Accounts payable internal controls reveal a governance gap in payment risk

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Pathlock's blog post: Accounts payable internal controls reduce fraud, duplicate payments, and approval failures by separating obligation checks, data entry, and payment execution.

Why it matters: It matters because IAM and governance teams face the same structural risk when one identity, role, or workflow can request, approve, and execute without independent checks.

Context

Accounts payable controls are a governance problem as much as a finance problem. When the same process can create, validate, approve, and release a payment, the organisation loses the separation of duties that makes fraud and error easier to detect before money moves.

The article frames AP as a layered control system built around obligation-to-pay checks, data-entry accuracy, and payment authorisation. That structure is directly relevant to identity governance because it mirrors the need to separate request, approval, and execution across sensitive workflows.

The core message is that speed and control are in tension, and manual shortcuts widen exposure. That is a familiar pattern for IAM, PAM, and NHI programmes wherever operational pressure encourages exceptions to become normalised.

Key questions

Q: What breaks when accounts payable controls do not separate approval from payment execution?

A: When AP controls do not separate approval from execution, the same identity can create, validate, and release a transaction. That destroys independent review, increases the risk of ghost vendors and duplicate payments, and makes later audit work much harder because the control evidence no longer shows distinct decision points.

Q: Why do poor accounts payable controls increase fraud and payment error risk?

A: Poor AP controls increase risk because payment processes depend on independent verification of obligation, amount, and authority. If invoice validation, data entry, and release are not separated, errors can pass through unchecked and fraudulent changes can look legitimate long enough for funds to move.

Q: What are the signs that accounts payable governance is failing?

A: Warning signs include frequent invoice exceptions, duplicate payments, weak audit trails, rushed approvals, and vendor master changes that are not independently validated. When those signals appear together, the organisation is probably treating control steps as administrative friction instead of as evidence-bearing checkpoints.

Q: How should security teams implement segregation of duties in IAM workflows?

A: Start by mapping the high-risk actions that must never sit in one entitlement path, then enforce those conflicts at role design and provisioning time. Use a conflict matrix, automate checks in your IGA or IAM process, and require independent approval for elevated access. The goal is to block harmful combinations before they reach production.

Technical breakdown

Why three-way matching matters in payment governance

Three-way matching compares the purchase order, receiving evidence, and invoice before the payable is recorded. In control terms, it verifies that an obligation really exists and that the amount billed matches what was ordered and received. This reduces false payments, duplicate invoices, and vendor impersonation risk because the finance system does not rely on a single document or a single approver. The control is effective only when the inputs are independent and when exceptions are investigated rather than waived by habit.

Practical implication: require invoice approval to depend on independently verifiable receiving and purchasing records, not on the invoice alone.

Segregation of duties in accounts payable execution

Segregation of duties splits invoice entry, approval, and payment release across different people or control points. That matters because a person who can both create and approve a transaction can conceal manipulation, create ghost vendors, or process duplicate payments without a second set of eyes. The article also extends this logic to access controls, showing that roles, groups, and multifactor authentication should gate payment systems and bank portals. The technical point is simple: the control fails when one identity can carry the full transaction chain end to end.

Practical implication: separate payment preparation from payment authorisation and review privileged access to bank and AP systems as distinct entitlements.

Audit trails and automation as control evidence

Audit trails convert payment activity into evidence by recording who approved, who posted, and when each step happened. Automation strengthens that evidence when it enforces workflow sequence, captures exceptions, and reduces manual re-entry that can introduce errors. In the article’s framing, digital trail quality matters as much as transaction speed because investigators and auditors need to reconstruct how a payment was authorised. Automation does not replace governance, but it makes the control surface visible and reviewable in a way paper-based handling rarely does.

Practical implication: preserve immutable approval logs and exception records so every payment decision can be reconstructed during audit or dispute resolution.

Threat narrative

Attacker objective: The objective is to move money to an unauthorised destination or under false pretences while avoiding detection long enough for the payment to clear.

