Accounts Payable Policy: What It Is, What It Contains and How to Write One

Many businesses run their accounts payable function on conventions that have never been written down. The approval process works because the same two people have handled it for years. The payment authority limits exist in someone’s head. The duplicate payment controls depend on a team member who knows the vendor base by memory.

This works until it does not. A disputed payment with no documented authority. A fraud scheme that exploits an approval gap nobody knew existed. An auditor asking for written evidence of controls. All of these produce the same outcome: a costly problem that a well-written AP policy would have prevented.

This guide covers what an accounts payable policy is, why every organization needs a formal written version, what it should contain, how to write one, and how automation turns a written policy into a consistently enforced one. For the operational AP workflow, including invoice processing and payment scheduling, see our vendor invoice management guide and our vendor invoice processing checklist.

What Is an Accounts Payable Policy?

An accounts payable policy is the governance document that defines the rules and authority framework for the AP function. It specifies who has authority to approve vendor payments and at what amounts, what documentation is required before any payment is released, how disputes are handled, and what controls are in place to prevent errors and fraud.

It is the written authority that every member of the AP team, and every person who interacts with it, refers to when a question arises about what is permitted. Without it, decisions default to precedent or individual judgment, neither of which constitutes a control.

What Is the Difference Between an AP Policy and AP Procedures?

The policy and procedures serve different functions and are often maintained as separate documents, even when combined into a single manual:

An AP policy without procedures tells people the rules but not how to follow them. Procedures without a policy have no governance foundation. Both are necessary; they answer different questions.

Why Does Every Organization Need a Written Accounts Payable Policy?

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities, including written policies and procedures, as one of the five essential components of an effective internal control framework. In that context, an AP policy is not a bureaucratic formality. It is a documented internal control that management has put in place to ensure AP transactions are authorized, accurate, and compliant.

• Fraud prevention: An AP policy that establishes approval authority limits, segregation of duties, and dual-approval requirements for high-value payments creates structural barriers to fraud. Without a written policy, these controls exist informally and inconsistently, if at all.
• Regulatory and tax compliance: AP policies establish documentation requirements that support tax compliance (VAT documentation, withholding obligations, 1099 reporting), audit readiness, and financial reporting accuracy. A written policy creates an audit trail of intent as well as action.
• Consistency across teams and locations: A business with multiple AP team members, departments, or locations processes payments consistently only when the rules are written down and shared. Without a policy, different people apply different standards, and the variations compound into reconciliation problems and audit findings.
• Operational continuity: When staff change, the written policy preserves institutional knowledge about authority levels, required documentation, and approved vendor relationships. Without it, staff turnover creates control gaps that can take months to identify.
• Audit readiness: External auditors require evidence that controls exist and are followed. A written AP policy, regularly reviewed and signed off by appropriate authority, is primary evidence that the organization has designed its controls intentionally.

What Are the Core Components of an Accounts Payable Policy?

A complete AP policy addresses each of the following areas. The depth required in each section varies by organization size and complexity, but none of these components should be absent.

1. Purpose and Scope Defines why the policy exists, which transactions it covers, and which entities or departments it applies to. A clear scope statement prevents disputes about whether the policy applies in a given situation.

2. Roles and Responsibilities Identifies who is responsible for each element of AP: who receives invoices, who verifies them, who approves them, who processes payments, and who has oversight responsibility. Role clarity is the foundation of segregation of duties.

3. Approval Authority Matrix and Spending Limits Defines the dollar thresholds at which each level of authority can approve payments without additional sign-off. This is the single most important fraud control in an AP policy. For how digital workflows implement this matrix automatically, see our invoice approval workflow guide.

4. Invoice Acceptance and Rejection Criteria Specifies what a valid invoice must contain before it enters the AP process: vendor details, tax identification, PO reference number for PO-backed invoices, line-item descriptions, and payment terms. Invoices that do not meet these criteria are returned to the vendor rather than processed with missing information. For the matching process that applies once an invoice is accepted, see our three-way matching guide.

5. Payment Terms and Scheduling Documents the organization’s standard payment terms by vendor category, the policy for capturing early payment discounts, and the approval required to deviate from standard terms.

6. Write-Off Policy Defines the conditions under which AP balances can be written off, including approval thresholds and documentation requirements. Covered in depth in the section below.

7. Vendor Onboarding and Vendor Master Requirements Establishes the documentation required before a new vendor can be added to the approved list, who can authorize a new vendor addition, and how often vendor master records are reviewed for accuracy.

8. Segregation of Duties Specifies that no individual can both approve an invoice and process the corresponding payment, and that no individual can both set up a new vendor and approve the first payment to that vendor. These separations are foundational fraud prevention controls.

