Accounts payable internal controls best practices are usually written assuming enough people to separate every incompatible duty, and a business with two people in finance cannot follow them as written. The honest response is not to abandon controls but to be clear about which ones carry the weight, which can be compensated for, and which gaps have to be stated and accepted by the owners. This page is written for that reality. It sets out the four controls that matter most at small scale, what each prevents, and the specific compensating arrangements that are recognised when separation is genuinely impossible.
The four that carry the weight
Approval by somebody other than the person entering the invoice. Matching to an order or a recorded commitment. A review of new suppliers and bank detail changes. And a review of the payment run before release. Between them they address unauthorised spend, fictitious invoices, diverted payments and error.
What each one prevents
Approval prevents spend nobody agreed to. Matching prevents paying for what was not received. Supplier review prevents payments to entities that should not exist. Payment run review is the last chance to notice anything the first three missed, which is why it is the one most worth keeping when time is short.
When you cannot segregate
State the gap, and put a compensating review in place with somebody outside the finance function, usually an owner or director. Record that it happened. The ACFE's material on how occupational fraud schemes work is a useful read for anyone deciding how much this matters in a small business.
Questions people ask about accounts payable internal controls best practices
What is the single most important control?
Somebody other than the person entering the invoice approving the spend. Everything else can be compressed; that separation is the difference between a process and an honour system.
Do controls have to be documented?
They have to operate. Documentation helps you demonstrate they operated consistently, which is what an auditor tests, so in practice a short written description earns its place.
Are automated controls better?
They are more consistent and they fail silently. A mixture, with a person reviewing what the automation did, is generally stronger than either alone.