How to Set Up an Invoice Approval Workflow

What is an invoice approval workflow?

An invoice approval workflow is the fixed route every supplier invoice takes before it is paid: it is entered once, checked against the order and what arrived, sent to the person allowed to approve that amount, and paid only after that person says yes, with a record of each step. If you keep the books or run accounts payable, the workflow is what lets you show that every payment was approved by someone entitled to approve it. It is the approval step of the wider procure-to-pay process, which runs from the purchase request to the payment. The parts that matter most are the approval limits, the amount each person may approve, and a regular look at the invoices that found a way around them.

What are the steps in an invoice approval process?

There are six, and each one leaves a trace you can point to later.

1. Receive it in one place. Every invoice arrives at one inbox or folder and is entered once, so none is paid from an email someone forwarded.
2. Check it against the order and the receipt. The quantity matches what you ordered or received, and the price matches what you agreed; checking supplier invoices against agreed prices covers that comparison line by line.
3. Code it. It gets an account and the name of the person whose budget it falls in.
4. Route it by amount and type. It goes to the person whose limit covers its total and whose area of spending it belongs to.
5. Approve it on the record. The approver says yes in the accounting system or in writing, and the approval carries their name and the date.
6. Pay only what was approved. The person who releases the payment checks that the approval exists and that they did not give it themselves.

The GAO’s Standards for Internal Control in the Federal Government, written for federal agencies but a clear statement of ideas any organization can use, says transactions should be authorized only by people acting within the scope of their authority, and that management should communicate those authorizations clearly. Steps four and five are how a small company does both.

How do you set approval limits in accounts payable?

You set a dollar ceiling for each approver, limit it to the kinds of spending they understand, and write it down where everyone who enters or pays an invoice can see it. A common shape for a company with a small office has three tiers: a manager approves routine purchases in their own area up to a modest amount, the person who runs finance approves anything up to a higher amount, and the owner approves everything above that. The amounts depend on your size, and a useful test is whether the owner would want to know about a payment of that size before it left the bank.

A few rules keep the limits meaningful:

• The limit applies to the purchase, not the invoice. One order billed on three invoices is approved as one total, or splitting it beats the limit.
• Scope matters as much as amount. An operations manager who approves parts for the vans should not approve the office’s software subscription, even when it is under their limit.
• Recurring invoices still need approval. Approve the agreement once with its yearly total, then check each invoice against it, rather than letting a monthly bill pass unseen.
• A change to a limit takes two people. A limit raised by the person who uses it is no limit.
• Review the limits once a year, and whenever someone joins, leaves or changes role.

Who should approve a supplier invoice?

The person who knows the goods or service was needed and arrived, usually the one whose budget it comes from, as long as they did not also enter the invoice or set up the supplier. The COSO Internal Control Integrated Framework’s executive summary names authorizations and approvals among the control activities a company relies on, and says segregation of duties is usually built into them, with other controls chosen where separation is not practical. In plain terms, three jobs should sit with three people wherever you can manage it: entering the invoice, approving it, and releasing the payment.

On a team of two or three that is not always possible, and the GAO standards say that where limited staff make segregation impractical, management designs other controls to cover the risk. The usual answer is for the owner to approve every payment to a new supplier and every invoice one person both entered and approved, and to read a short monthly list of approvals. Segregation of duties on a small finance team covers which pairs of duties to split first.

How do invoices get around approval limits?

Mostly in ordinary ways that nobody meant as a shortcut, which is why they are easy to miss. The ACFE’s 2026 Report to the Nations ranks billing schemes, where someone gets the company to pay a false, inflated or personal invoice, among the riskiest kinds of asset theft for how often they happen and how much they cost, and found them more common in smaller organizations than in larger ones. An approval limit is one of the controls standing in the way, so it is worth knowing how one gets bypassed:

• A split purchase: one order billed on two or more invoices, each under a limit and together over it.
• Approval outside scope: an invoice approved by someone whose limit covers the amount but not that kind of spending.
• Paid first, approved later: an “urgent” invoice paid before anyone approved it, with the approval added afterward or never.
• Self-approval: a person approving an invoice for a purchase they made, or one they entered.
• Just under the line: one supplier’s invoices landing just below an approver’s limit, month after month.

