An invoice approval process with clear evidence and limits

An invoice approval process should answer a few concrete questions: did the business expect this charge, is there evidence of what was supplied, are the details correct, and does the reviewer have authority to approve the next step? A forwarded email saying “looks fine” often leaves those questions unresolved.

For a small team, a useful process is a shared record with clear states, evidence, decision limits, and exception ownership. This guide focuses on supplier invoices received by the business. It separates administrative review from accounting treatment and payment authorisation, which should follow the business’s authorised arrangements and qualified advice where needed. The example and worksheet are hypothetical, and no accounting application is required to use them.

Define what approval actually authorises

Write down the meaning of each approval. Confirming that a service was delivered is different from approving its accounting treatment. Approving an invoice for processing is different from authorising a bank payment. If your team uses one word for all three, people may assume someone else checked a part that nobody owns.

List the decisions and the roles permitted to make them. The person who requested work can often confirm delivery. The budget owner can confirm the commercial scope within their limits. The bookkeeper can review the records and posting requirements. The payment authoriser follows the separate financial process. In a small business, one person may hold multiple roles, but the checks should remain explicit.

Define which cases require an additional review: a new supplier, an unplanned commitment, a material discrepancy, an unusual currency, or changed payment details. Set limits appropriate to your business rather than copying someone else’s amount thresholds. The purchase request process guide helps establish evidence before the invoice arrives.

Create one intake route and a stable reference

Give staff a clear way to submit invoices into the process, even if suppliers use several delivery channels. A common intake address or internal upload route can feed one controlled register. The aim is to avoid parallel approval threads where different people work on separate copies without knowing it.

Assign an internal reference and preserve the original source. Record the supplier, supplier document reference, received date, stated due date, currency, amount, related purchase or project, and current owner. Use your bookkeeper’s definitions for financial fields. Keep incomplete or suspicious documents visible as exceptions rather than forcing them into ordinary processing.

Check for an existing case before creating another. Similar names or matching amounts are useful clues, but they are not a complete duplicate decision. A recurring supplier may legitimately issue identical amounts each month. The register should help a person investigate rather than automatically treating every repeated amount as an invalid charge.

Specify the evidence required for review

Define a proportionate evidence pack. For an expected purchase, it may include the approved request, the supplier’s invoice, and evidence that the goods or services were received. Some work has milestone acceptance rather than a delivery note. Choose evidence that actually supports the commercial question.

Do not ask reviewers to approve an unstructured folder containing every project document. Present the relevant evidence and make missing items obvious. A concise packet improves the chance that review time is spent on the actual decision, rather than searching for records.

Give the register meaningful states

Use states that describe what remains to be done: received, evidence incomplete, awaiting commercial review, disputed, approved for processing, awaiting payment authorisation, payment pending, and payment confirmed. Your business may need fewer states, but each should have a clear owner and next action.

Keep rejected, duplicate, and superseded cases distinguishable from paid cases. A closed case is not necessarily a completed payment. If an invoice is replaced, link the replacement and preserve the explanation so someone investigating later understands why two similar documents exist.

Xero’s official bill entry and approval documentation illustrates distinct draft and approval handling and warns about potential duplicates in its product. Those product states are an example, not a required system. Define your operating states first, then map them to whichever first-party register or accounting arrangement your business actually uses.

Make approvals specific to the version and amount

Show the approver the supplier, source document version, currency, amount, scope reference, and any unresolved issue. Record the person’s identity, decision, date, and relevant authority. “Approved” without these details may be difficult to interpret when a corrected invoice arrives later.

If the amount, supplier, scope, or payment instructions change, do not assume an earlier approval still applies. Decide which changes require a fresh decision and enforce that rule. A person should not approve one amount and discover that a different version moved into payment processing.

Use explicit outcomes: approve for the defined next step, request information, dispute a particular item, reject, or refer to another authorised owner. Add a reason for exceptions. This creates useful evidence and reduces repeated questions about whether a reviewer is still considering a case or has returned it for action.

Keep bank detail changes on a separate route

An invoice or email requesting a new bank account should not update the supplier master automatically. Use the business’s independent verification procedure and an authorised reviewer. The person confirming delivery may have no basis for validating where money should be sent.

The FBI’s Business Email Compromise guidance advises verifying changes in account numbers or payment procedures and checking requests through independently established contact details. This is fraud-prevention guidance, not a statement of one country’s payment law. Your business should define a verification process suited to its circumstances and financial providers.

Keep sensitive bank details out of broad approval notifications. A notification can identify the case and state that verification is pending, while authorised people access the restricted record. Do not ask staff to paste account credentials, passwords, or full financial details into an ordinary team conversation as evidence of a check.

Work through a hypothetical service invoice

Imagine a small marketing business receives an invoice for a photography project. The agreed scope covers one shoot and a specified set of edited images. The supplier invoice also includes an extra editing charge. The delivery owner confirms that the original images were received, but no one can find approval for the additional work.

The invoice enters the register as received, with the original file and project reference. The commercial review identifies the extra charge and marks the case disputed rather than approved. The record states which item is in question and assigns the project owner to compare the supplier’s request with the project’s change records.

