Accounts Payable Checklist

Pull invoices from the dedicated ap@ mailbox, vendor portals (Schwab, Pershing, Orion, Salesforce), and any paper intake. Bill.com, Stampli, and AvidXchange auto-ingest from the inbox; confirm the day's queue is empty before moving on.

Match invoice to the purchase order and the receiver / service confirmation. PO-exempt invoices (custodian fees, recurring software, utilities) follow the standing-approval list — flag anything off the list for the controller.

Search vendor + invoice number in NetSuite or QuickBooks. Common duplicates: vendor resends after late payment, statement entries booked alongside the original invoice, copies forwarded by multiple business owners.

Look up the payee in the vendor master. New vendors must clear onboarding (W-9, OFAC, banking verification) before any payment is released. Inactive vendors require controller reactivation.

Apply the GL account and cost center per the chart of accounts. Capitalized vs. expensed software, advisor-attributable expenses, and cross-entity allocations are the recurring miscoding risks — check the prior period's coding for the same vendor when in doubt.

Domestic vendors return Form W-9; foreign vendors return W-8BEN or W-8BEN-E. No payment goes out before the form is on file — backup withholding and 1099 misreporting both trace back to skipped W-9 collection at onboarding.

Screen the vendor legal name and any beneficial owner against the OFAC SDN list using Bridger, World-Check, or the Treasury sanctions search. Save the screen result with date and operator. Potential matches go to the BSA officer before any payment is released.

Call the vendor at a number from a prior invoice or the published website — never the number in the email containing the banking instructions. Business email compromise targeting AP banking changes is the largest single-incident loss vector for finance ops; the call-back rule applies to every new vendor and every change to existing instructions.

On-site service vendors (cleaning, IT contractors, build-out) require general liability and workers' comp coverage on file before payment. Tech vendors processing client data require cyber liability with the contractually-required limits. Expired COIs block release.

Apply the delegation-of-authority matrix to set the approval tier. Aggregated invoices from one vendor in the same period are summed against the tier — splitting an invoice to dodge the next tier is the most-cited internal-audit finding.

Route via Bill.com or Stampli to the named cost-center owner. Owners get auto-reminders at 24 and 48 hours; anything stuck past 72 hours rolls to the controller for chase.

Invoices over $25K require CFO countersignature in addition to business-owner approval. Attach the contract or SOW reference so the CFO can verify the spend was authorized, not just incurred.

The audit trail must capture approver identity, timestamp, and the tier applied. SOC 2 and external-audit AP samples both pull on this — the trail lives with the invoice in the AP system, not in email.

Pull all approved, due-this-week invoices into the batch. Capture early-payment discounts (2/10 net 30) and exclude any disputed amounts. Run the batch totals against approved-invoice totals before treasury hand-off.

The preparer cannot release. The controller or CFO is the second pair of eyes on batch totals, payee list, and bank account selection. Dual control is the firm's most-tested internal control at the annual financial audit.

Release ACH and wires through the treasury portal; print and sign the check run. Capture the bank confirmation numbers in the AP system per payment so the reconciliation has a one-click trace.

Email remittance advice to the vendor's AP contact listing invoice numbers and amounts paid in the batch. Most vendor disputes are resolved by the remittance advice — without it, the next month brings a duplicate invoice.

Tie the AP subledger total to the GL 2000 control account at month-end. Common reconciling items: unposted journal entries, manual checks booked direct to GL, intercompany allocations not pushed through AP. Document each item with owner and clearing date.

Pull the aging from the AP system. Anything past 60 days is either a stuck approval, a vendor dispute, or a coding hold — name an owner and a clearing path for each line. Items past 90 days roll into the controller's escalation report.

Tag any 1099-eligible payments (services to non-corporate vendors, attorney fees regardless of entity, rent) so the year-end 1099-NEC and 1099-MISC runs are clean. Reclassifying twelve months of payments in late January is the avoidable failure mode.

Invoice, PO, approval trail, and payment confirmation all live together in the AP system for the firm's seven-year retention period. External audit, IRS exam, and SOC 2 evidence requests all pull from this folder — incomplete files are the most common audit finding.