Most invoice problems are not accounting problems. They are routing problems. An invoice lands in a shared inbox, someone forwards it to a manager who is on leave, a reminder goes out three weeks later, and the vendor emails to ask why they have not been paid. The money was never in doubt. The path to approval was.
An invoice approval workflow fixes this by answering four questions in advance: who must approve this invoice, in what order, within how long, and what happens when something does not match. When those answers are written down and built into your tools, invoices move on their own and the exceptions stand out.
This guide covers how to design that workflow for a small or mid-sized operations team. It explains the steps, how to set approval thresholds, when to require a three-way match, how to handle exceptions, which fraud checks to keep, and how to measure whether the process is working. If you want to add AI on top of the workflow, our guide to AI invoice processing covers where it helps and where it does not. Get the workflow right first, because automation only speeds up whatever process you already have.
What an invoice approval workflow actually does
An invoice approval workflow is the set of steps an invoice passes through between arriving and being paid. A good one does three jobs at once.
- Control. It makes sure money only leaves for goods or services the business actually ordered and received, at the agreed price.
- Speed. It keeps invoices from sitting in someone's inbox, so vendors are paid on time and early payment discounts are not missed.
- Evidence. It leaves a record of who approved what and when, which is what an auditor, a lender or a new finance lead will ask for.
Notice that control and speed pull against each other. Every approval adds safety and delay. The art of the design is to add approvals only where the risk justifies them, and to remove them everywhere else. A five-dollar subscription does not need the same scrutiny as a five-figure contractor invoice.
The six steps of the workflow
Almost every working approval process, from a ten-person company to a large one, follows the same six steps. The tools differ, the order rarely does.
| Step | What happens | Typical owner |
|---|---|---|
| 1. Intake | Invoice arrives and is captured in one place | AP or finance ops |
| 2. Validation | Check the basics: vendor, invoice number, amount, tax, duplicate | AP |
| 3. Coding | Assign the cost category, department or project | AP, with the budget owner |
| 4. Approval | The right person confirms the spend is legitimate | Budget owner, then finance |
| 5. Payment | Schedule the payment on the agreed due date | Finance or treasury |
| 6. Record | Archive the invoice, approval trail and payment confirmation | AP |
Name an owner for every step. If you have not defined roles yet, a simple RACI matrix is the fastest way to stop two people each assuming the other one is handling it.
Step 1: One front door
The single most useful change most teams can make is to give invoices one place to arrive. Pick a dedicated address such as an accounts payable mailbox, tell every vendor to use it, and forward anything that arrives elsewhere. If invoices can arrive in five inboxes, you cannot measure how long approval takes, because you do not know when the clock started.
Capture the date received at this point. Every later metric depends on it.
Step 2: Validate before anyone approves
Approvers should never be the first line of error checking. Before an invoice goes to a budget owner, AP confirms the following.
- The vendor exists in your vendor list and is active.
- The invoice number has not been paid before. Duplicate invoices are one of the most common and most avoidable errors.
- The totals, tax and currency add up.
- The bank details match the ones on file for that vendor.
- The invoice references a purchase order, contract or request, where your process requires one.
This is also where rules beat judgement. Each of these checks has a clear yes or no answer, so they are good candidates to automate with plain rules. Our article on what to automate first explains how to decide which steps earn automation.
Step 3: Code the invoice
Coding means deciding which budget the cost belongs to. A good coding rule is boring and written down: for example, recurring software goes to the department that uses it, and shared services go to operations. Where a vendor always bills the same category, store the default on the vendor record so the invoice arrives pre-coded and the approver only confirms it.
Step 4: Approve in the right order
Approval is where most of the delay happens, so it needs the most design. The next two sections cover who should approve and how to set the limits.
Step 5 and 6: Pay and record
Pay on the due date, not the day the invoice is approved, unless a discount rewards paying early. Then store the invoice, the approval trail and the payment proof together. When someone asks six months later why a payment was made, you should be able to answer in one click.
Set approval thresholds by risk, not by habit
A threshold is a dollar amount above which an invoice needs an additional approver. The aim is to match the level of scrutiny to the level of risk.