1. Entry occurs when an invoice, vendor change request, or payment instruction enters AP without independent validation of the obligation to pay.
2. Credential or authority abuse follows when one person or one workflow can enter data, approve it, and release funds without separation of duties.
3. Impact appears as duplicate payments, overpayments, vendor impersonation, or unauthorised disbursement that weakens financial integrity and supplier trust.

Breaches seen in the wild

• Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Payment governance fails when request, approval, and execution are treated as one workflow. Pathlock’s article shows that AP risk is not primarily about payment speed, but about whether the organisation can prove each step independently. When obligation checking, data entry, and release authority collapse into a single operational path, the control model becomes too weak to distinguish valid payments from manipulated ones. That same governance pattern is the one IAM teams must avoid in privileged and transactional workflows.

Accounts payable is a useful analogue for identity governance because authority without separation becomes a fraud control problem. The article’s emphasis on segregation of duties, dual authorisation, and access restriction reflects the same structural logic behind least privilege and PAM governance. If an identity can both create and finalise an action, review becomes ceremonial rather than preventive. Practitioners should treat AP as a reminder that controls protect the process only when no single actor owns the full transaction.

Auditability is not a reporting layer added after the fact, it is part of the control itself. The article repeatedly links clean audit trails with accuracy, accountability, and compliance readiness, which is the right framing. In practice, a control that cannot show who acted, when they acted, and what evidence supported the action is already weakened. That principle generalises directly to NHI and human access governance, where proof of approval matters as much as the approval event.

Automation reduces manual error, but it also shifts where trust has to be enforced. Automated matching and workflow routing help reduce duplicate payments and human mistakes, yet they do not eliminate the need for authority checks, role boundaries, and exception handling. The named concept here is payment-chain separation: the idea that high-risk financial actions should be broken into independently governed stages. For practitioners, the lesson is to govern the chain, not just the tool that moves data through it.

What this signals

Payment-chain separation: The article shows that high-risk financial workflows fail when one person or one workflow can both validate and execute the transaction. IAM programmes face the same issue whenever approval and execution are collapsed into a single entitlement path.

AP automation improves visibility only when it preserves control evidence, not just transaction speed. For identity teams, the lesson is that workflow automation must still leave a durable trail of who authorised what, and on what basis, if governance is to remain defensible.

For practitioners

• Separate approval from execution Design AP and payment workflows so the person who prepares a transaction cannot also release it, and ensure exceptions require a different approver.
• Enforce role-based payment access Restrict bank portal and payment system access to explicitly approved roles, and review those roles whenever duties or vendor responsibilities change.
• Make three-way matching mandatory Require purchase order, receiving evidence, and invoice data to align before payment posting, with documented handling for mismatches and disputes.
• Protect payment change requests Validate vendor bank-detail changes through an out-of-band contact method tied to a pre-existing record, not the request message itself.
• Preserve complete audit evidence Store approval logs, exception notes, and payment histories in a format that lets auditors and finance leaders reconstruct each transaction end to end.

Key takeaways

• Accounts payable risk rises when obligation checks, data entry, and payment release are not independently controlled.
• The article links fraud, duplicate payments, and audit weakness to missing separation of duties and weak validation.
• IAM and PAM teams can apply the same lesson by separating authority, execution, and review in sensitive workflows.

Key terms

• Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.
• Three-Way Matching: Three-way matching is a verification control that compares the purchase order, the goods or services received, and the invoice before payment is released. It prevents mismatches and fraudulent billing by requiring independent evidence to align before a transaction moves forward.
• Audit Trail: An audit trail is a record of who accessed a system, what they did, and when they did it. For PHI environments, it provides the evidence needed to investigate incidents, support breach determinations, and demonstrate that access was attributable to a specific identity or workflow.
• Vendor Master Change: A vendor master change is an update to supplier information such as bank details, addresses, or payment instructions. Because these changes can redirect funds, they need independent verification and tighter approval than routine transaction updates, especially where impersonation or business email compromise is a risk.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.