Accounts Payable Checklist 2026: Controls for Each Step

An accounts payable checklist is a control list: one line per step of the AP cycle, naming the control, the person who runs it and the record that proves it happened. The eight steps below run from vendor setup to month-end review. Fraud makes the list urgent: AFP's 2026 survey found that 76% of US organizations experienced attempted or actual payments fraud in 2025.

Toolradar data: we track 268 accounting tools, and 26% of them are free, freemium or open source, as of October 2026. A control works only when someone owns it, whether the tool is free or paid. That is why the table names an owner for each row.

The checklist at a glance

Use the table as the working list. Each row is one control, and the last column is the evidence you keep to prove it ran.

#	Step	Control to run	Owner	Evidence to keep
1	Vendor setup	Signed W-9 before the first payment; bank details confirmed by a call to a number already on file	AP manager	W-9 on file, callback log
2	Invoice intake	Every invoice logged on arrival; duplicates rejected by vendor, invoice number and amount	AP clerk	Intake log with dates, duplicate report
3	Matching	Three-way match (purchase order, receipt, invoice) inside a written tolerance	AP clerk	Match result per invoice, exception log
4	Coding	Each invoice coded to an account, department and project from the chart of accounts	AP clerk, reviewed by controller	Coding review sign-off
5	Approval	Approver set by budget owner and amount in a written matrix; no one approves their own spend	Budget owner	Approval timestamp linked to the invoice
6	Payment run	Payment file checked against approved invoices; edits after approval blocked; second release above a limit	Treasury or controller	Payment run report, release log
7	Reconciliation	AP subledger tied to the general ledger control account and to bank clearing each month	Accounting manager	Signed reconciliation, open-items list
8	Month-end review	Goods and services received but not invoiced accrued; aging and vendor statements reviewed	Controller	Accrual schedule, aging report, statement tie-out

Why AP controls are a fraud question now

Two of the largest AP risks look like routine work. One is a payment sent to a changed bank account. The other is a fake invoice from a familiar sender. AFP's survey, fielded in January 2026 with 465 treasury practitioners and published April 14, 2026, found that 74% of organizations experienced business email compromise in 2025.

So the checklist puts its strictest controls on vendor bank details (step 1) and invoice intake (step 2). The rest of the list proves that every approval and payment matched what was authorized.

1. Vendor setup and bank details

A payment to the wrong bank account is the hardest AP error to undo, so vendor setup gets the strictest controls. Set them up before the first invoice arrives, not after it.

• Collect a signed W-9 before the first payment. It holds the legal name and tax ID you need for 1099 reporting.
• Search for an existing record by tax ID and legal name before you create a new vendor.
• Confirm bank details by phoning a number already on file. Never use the number or email address in the request.
• Limit vendor creation and bank changes to named people, and keep the person who creates a vendor out of approving that vendor's invoices.

The reporting rule also changed. The IRS instructions say the threshold for Forms 1099-NEC and 1099-MISC is $2,000 for tax years beginning after 2025, up from $600, and that the amount may be adjusted for inflation starting in 2027. Payments to attorneys reported as gross proceeds keep the $600 threshold. Record each vendor's 1099 status at setup, so the answer is ready in January and not rebuilt from old invoices.

2. Invoice intake

Every invoice should enter the system on the day it arrives, through one intake route, and leave a record that cannot be quietly edited.

• Route all supplier invoices to one shared inbox or portal. An invoice that reaches an approver by private email leaves no audit trail.
• Run the duplicate check at intake, on vendor, invoice number and amount. A duplicate caught here costs a minute. A duplicate that gets paid means asking a supplier for the money back.
• Send any invoice that arrives with new bank details back to step 1 instead of processing it.
• Reject invoices addressed to the wrong legal entity or sent by a vendor with no record. Ask the vendor to resubmit through your intake route.

For how intake fits the wider AP workflow, what AP automation does walks through the full cycle.

3. Matching

Match each invoice to its purchase order and to the receiving record before anyone approves it, and put the allowed differences in writing.

• Three-way matching compares the purchase order, the goods receipt or service confirmation, and the invoice. It fits purchases where something has to be received.
• Many teams use two-way matching (purchase order to invoice) for services that produce no receipt. Write that exception into the policy so it is not decided invoice by invoice.
• Set price and quantity tolerances on paper. A tolerance nobody wrote down turns every mismatch into an argument.
• Send each mismatch to the buyer who raised the purchase order, with a deadline, and log the outcome against the invoice.

4. Coding

Code each invoice to a ledger account, department and project before approval, so the approver sees what they are signing off.

• Choose accounts only from the chart of accounts. Free-text coding is where spend disappears from reports.
• Route invoices with unusual codes, such as a suspense account or an account used once, to the controller for review.
• Flag capital purchases for the fixed asset decision at intake, not at year end.
• Count the coding exceptions each month. A rising count is an early sign that the chart of accounts or the buyers have drifted.

5. Approval

Approval is the control many teams already have, and the one that fails quietly, because the approver signs without seeing the match or the coding.