The numbers below are examples to show the structure, not recommendations. Set yours from your own spend profile and risk appetite, and review them every year.
| Invoice amount | Approver | Why |
|---|---|---|
| Under a low limit, on a PO or contract | Auto-approve after matching | Low risk, high volume, little value in a human glance |
| Low to mid range | Budget owner | The person who ordered it knows whether it is right |
| Mid to high range | Budget owner and finance lead | A second set of eyes on larger commitments |
| Above a high limit | Budget owner, finance lead and executive | Material spend needs senior sign-off |
Three rules make thresholds work in practice.
- Approve against the budget owner, not the manager of the person who forwarded it. The person accountable for the budget is the only person who can judge whether the spend is right.
- Use total commitment, not the single invoice. If a vendor sends five invoices of just under the limit for one project, the thresholds should see the project total.
- Keep a separate rule for new vendors and changed bank details. These carry the highest fraud risk and deserve an extra check whatever the amount.
Delegation and absence
Every approver needs a named delegate. Without one, a holiday stalls every invoice they own. Most tools let you set a delegate by date range. If yours does not, put a simple rule in the SOP: if an invoice has been waiting more than two business days, it escalates to the approver's manager.
When to require a three-way match
A three-way match compares three documents before payment: the purchase order (what you ordered), the goods receipt or confirmation of service (what you got) and the invoice (what the vendor is charging). If the three agree within a set tolerance, the invoice is approved for payment without a human reading it.
It is powerful because it checks the thing approvers are bad at checking from memory, which is whether the price and quantity on the invoice are the ones that were agreed.
| Situation | Match type | Notes |
|---|---|---|
| Physical goods, repeat orders | Three-way | Receipt confirms the goods arrived |
| Services with a fixed scope | Two-way (PO and invoice) | A receipt adds little when the deliverable is hard to count |
| Subscriptions and recurring services | Contract or amount check | Compare to the agreed recurring price |
| Utilities, rent, taxes | No match, check against prior period | Flag any change beyond a set percentage |
Do not force a three-way match on every invoice. It requires purchase orders and receipts to exist, and creating them for low-value spend costs more than the risk it removes. Use it where the value and the volume justify the effort.
Set a tolerance
Real invoices rarely match to the cent. Freight, rounding and partial deliveries are normal. Agree a tolerance, such as a small percentage or fixed amount, within which a mismatch is accepted automatically. Anything outside the tolerance becomes an exception and goes to a person. A tolerance that is too tight floods the team with exceptions. One that is too loose lets errors through. Start tight, watch the exception volume for a month, then adjust.
Handle exceptions on purpose
Exceptions are where the process either proves itself or falls apart. Plan for the common ones.
| Exception | First action | Who resolves it |
|---|---|---|
| No purchase order where one is required | Ask the requester for the PO or approval | Budget owner |
| Price or quantity mismatch | Hold the invoice and contact the vendor | AP with the buyer |
| Duplicate invoice | Reject and notify the vendor | AP |
| Invoice from an unknown vendor | Stop and verify the vendor before anything else | AP with procurement |
| Missing or wrong tax details | Request a corrected invoice | AP |
| Approver does not respond | Remind, then escalate after a set time | AP, then approver's manager |
Give every exception a time limit and a visible owner. An invoice on hold with no owner is just a delayed invoice with an excuse. Our vendor onboarding SOP explains how a clean vendor setup prevents a large share of these exceptions before they start.
The fraud checks to keep, however fast you go
Speed is not an excuse to drop the checks that stop fraud. Invoice and payment fraud usually works through the process rather than around it: a convincing fake invoice, a vendor email that quietly changes the bank account, or an urgent request from someone pretending to be an executive.
The FBI has described business email compromise as a scam in which criminals use or imitate a trusted business contact to redirect payments, and its advice includes verifying any change in account number or payment procedures and being cautious when a request is urgent. Build those lessons into the workflow.
- Verify bank detail changes by calling a known number. Use the number already on file, never the one in the email that asked for the change.
- Separate duties. The person who creates or edits a vendor should not be the person who approves or releases payment to that vendor.
- Hold the first payment to any new vendor for an extra check.
- Treat urgency as a warning sign. A request that says pay today or skip the process should trigger more checking, not less.
- Block self-approval. No one approves their own expense or an invoice from a vendor they manage.
