, often the owner, reviews new vendors, bank detail changes, and the payment run.

Duplicate payment prevention. Duplicate payments happen when the same invoice arrives twice, once by email and once by mail, or when a vendor resends a "reminder" that is really the original bill again. Capturing the exact invoice number and having the system flag a repeat is the defense. Recovering a duplicate payment means asking a supplier to give money back, which they are not always quick to do.

Approval thresholds and authority limits. Write down who can approve what. Spend under a small limit can move on one approval; larger amounts require a second, and the largest require an officer. This is not bureaucracy for its own sake, it is what ensures the invoices big enough to matter actually get looked at by someone with the authority and the context to catch a problem.

Vendor bank detail verification. Treat any new or changed bank detail as a fraud risk until proven otherwise, and verify it by calling the vendor on a number you looked up yourself. That control has its own section below, because it is the one that stops the most expensive single failure in accounts payable.

The bank detail check that stops AP payment fraud

The most expensive thing that goes wrong in accounts payable is not a duplicate payment or a coding error, it is paying a criminal. Business email compromise aimed at AP follows a consistent script: an email that looks like it comes from a real supplier you genuinely owe says the banking details have changed and asks for the next payment to go to a new account. The email is well written, the invoice is real, and the account is a mule. The money goes out, and getting it back after it clears is difficult.

The scale is not hypothetical. In its 2024 Internet Crime Report, the FBI Internet Crime Complaint Center recorded $2.77 billion in business email compromise losses across 21,442 complaints, second only to investment fraud by total dollars lost, and nearly $8.5 billion in BEC losses over the three years from 2022 to 2024. A large share of that is exactly this scenario: a payment redirected inside an otherwise normal AP process.

The control is procedural and takes about four minutes. When bank details are supplied or changed, verify them by calling the vendor on a phone number you looked up independently, from the signed contract or the company's own website, never a number that appears in the email or the attachment. Note who confirmed it and when. Treat a change of details on an existing vendor as higher risk than the original setup, because that is what attackers actually target, and apply the check without exception to urgent requests, because manufactured urgency is the whole technique. This is the same discipline that belongs in vendor onboarding, and it is worth repeating every time the details move.

The tax paperwork the AP process has to carry

Accounts payable is where a company's 1099 obligations either get handled cleanly or turn into a January scramble, so the paperwork belongs in the process rather than bolted on at year end.

Collect a completed Form W-9 from every US vendor before the first payment, not after, because a vendor who has been paid has no reason to send it. If a vendor has not supplied a correct taxpayer identification number, the IRS requires backup withholding at 24 percent, meaning you are obliged to hold back and remit a quarter of the payment. The reporting threshold matters too, and it changed: for payments made in calendar year 2026, the Form 1099-NEC threshold is now $2,000 or more in nonemployee compensation, raised by the One Big Beautiful Bill Act from the $600 level that had stood since 1954, and inflation-adjusted after 2026. Most AP checklists still print $600, which is now out of date. Form 1099-NEC is due to the IRS and the recipient by January 31, and if you file 10 or more information returns in aggregate you must file electronically.

For foreign suppliers the form is different: a Form W-8BEN for a foreign individual or W-8BEN-E for a foreign entity, not a W-9. Which form applies to which vendor, and when each expires, is the subject of a fuller walkthrough in our guide to W-9 versus W-8BEN. The practical AP rule is to collect the right form at onboarding, file it against the vendor record, and diary the W-8 for re-collection before it lapses.

Accounts payable metrics worth tracking

You cannot tell whether an AP process is healthy from how busy it feels. A few metrics tell you the truth, and they are worth pulling monthly.

Days payable outstanding, the average number of days you take to pay suppliers, tells you whether you are using your payment terms as intended or paying too early and starving your own cash, or too late and burning goodwill. Invoice processing time, from receipt to approval, tells you where the bottleneck is; if it is sitting at the approval step, the fix is a threshold change, not more effort. The rate of invoices paid on time protects your early-payment discounts and your supplier relationships. The rate of exceptions, invoices that fail the match or need a coding correction, tells you whether the upstream process, purchasing and receiving, is feeding AP clean data. And the count of duplicate or erroneous payments caught, versus paid, is the blunt measure of whether your controls are actually working.

The point of the metrics is not the dashboard, it is the decision each one drives. A rising exception rate means fix purchasing. A slipping on-time rate means fix the approval bottleneck. A single duplicate payment that got out means tighten the invoice-number check before the next one does.

Where the accounts payable process goes wrong

The failure modes are consistent across every AP function, and none of them are exotic.

• Invoices captured to personal inboxes instead of one intake point, so they surface late
• The exact invoice number not recorded, so duplicate bills get paid twice
• Bank details accepted by email without a callback: the one failure that costs real money
• Duplicate vendor records, so spend is invisible and payment terms are inconsistent
• One person setting up vendors, approving payments, and reconciling: no control catches a mistake
• W-9s chased in January instead of collected before the first payment
• Early-payment discounts missed because invoices sat unapproved past the discount window

Running accounts payable without it eating the week

Look at what the process above actually consists of. A small number of real decisions, is this vendor right, is this spend approved, does this exception need investigating, and a long tail of coordination: capturing invoices to one place, chasing the approver who has not responded, chasing the W-9 that did not come back, filing the invoice and the approval against the right record, and remembering that a discount window closes on Thursday. The decisions are the work. The coordination is what makes accounts payable feel like it never ends.

That coordination layer is what Officeagent runs, with a human approving every action. It captures invoices arriving by email into one filed, searchable place against the right vendor, turns each open invoice into a tracked task with one owner and a due date, chases the approvals and the missing paperwork that have not come back without anyone having to remember, and reads routine invoice data so it does not have to be keyed in by hand. It is not an invoice-matching engine or a payment platform, and it will not move money; it is the assistant that keeps the paper moving to the right desk so the people who own the decisions and the payment can make them on time.

It is worth connecting this to the documents that sit around it. A clean vendor onboarding is what makes the three-way match possible, because the match only works against a vendor record that is correct. A purchase order is the first leg of that match. And an expense report is what you get instead when someone bypasses AP and buys on a personal card, which is usually a sign the process was slow enough that people routed around it.