The owner finds an email discussing an option but no confirmed acceptance. They contact the supplier through the established business process to clarify the charge. The invoice remains visible, and the team records its next review date. It does not change the supplier’s document or silently remove the item to make the total match expectations.

If the parties agree a correction, the replacement document is linked to the original and reviewed under the business’s accounting procedure. Payment authorisation remains a separate step. The hypothetical case shows why evidence of delivery does not resolve every commercial question, and why a due date should not erase an unresolved discrepancy.

Handle partial delivery and partial disputes carefully

An invoice may cover work that is only partly delivered, or the business may agree with some items and dispute others. Give the case an owner who can identify the relevant portions and seek the appropriate commercial and accounting decision. Avoid a binary process that forces staff to label the entire invoice either correct or invalid.

Record what is agreed, what remains in question, and who may decide the next step. Any partial payment, credit, or revised invoice should follow the authorised arrangement and applicable advice. An administrator should not invent an adjustment method or assume a supplier will interpret an unexplained short payment correctly.

The client billing dispute guide addresses the corresponding process when your own customer questions an invoice. Both sides benefit from precise issue descriptions and a clear distinction between communication, commercial agreement, and accounting records.

Establish absence coverage and escalation

Identify a backup for every approval role and confirm that the backup has appropriate authority and access. A holiday should not cause cases to disappear into someone’s private inbox. Transfer the case through the shared register so staff can see who now owns the decision.

Use internal review targets that leave time for unresolved questions before the stated due date. The targets are operating choices, not an assertion that all suppliers or jurisdictions permit the same payment timeline. Escalate missing evidence or unavailable approvers to a named owner, rather than treating silence as permission.

Avoid repeated reminders to every participant. Notify the current owner about a specific next action and show the relevant evidence gap. If the same approval frequently waits for the same person, review the authority design or workload. The problem may be a missing decision limit rather than insufficient reminder frequency.

Automate coordination before financial decisions

Rules can assign internal references, check required fields, flag potential duplicates, route a packet, and remind the current owner. They can also prevent movement while a required decision is missing. These are useful coordination tasks even when financial actions remain under existing authorised controls.

AI, if used at all, can propose field extraction or summarise a discrepancy for review. It should not become the authority for supplier identity, accounting treatment, changed bank details, or payment approval. The AI document extraction review guide describes how to separate proposed fields from record changes.

Test any automation with synthetic invoices and a non-actioning register first. Include duplicates, revised documents, missing evidence, changed amounts, absent approvers, and an interrupted processing step. Verify that a technical retry cannot create a second payable record or bypass a disputed state. No supplier account connection is necessary to test the process design.

Review the process when one person holds several roles

Small teams cannot always assign a different employee to every check. Make that constraint visible instead of describing separation that does not exist. List the roles the owner performs and identify which exceptional cases require another authorised reviewer or adviser. A simple process honestly describing its limits is more useful than an impressive diagram nobody follows.

Use evidence and periodic review to support those limits. For example, the person processing ordinary expected invoices can retain the source and purchase reference, while a second authorised person reviews selected exceptions and changes to supplier details. The appropriate arrangement depends on the business’s circumstances; a worksheet cannot determine the right financial control for every organisation.

Keep urgent purchases visible. A verbal request during a service interruption may not have the same initial paperwork as planned work, but it should not disappear outside the record. Capture who requested it, what was authorised, why the ordinary route was unavailable, and which follow-up review is required. Do not create a false purchase approval dated before the work merely to make the file appear complete.

Include owner absence in a tabletop exercise. Use a synthetic invoice arriving while the usual reviewer is unavailable and ask the backup to follow the procedure. Can they find the evidence, understand their limit, and route a discrepancy? Can they distinguish approving a charge from authorising payment? If the answer is unclear, fix the procedure or authority arrangement before relying on reminders.

Review a small sample after the process starts. Choose ordinary cases and exceptions rather than only the easiest approvals. Ask whether each decision can be explained from the record and whether the required authority was present. The objective is to discover weak handoffs early, not to reward a high count of cases marked approved.

When a review reveals a gap, assign its repair to a named person. Updating an evidence requirement, correcting an owner, or clarifying a decision limit should have a visible completion date. Otherwise, the same gap can appear in every sample without changing the way invoices are actually handled.

Measure delay by its cause

Track time waiting for evidence, time awaiting a decision, active review time, duplicate candidates, disputed cases, and cases returned for missing information. Separate coordination delay from an intentional commercial hold. Otherwise, a dashboard may pressure staff to clear valid exceptions simply to improve an average.

Review a few completed cases end to end. Can someone see the original invoice, the relevant agreement, the decision, and the final processing state? Can they explain a correction without searching private messages? These checks reveal process quality that a count of approvals alone cannot show.

Start with one invoice category and a manageable set of synthetic cases. Write the approval meaning, required evidence, decision limits, and exception routes before building the notifications. The process is working when every case has a visible state and a responsible next owner, and when approval has a precise meaning the whole team understands.

Sources and editorial method

Primary sources checked on October 15, 2026: Xero Central: add and approve a bill and FBI: Business Email Compromise. The evidence matrix, hypothetical project, register states, and pilot are original operational analysis. Product documentation is cited factually, without affiliate promotion or a required subscription. Obtain appropriate accounting, contractual, and local advice for financial decisions.