• Publish an approval matrix that says who approves which department's spend, up to which amount. Keep it with the policy, not in someone's memory.
• The approver is the budget owner or a named delegate. No one approves an invoice for a purchase they raised.
• Approve inside the system, so the approver's name and the time attach to the invoice record.
• Give every delegation an end date and review the delegation list each quarter.

6. Payment run

The payment run is the step where cash leaves, so it needs the cleanest separation of duties in the whole process.

• Pay only invoices with a completed approval. The run file should match the approval report line for line.
• Lock the payment file after approval. Any change to the amount, vendor or bank account sends that item back to approval.
• Require a second person to release payments above a limit you set. The person who built the run does not release it.
• Never accept a change to a payee's payment method by email. It goes back to step 1.
• Tie the bank confirmation total to the run total before you close the run.

If you automate this step, check each tool's approval and release settings against this list before you sign. The AP automation pricing comparison shows what the main options cost at one volume, and the Ramp and BILL profiles on Toolradar are a starting point for the feature check. The fee schedules are in Ramp pricing and BILL pricing, and the head-to-head is in Ramp vs BILL.

7. Reconciliation

Reconciliation proves that the AP ledger and the bank agree, and auditors test exactly that.

• Tie the AP subledger total to the general ledger control account every month.
• Match every outgoing payment to the bank statement, or to an open item with a named owner.
• Clear unmatched payments inside the month. A payment still unexplained at quarter end becomes a close problem.
• Scan for duplicate payments: same vendor and amount inside a short window.

A reconciliation is only as good as its sign-off. Sign and date it, and file the open-items list with it. If reconciliation runs inside a close tool, compare the options in FloQast vs BlackLine before you choose one.

8. Month-end review

Month-end is where unrecorded bills hide, so the checklist ends with accruals and aging.

• Accrue goods and services received but not yet invoiced, using the receiving log as the source.
• Review aging weekly during close. Anything past due is either disputed or missed, and each item needs a named owner.
• Request statements from your largest suppliers and reconcile them to your ledger.
• Sign the review. The signature date is the evidence that it happened in the period.

Who should not hold two steps

Segregation of duties is the rule the rest of the list depends on. The person who creates or changes a vendor, approves invoices and releases payments should be three different people. Small teams often cannot manage that. When one person holds two of those steps, the controller should review that person's vendor changes and payment runs every month, and write the review down.

What software changes, and what it does not

Software enforces matching, approval and release rules on every invoice, and it keeps the audit trail without anyone remembering to file it. It does not choose your tolerances, approval limits or owners. Those are policy decisions, and this checklist is where they get written down.

For the cost side of the choice, read the AP automation pricing comparison. For the tools behind the approval step, see the best AP automation software guide and the Stampli review. Teams that also weigh Tipalti can start with the Tipalti review and the Tipalti alternatives guide.

Frequently asked questions

What should an accounts payable checklist include?

At minimum, one control for each step of the AP cycle: vendor setup, invoice intake, matching, coding, approval, payment, reconciliation and month-end review. Each control needs a named owner and a record that proves it ran, because that record is what auditors test.

How often should AP controls be reviewed?

Run the invoice-level checks on every invoice and every payment run. Reconcile monthly, and review the approval matrix, the delegations and the vendor change log each quarter. An annual review misses delegations that expired months earlier.

Do I need three-way matching for every invoice?

No. Three-way matching fits purchases where something is received. Services that produce no receipt often use two-way matching, purchase order to invoice. Write the rule into the policy so exceptions are not decided one at a time.

Does the 1099 threshold change affect the AP checklist?

It affects the vendor setup step. The IRS says the threshold for Forms 1099-NEC and 1099-MISC is $2,000 for tax years beginning after 2025, up from $600, and attorney gross proceeds stay at $600. Collect a W-9 when the vendor is created, so the reporting status is set once rather than reconstructed at year end.

Which fraud risk should AP guard against first?

Guard first against a change to a payee's bank details, requested by someone pretending to be the vendor. AFP's 2026 survey found that 74% of organizations experienced business email compromise in 2025. A call to a number already on file, made before the first payment to a new account, is the control that catches it.

Can AP software run this checklist for us?

It can enforce matching, approval and release rules on every invoice, and it keeps the audit trail. It cannot set your tolerances, approval limits or owners, because a person has to decide those. Start with the AP automation pricing comparison to see what the main options cost.

How this checklist was built

The steps follow common accounts payable control practice and three sources checked in October 2026: the IRS instructions for Forms 1099-NEC and 1099-MISC, the 2026 AFP Payments Fraud and Control Survey, and the accounting category on Toolradar, which currently evaluates 268 tools. We did not test any product. The steps describe control design. Your company sets its own tolerances, limits and owners. This page is general information, not personalized financial advice or tax advice.

Cite this: CFOpresso, "Accounts Payable Checklist 2026," October 2026.

Some offers on this page may be paid placements or contain affiliate links.