9. Dispute Resolution Documents the process for handling invoice disputes with vendors: who contacts the vendor, what documentation is maintained, and the timeline for resolution.

10. Record Retention Requirements Specifies how long AP records must be retained, in what format, and under what access controls. Retention periods are typically governed by tax authority requirements and should be confirmed with the organization’s legal and tax advisors.

11. Policy Review Cycle Documents when the policy will be reviewed, who is responsible for initiating the review, and who must approve changes. Without a defined review cycle, policies become outdated and cease to reflect actual controls.

What Should an Accounts Payable Write-Off Policy Include?

A write-off policy governs how the organization handles AP balances that cannot be resolved through normal processes. Without a written write-off policy, finance teams make ad-hoc decisions that may be inconsistent, undocumented, or incorrectly treated for accounting purposes.

A complete write-off policy should specify:

• The monetary threshold below which write-offs can be approved without escalation
• The approval level required for write-offs above the self-approval threshold, with different tiers for different amounts
• The documentation required for every write-off: the reason, vendor details, supporting documentation, and the GL account to which the write-off is posted
• The frequency at which unresolved small balances are reviewed and considered for write-off
• Whether aged credit balances owed by the organization from overpayments or unapplied credits require the same approval process

For managing vendor account balances and identifying unapplied credits before they require write-off, see our vendor reconciliation guide.

What Is an Approval Authority Matrix and Why Does It Belong in the AP Policy?

An approval authority matrix specifies exactly who can authorize payments at which dollar amounts. It is the formal translation of the organization’s financial authority structure into AP operational rules, and it is the single most important component for preventing payment fraud.

A typical structure has three to four tiers:

The matrix should also specify authority for exceptional situations: emergency purchases, payments to entities related to employees, and transactions in foreign currencies. When the authority matrix is encoded into an automated system rather than enforced manually, it becomes consistent regardless of who is available. For how automated approval workflows implement the authority matrix in practice, see our invoice approval workflow guide.

How Do You Write an Accounts Payable Policy? (Step by Step)

The steps below are for creating the policy document itself, not for implementing the AP operational process.

1. Document the current state and identify gaps. Map what currently exists: informal approval conventions, spending limits that exist in practice, vendor onboarding steps that happen without being documented. The gaps between what happens and what is formally required are where the policy needs to provide the clearest guidance.
2. Define scope and engage stakeholders. Confirm which entities, locations, and transaction types the policy will cover. Identify stakeholders who need to be consulted: Finance, Legal, Internal Audit, IT, and business units that regularly interact with AP.
3. Draft the approval authority matrix. This is the core of the policy and typically requires the most senior input. Confirm payment approval thresholds with the CFO and align them with the organization’s existing delegation of authority framework if one exists.
4. Write each policy section. Draft each component in order: purpose and scope, roles and responsibilities, approval matrix, invoice criteria, payment terms, write-off policy, vendor requirements, segregation of duties, disputes, record retention, and review cycle. Use plain, unambiguous language. Clarity is the goal, not formality for its own sake.
5. Review with Legal, Finance, and Internal Audit. Legal confirms compliance with applicable regulations. Finance confirms authority levels and accounting treatments. Internal Audit confirms the policy addresses the control risks they consider material.
6. Obtain executive sign-off and distribute. The policy should be formally approved by the CFO and distributed to everyone it applies to: the AP team, Finance, procurement, department heads, and approvers at every level in the authority matrix.
7. Establish the review cycle and assign ownership. Designate who is responsible for initiating the annual review. Document the next review date in the policy itself. Without a named owner and a scheduled date, policies drift into obsolescence.

How Often Should an Accounts Payable Policy Be Reviewed and Updated?

Annual review is the standard for most organizations and is sufficient when the business environment is stable. The review should compare the current policy against actual practice, any regulatory changes in the period, and any control weaknesses identified through audit or incident review.

Certain events should trigger an immediate out-of-cycle update:

• A regulatory change affecting payment obligations, tax documentation requirements, or data protection
• A fraud incident or near-miss that reveals a gap in the existing controls
• An organizational restructuring that changes approval authority or team responsibilities
• The implementation of new AP technology that changes how controls are enforced
• A merger, acquisition, or geographic expansion that brings new vendor relationships or regulatory jurisdictions into scope

When AP automation is implemented, the policy review is particularly important. The policy should be updated to reflect the controls the system now provides automatically (approval routing, duplicate detection, audit trails) and to retire manual controls the system has replaced.

How Does Automation Help Enforce an Accounts Payable Policy?

A written AP policy only prevents problems if it is followed consistently. In a manual environment, consistent enforcement depends on individual team members remembering the rules and applying them correctly under time pressure. Automation changes this: it encodes the policy into the workflow, making compliance the default rather than the exception.

