Payment Run Approvals and Controls

A payment run is the process of selecting, reviewing, and releasing a batch of approved invoices for payment. It is the final control point in the accounts payable process — the moment where money actually leaves the organization. Every control weakness upstream becomes a financial loss at this stage.

Payment run controls exist to ensure that only approved, verified, non-duplicate invoices are paid, at the correct amounts, to the correct vendors, through the correct bank accounts. Without these controls, organizations are exposed to duplicate payments, unauthorized disbursements, and payment fraud.

Payment Run Workflow

A standard payment run follows this sequence:

1. Select eligible invoices — The system or AP team identifies invoices that are approved, matched, and due for payment based on payment terms.
2. Assemble the payment batch — Selected invoices are grouped into a batch with a total amount, vendor count, and payment method breakdown.
3. Apply prioritization rules — Invoices are prioritized by due date, early payment discount eligibility, vendor tier, or cash flow position.
4. Run pre-release checks — Automated checks scan for duplicates, verify vendor bank details, and flag anomalies.
5. Route batch for approval — The batch is sent to the authorized payment releaser for review.
6. Dual authorization — For batches above the defined threshold, a second authorized individual reviews and approves.
7. Release payment — The approved batch is transmitted to the bank for execution.
8. Record and reconcile — Payment records are posted to the ERP and the AP subledger is updated.

Each step is a control point. Skipping any step creates risk.

Approval Checkpoints

Payment batch approval is structurally different from invoice approval. Invoice approval verifies that a specific purchase is valid. Payment batch approval verifies that the collection of approved invoices is ready for disbursement — a broader review that catches issues individual invoice approvals may miss.

Who Reviews the Batch

The payment batch reviewer should be someone who did not process or approve the individual invoices. This is a critical segregation of duties requirement. Typically, the batch reviewer is:

• A treasury manager
• A senior finance leader
• The controller or CFO (for high-value batches)

Dollar-Based Approval Thresholds

Payment batch approval thresholds should be defined and enforced by the system:

These thresholds should be enforced by the system, not by policy. System enforcement means the batch cannot be released without the required number of approvals, regardless of urgency or seniority.

Rush Payment Handling

Payments outside the normal cycle — rush payments for critical vendors, one-time payments, or emergency disbursements — require additional scrutiny because they bypass the normal batch process.

Controls for rush payments:

• Require written justification for any payment outside the standard cycle
• Require approval one level above the normal authority for the amount
• Log all rush payments separately for monthly review
• Limit the individuals authorized to initiate rush payments

Fraud and Error Controls

Payment runs are the primary target for AP fraud because they are where money moves. These controls prevent the most common payment fraud schemes:

Pre-Release Duplicate Scan

The most cost-effective control in AP is scanning for duplicates before payment rather than recovering them after. An effective duplicate scan checks:

• Same vendor + same invoice number
• Same vendor + same amount + same date
• Same vendor + same amount within 30 days
• Same invoice number across different vendor records (catches vendor master duplicates)

Duplicates flagged by the scan should block the batch until reviewed and cleared. False positives are acceptable — they take seconds to clear. Missed duplicates cost $50 to $100 each to recover.

Release Governance

Release governance defines who can execute the final step — transmitting the payment to the bank — and under what conditions.

Separation of Batch Preparation and Batch Release

The person who assembles the payment batch should not be the person who releases it. This is a foundational segregation of duties control. The batch preparer selects invoices and assembles the batch. The batch releaser reviews and authorizes the disbursement.

Time-Based Release Windows

Some organizations restrict payment releases to specific days and times:

• Payments released only on scheduled payment days (e.g., Tuesday and Friday)
• No payment releases after 3 PM to allow bank processing within the same business day
• No payment releases on the last business day of the month without controller approval

Time-based controls prevent rushed, poorly reviewed payments and give the organization a predictable cash outflow schedule.

Emergency Payment Procedures

Despite best planning, emergencies happen — a critical vendor threatens to stop supply, a regulatory payment is due immediately, or a payroll-related payment cannot wait for the next batch.

Emergency payment procedures should:

• Be documented and accessible to all authorized personnel
• Require approval one level above normal authority
• Include a post-payment review within 24 hours
• Be logged and reported to the controller monthly
• Not become routine — if emergency payments exceed 5 percent of total payments, the normal schedule needs adjustment

Positive Pay and Payment Fraud Prevention

Positive pay is a bank-side control where the organization sends the bank a list of authorized checks or ACH payments. The bank only processes payments that match the list. Unmatched payments are held for review.

ACH Fraud Controls

ACH payments are increasingly targeted by fraud. Controls include:

• ACH debit blocks or filters that prevent unauthorized debits from the payment account
• Dual authorization for all ACH payment file transmissions
• Reconciliation of ACH payments within 24 hours of execution
• Separate bank accounts for high-volume AP payments to isolate fraud exposure

Wire Transfer Verification

Wire transfers are irreversible once executed. Controls for wire payments:

• Callback verification for any new or changed wire instructions
• Dual authorization for all wire transfers regardless of amount
• Same-day reconciliation of wire transfers
• Restriction of wire initiation authority to a small number of authorized individuals

Audit Evidence for Payment Runs

Every payment run should generate audit evidence that answers these questions:

What to Log

• Batch contents — Every invoice included in the batch with vendor name, invoice number, amount, and payment method
• Approver identities — Who approved the batch, with timestamp and authentication method
• Release confirmation — Who released the batch, when, and the transmission confirmation from the bank
• Pre-release check results — Duplicate scan results, vendor verification status, and any flags reviewed
• Exceptions and overrides — Any items that were flagged and cleared, with justification and approver

Retention Requirements

Payment records, approval logs, and supporting documentation should be retained according to your organization's retention policy — typically seven years for tax purposes and longer for government contracts.

Common Audit Findings

Auditors frequently cite these payment run control weaknesses:

• No evidence of pre-release duplicate scanning
• Same individual prepared and released payment batches
• Missing dual authorization for batches above threshold
• Rush payments without documented justification
• Bank detail changes processed without secondary approval

Each finding is preventable with the controls described in this guide.

How Automation Strengthens Payment Run Controls

AP automation makes payment run controls more reliable by enforcing them systematically:

• Automated batch assembly — The system selects eligible invoices based on approval status, match status, and payment terms, eliminating manual selection errors.
• System-enforced dual authorization — The system blocks batch release until the required number of approvals are recorded, regardless of urgency.
• Pre-release scanning — Duplicate detection, vendor verification, and variance checks run automatically before every batch.
• Complete audit trail — Every action from invoice receipt to payment release is logged with user, timestamp, and decision, generating audit evidence as a byproduct of normal processing.
• Exception visibility — Flagged items are tracked in the system with resolution status, ensuring nothing is quietly removed from a batch without documentation.

For organizations designing or improving their AP approval workflows, payment run controls should be part of the same design effort. The invoice approval workflow and the payment release workflow are two halves of the same control framework.

For foundational AP concepts, see what is accounts payable automation. For audit and compliance controls, see the audit compliance use case.