What breaks when one identity can create, approve, and pay invoices?

Why This Matters for Security Teams

When a single identity can create, approve, and pay invoices, the control problem is not just fraud detection. It is a failure of segregation of duties, and that failure turns the accounts payable workflow into a privilege concentration point. In identity-heavy environments, this is the same pattern NHIMG warns about in its Ultimate Guide to NHIs, where excessive privileges and weak offboarding make misuse hard to spot until damage is already done.

Security teams often assume finance controls are separate from identity governance, but the underlying issue is the same: one principal should not be able to originate, authorize, and release value without an independent checkpoint. NIST’s Cybersecurity Framework 2.0 reinforces the need for governance, access control, and continuous oversight, which applies just as much to business workflows as to technical systems. In practice, many teams discover this only after a duplicate payment, a forged vendor change, or an internal abuse case has already occurred, rather than through deliberate control design.

How It Works in Practice

The practical fix is to break the invoice lifecycle into distinct control points so no single identity can complete the full transaction alone. That usually means separating vendor creation, invoice approval, payment release, and exception handling across different roles, systems, or both. Where automation is involved, the machine identity should have only the narrowest permissions needed for its task, and those permissions should be time-bound and traceable.

This is consistent with NHIMG guidance on high-risk identity sprawl, especially where secrets and access are broadly distributed rather than centrally governed. The Top 10 NHI Issues and the 52 NHI Breaches Analysis show a common pattern: once an identity can both request and authorize downstream action, abuse becomes much harder to detect.

• Assign separate identities or roles for invoice creation, approval, and payment execution.
• Require an independent approver for vendor master changes and payment exceptions.
• Use least privilege and limit payment authority to specific thresholds and business contexts.
• Log each step with immutable audit trails so reviewers can reconstruct who did what and when.
• Review service accounts, API keys, and workflow automations as part of the same control design.

Current guidance suggests that a strong AP workflow should treat approvals as a control boundary, not as a formality. If the same identity can also alter vendor details, suppress alerts, or rerun a failed payment without review, then the control has merely shifted the risk into a different system. These controls tend to break down when invoice processing is highly customized across ERPs, shared service centers, and ad hoc automation because ownership and approval boundaries become inconsistent.

Common Variations and Edge Cases

Tighter invoice controls often increase operational friction, requiring organisations to balance fraud resistance against close-speed and exception handling. That tradeoff becomes visible in small finance teams, shared service environments, and emergency payment scenarios, where one person may be expected to manage multiple steps. Best practice is evolving, but there is no universal standard for allowing temporary override paths without weakening the segregation model.

One common exception is emergency business continuity. Even then, the override should be time-limited, explicitly approved, and reviewed after the fact. Another edge case is automation: bots that draft invoices, match purchase orders, or queue payments can be helpful, but they should not be able to self-approve or self-release funds. NHIMG’s Ultimate Guide to NHIs is clear that non-human identities require the same governance discipline as human users, especially when privileges are broad or poorly rotated.

For organisations that rely on upstream controls, the real question is whether a second identity genuinely has independent authority, or whether it is only a rubber stamp in a shared workflow. The answer matters most when vendor onboarding, invoice approval, and payment execution sit in one platform with weak review depth, because that is where “separation” often exists only on paper.

Related resources from NHI Mgmt Group

• When do NHI access reviews create more value than a one-time cleanup?
• Why do air-gapped deployments create identity governance risk?
• Why do personal laptops create more identity risk than company-issued devices?
• Why do inherited permissions create so much identity risk?