• Approval authority matrix: When an invoice is submitted for approval, the system routes it to the correct approver based on the amount and category rules in the policy. The authority matrix is followed every time, not most of the time.
• Invoice acceptance criteria: The policy’s requirements for what a valid invoice must contain are validated automatically at intake. Invoices that do not meet the criteria are flagged or returned before they reach a human approver.
• Segregation of duties: Access controls prevent the person who enters an invoice from also being its final approver. Vendor master changes require a separate authorization step, enforcing the policy’s segregation requirements structurally.
• Duplicate payment prevention: Automated detection flags invoices that match an existing payment on vendor, amount, and invoice number, enforcing the policy’s fraud controls at point of entry.
• Record retention: Every invoice action, approval, and payment is timestamped and logged automatically, enforcing the policy’s record retention requirements with no additional effort and producing the documentary evidence that auditors require.

Serina’s AP automation platform encodes your AP policy into configurable approval workflows, matching rules, and vendor controls, so your team operates within the policy by default.

Talk to the Serina team about configuring controls for your policy requirements.

Bottomline

An accounts payable policy is not administrative overhead. It is documented evidence that your organization has thought about how payment decisions are made, who makes them, and what happens when something goes wrong. Without it, the AP function operates on precedent and individual judgment, which produces inconsistent outcomes and control gaps that grow over time.

Writing the policy is the first step. Keeping it current, distributing it actively, and enforcing it through systems rather than relying solely on individual discipline is what makes it effective. Automation does not replace the policy. It executes it, consistently, every time.

See how Serina helps enforce AP policy through automated controls.

Frequently Asked Questions

1. Who should own the accounts payable policy?

The AP policy is typically owned by the CFO or Controller, who has overall responsibility for financial controls. Day-to-day maintenance, including tracking required updates and coordinating the annual review, is usually delegated to the AP Manager or Finance Manager. However, changes to the approval authority matrix and segregation of duties provisions require CFO sign-off and should be reviewed by Internal Audit when material.

2. Does a small business need a formal written AP policy?

Yes, though the level of detail can be proportionate to the business size. A small business processing 50 invoices per month needs fewer approval tiers and simpler procedures than an enterprise processing thousands. But the core elements remain necessary regardless of size: defined payment authority, segregation of duties (even if limited), vendor verification requirements, and a clear record retention approach. The risk of fraud and error does not scale down with business size as much as most small business owners expect.

3. What is the difference between an AP policy and an expense reimbursement policy?

An AP policy governs payments to external vendors and suppliers: the invoices the business owes for goods and services received. An expense reimbursement policy governs payments to employees for out-of-pocket expenses they have incurred on behalf of the business. Both involve payment controls and approval authority, but they cover different payers and transaction types. Many organizations document them separately; some combine them into a broader Financial Payments Policy. The key is that both are documented and both are current.

4. What regulations affect an accounts payable policy?

The specific regulations depend on jurisdiction, industry, and business size. Commonly relevant frameworks include: tax authority requirements for vendor documentation and payment reporting (1099 in the US, VAT invoice requirements in the UK and EU); SOX (Sarbanes-Oxley) for US publicly listed companies, which requires documented internal controls over financial reporting; GDPR and similar data protection laws for the retention and handling of vendor personal data; and industry-specific requirements in healthcare, financial services, and government contracting. The policy should be reviewed by legal counsel for jurisdiction-specific requirements.

5. Can an AP policy be a short document?

There is no required length. What matters is that the policy addresses all the necessary components, uses clear and unambiguous language, and can be understood by everyone it applies to. For small organizations, a concise five to ten page document may cover everything adequately. For complex enterprises with multiple entities and regulatory jurisdictions, a comprehensive policy manual is appropriate. The test is completeness and clarity, not length.

6. Should the AP policy be shared with vendors?

Vendors do not typically receive the full internal AP policy, but they should receive the elements relevant to them: payment terms, invoice format and content requirements, submission methods, and the dispute resolution process. Many organizations communicate these through a vendor onboarding packet rather than sharing the full internal policy document. Clear vendor communication of invoice requirements reduces the exceptions and delays caused by non-compliant invoices.

7. What is the COSO framework and how does it relate to an AP policy?

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) published the Internal Control Integrated Framework, which is the most widely adopted standard for evaluating internal controls over financial reporting. COSO identifies five components of internal control: control environment, risk assessment, control activities, information and communication, and monitoring. An AP policy sits within the ‘control activities’ component: it is the documented policy through which management’s financial authority is translated into consistent AP operations. Auditors reference COSO when evaluating whether AP controls are adequate, which is why a policy that addresses the components described in this guide supports a strong internal control posture.