These controls cost a few minutes on a small fraction of invoices and protect against the losses that are hardest to recover. For automated steps that can pay out, also apply the guidance in our human-in-the-loop approvals article.
A workflow you can copy
Here is a plain template to adapt. Replace the bracketed items with your own values.
Invoice approval SOP
- All invoices go to [AP mailbox]. Anything received elsewhere is forwarded within one business day.
- AP logs the invoice and records the date received.
- AP validates vendor, invoice number, totals, tax and bank details. Duplicates and unknown vendors are stopped here.
- AP codes the invoice using the vendor default or the coding guide.
- The invoice is routed to the budget owner. Approval is due within [two] business days.
- Invoices above [limit] also go to [finance lead]. Invoices above [higher limit] also go to [executive].
- Where a PO exists, the system performs a three-way match within [tolerance]. Mismatches go to the exception queue.
- Approved invoices are scheduled for payment on the due date.
- AP archives the invoice, the approval trail and the payment confirmation together.
Write this as a one-page SOP with named owners, as described in our guide to writing an SOP people actually follow, and keep a version history so changes to thresholds are traceable. The SOP governance guide explains how.
Build it in the tools you already have
You do not need a dedicated AP platform to run this workflow. Most small teams can build it with what they own.
- Shared mailbox plus a tracker. A spreadsheet or Airtable base with columns for vendor, amount, date received, approver, status and due date. Filters show what is overdue.
- Form and automation. A form for intake, with an automation tool routing the invoice to the approver by amount and sending reminders. Compare options in our Zapier, Make and n8n guide.
- Accounting software. Many accounting packages include bill approval rules. If yours does, use that first, because the approval trail sits next to the payment.
Whichever you choose, test the whole path with a few real invoices before you switch over, and put monitoring on the routing so a broken connection does not silently stop invoices from reaching approvers.
Measure whether it is working
You cannot improve what you cannot see. Track a small set of measures from the date-received timestamp you captured at intake.
| Measure | What it tells you |
|---|---|
| Days from receipt to approval | Where invoices wait |
| Days from approval to payment | Whether you pay on time |
| Exception rate | Whether intake and matching rules are well tuned |
| Duplicate and error catches | Whether validation is earning its keep |
| Invoices paid late | The cost of delay, including missed discounts and vendor friction |
| Approvals waiting past the limit | Which approvers or thresholds need attention |
Review these monthly. A rising exception rate usually points at a vendor, a missing PO habit or a tolerance that is too tight. Long approval waits usually point at a missing delegate or a threshold that routes too much to too few people.
Common mistakes
- Routing everything to finance. Finance cannot judge whether a marketing agency invoice is right. The budget owner can.
- No single intake. Without one front door you cannot measure or enforce anything.
- Thresholds nobody reviews. A limit set years ago may now send everything to an executive or nothing at all.
- Treating the exceptions as one-offs. If the same exception happens weekly, fix the cause upstream.
- Letting speed erode the bank-change check. This is the control that most often saves real money.
- Automating a broken process. Fix the steps first. Automation then makes a good process faster instead of making a bad one fail faster.
Key takeaways
- An invoice approval workflow answers who approves, in what order, within how long and what happens on a mismatch.
- Use six steps: intake, validation, coding, approval, payment and record, with a named owner for each.
- Give invoices one front door and capture the received date so you can measure delay.
- Set approval thresholds by risk and route to the budget owner, using total commitment rather than single invoices.
- Use a three-way match where value and volume justify it, with a tolerance tuned to your exception volume.
- Plan exceptions with a time limit and a named owner.
- Keep the fraud checks: verify bank changes through a known number, separate duties, hold first payments and treat urgency as a warning.
- Measure days to approval, exception rate and late payments every month.
Start small this week: set up one intake address, write the one-page SOP and name a delegate for every approver. Those three changes remove most of the waiting.
A note on sources
This guide is written by the OpsGrit Research Desk from common finance operations practice. The thresholds and tolerances are examples, so set your own from your risk profile and check your obligations with your accountant. It does not cite outside statistics. If you spot something that looks wrong, tell us.
Further reading. The FBI page below is the source for the points above about verifying changes in account numbers and treating urgent requests with caution: