Procure-to-Pay Controls: Vendor Creation to Payment Approval
Control vendor onboarding, purchase commitment, invoice checking, tax and payment without creating bureaucracy.
A payment can be perfectly approved and still be wrong if the vendor was fake, the bank account was changed by a compromised email or the goods were never received. Procure-to-pay control begins before the invoice reaches finance.
Most payment fraud begins with vendor or bank-detail changes.
Approval should happen before the purchase, not only before payment.
Purchase order, receipt/performance and invoice should agree.
GST, TDS and MSME status are part of vendor data, not year-end clean-up.
1. The operating framework
| Stage | Control | Exception requiring escalation |
|---|---|---|
| Vendor onboarding | Independent verification of legal name, PAN, GSTIN, Udyam status, bank and conflict declaration. | Bank/name mismatch, related party, personal account or incomplete tax data. |
| Purchase request/order | Budget and authority approval before commitment. | Retrospective PO, split orders or single-source purchase without rationale. |
| Receipt/performance | Goods receipt or service acceptance by business owner. | Invoice without evidence of delivery or milestone acceptance. |
| Invoice | Three-way match, duplicate detection, GST/TDS review. | Quantity/price variance, stale invoice, credit note pending or ITC mismatch. |
| Payment | Due-date selection, maker-checker and beneficiary verification. | Urgent override, changed beneficiary, weekend payment or manual bank upload. |
| After payment | Vendor statement and ledger reconciliation. | Old advances, debit balances or unadjusted credit notes. |
2. CFO playbook
- Separate vendor-master creation/change from invoice processing and payment approval.
- Confirm bank changes using a known phone number or independent channel, not the email requesting the change.
- Capture micro/small enterprise status and agreed payment terms; the MSMED Act can create interest exposure beyond the agreed period and statutory ceiling.
- Require purchase approval before commitment, with documented emergency exceptions.
- Use tolerance limits for three-way match and route variances to the business owner.
- Run duplicate-invoice checks across vendor, invoice number, amount, date and bank account.
- Reconcile GST input data and vendor statements before old differences become unrecoverable.
3. Practical example
A supplier emails new bank details two hours before payment. The invoice and approval are genuine, but the email account is compromised. A callback to the previously recorded number and dual approval of the vendor-master change prevent the loss.
4. Common failure points
- Allowing the same user to create vendor, post invoice and release payment.
- Using payment approval as substitute for purchase approval.
- Ignoring Udyam/MSME declarations and delayed-payment exposure.
- Paying against pro forma documents without advance controls.
- Not tracking blocked or time-barred GST credit.
5. Evidence folder
- Vendor onboarding file
- Conflict and related-party declaration
- PO/contract and budget approval
- Receipt or service-acceptance proof
- Invoice match and tax review
- Bank-change verification
- Payment and vendor-reconciliation file
6. Finin2min takeaway
Design the evidence before the transaction.
Reliable compliance is the result of clear ownership, timely action, reconciled records and a documented escalation route—not a last-minute filing exercise.