Worked example: a month of approvals at Ferrygate

Ferrygate Plumbing & Heating is an invented company, one of the Demo companies Ressura uses to show its checks, and every name and figure below is made up for the example. It is a plumbing and heating contractor with about forty staff and an office of five, and its written approval limits have three tiers. Tomas Reyes, the operations manager, may approve up to $2,500 for parts and fleet. Dana Whitlock, the office manager and bookkeeper, may approve up to $5,000 for anything, and Marcus Oyelaran, the owner, approves any amount. Priya Natarajan, the accounts payable clerk, enters every invoice and approves none.

In one month Ferrygate entered 64 supplier invoices. Tomas approved 38, all for parts and fleet and all under $2,500, Dana approved 17, each under $5,000, and Marcus approved the 9 above $5,000. On a first read, every invoice was approved by someone whose limit covered it.

Two of Dana’s 17 tell a different story. Pacific Tool & Equipment billed $4,640.00 on the 9th and $4,385.00 on the 12th, and both invoices quote the same order number, for a sewer jetter and its hose reels. Each was under Dana’s $5,000 limit, so each was routed to her and she approved it. Together they come to $9,025.00, one purchase above her limit, which under Ferrygate’s rules needed Marcus.

Nothing suggests anyone meant to hide it. The supplier shipped the jetter and the reels separately and billed each shipment, which is common practice. But the limit exists so that the owner sees a purchase of that size before it is paid, and here he did not. Dana sends both invoices to Marcus with the order, he approves the total, and his approval is filed with them. Ferrygate also adds one line to its written limits: invoices on the same order are approved as one total.

The line Dana takes to the owner for the month reads: 64 invoices approved, 62 within their limits, and two invoices for one $9,025.00 purchase, now approved by the owner.

How do you check that approvals stayed within the limits?

Once a month, list every approved invoice with its supplier, order number, amount, approver and approval date, and read the list against the written limits. Most accounting systems can export it as a report. Look for:

• an approver whose limit or area does not cover the invoice;
• two or more invoices from one supplier within a few days, or on one order, that together exceed the approver’s limit;
• invoices paid before their approval date, or with no approval at all;
• the same person entering and approving an invoice;
• one supplier’s invoices landing just below a limit again and again.

Keep the list with your initials and the date you reviewed it. That record is what you show the owner, and later an auditor, when they ask how you know every payment was approved by the right person.

What do you do when an invoice went around its limit?

You get it approved by the right person now, find out why it happened, and change the rule if the rule was the gap. Send the invoice and its order to the approver whose limit covers it, and file their approval with the original. Ask the supplier or the colleague why the invoice was split or paid early; usually the answer is shipping or urgency, and occasionally it is not. Record what you found, and if the same thing could happen again, write the fix into the limits, as Ferrygate did. Treat it as a gap in the process rather than an accusation, and the next one is more likely to be raised with you.

How can Ressura check your approvals?

Ressura’s Access & Segregation of Duties Module checks that no approval was given above the approver’s limit and that no limit was raised without a second person, and that no one both created and approved the same supplier invoice, payment or supplier record. It reads the user lists, roles and log of who did what from your finance systems; a user list and a log export are enough to start, and QuickBooks or Xero can bring them in. Fraud Watch, included with every subscription, points out two or more invoices that repeat or split one purchase, each small enough to pass without a second approval, and leaves the decision to you. Before an invoice reaches its approver, the Procure-to-Pay Module checks its prices, fees and quantities against your agreement, so the person approving it knows what they are saying yes to.

Sources

1. GAO’s Standards for Internal Control in the Federal Government
2. COSO Internal Control Integrated Framework’s executive summary
3. ACFE’s 2026 Report to the Nations