# Invoice approval workflow: how to stop paying invoices nobody approved

> How to build an invoice approval workflow with clear approvers, two-way and three-way match, duplicate checks, vendor setup and fraud controls, plus a template.

Published 2026-10-08 by Easyflow team. Category: Finance.

In most small companies, invoices arrive in a shared inbox, someone forwards them to "whoever bought this", and the bookkeeper pays whatever has a reply that says "ok". It works until an invoice is paid twice, a vendor is paid for work that was never delivered, or a bank account change turns out to be a scam.

The fix is not more people in accounts payable. It is a short, fixed path every invoice follows before money leaves the account.

> **Key takeaways**
>
> - Every invoice needs an owner who confirms it is real, matches what was ordered and was delivered.
> - Use a two-way match for services and small purchases, and a three-way match when there is a purchase order and a delivery.
> - Collect a W-9 and set up the vendor before the first payment, not at year end.
> - Never accept a change of bank details by email alone. Call the vendor at a number you already had.

This guide explains how to build an **invoice approval workflow** for a team of 10 to 300 people: who approves, how to match invoices, how to prevent duplicates and fraud, and how to organize payment runs. It touches on tax forms, so a standard note applies: this is practical guidance, not tax advice, and you should confirm the details with your accountant.

## What an invoice approval workflow is

An invoice approval workflow is the path a supplier invoice follows from "received" to "paid". It answers four questions:

1. **Is this invoice real?** The vendor exists in your records and the invoice is not a duplicate.
2. **Did we agree to buy this?** There is an approved purchase, contract or subscription behind it.
3. **Did we get it?** The goods arrived or the service was performed.
4. **Is it correct?** Quantities, prices, taxes and terms match what was agreed.

If your purchases are already approved before ordering (see our guide to the [purchase approval workflow](https://easy.wf/blog/purchase-approval-workflow)), invoice approval is mostly a check against that earlier decision. If they are not, the invoice approval is the only control you have, and it needs to be stricter.

## Who approves invoices

Split the work between two roles:

- **The budget owner** (the person who requested the purchase, or the department head) confirms the invoice is for something the team ordered and received, at the agreed price.
- **Accounts payable** (the bookkeeper, controller or office manager) checks the vendor, the math, the tax, the coding to the right account and the payment terms, and schedules the payment.

Larger invoices can need an extra approver by amount, the same way purchases do. Our guide to [approval limits by amount](https://easy.wf/blog/approval-matrix-approval-limits) explains how to set those tiers. One rule always applies: the person who approves an invoice should not be the person who sets up the vendor or releases the payment.

## Two-way vs three-way match

Matching is how accounts payable checks an invoice against what was agreed, without asking the budget owner to re-read every line.

| | Two-way match | Three-way match |
|---|---|---|
| Compares | Purchase order and invoice | Purchase order, receiving record and invoice |
| Confirms | You are billed what you agreed to | You are billed what you agreed to and what actually arrived |
| Best for | Services, subscriptions, small purchases | Physical goods, large orders, partial deliveries |
| Main risk it leaves | Paying for goods that never arrived | Slower when the receiving record is missing |

For services, there is no delivery slip, so the "receipt" is the budget owner confirming the work was done. That confirmation is the approval step.

When something does not match (a higher price, an extra line, a partial delivery), the invoice is held and goes back to the budget owner with the difference, instead of being paid and argued about later. Decide in advance how much difference you tolerate, such as a few dollars for shipping or rounding, so small variances do not stop the line.

## How to prevent duplicate invoice payments

Duplicates happen for boring reasons: a vendor sends the invoice by email and again by mail, a reminder is entered as a new invoice, or two people enter the same bill.

Controls that catch most of them:

- **One entry point.** Invoices come to one address or form, not to individual inboxes.
- **Check vendor plus invoice number** before entering an invoice. Same vendor and same number is a duplicate until proven otherwise.
- **Check vendor plus amount plus date** as a second pass, for vendors that reuse numbers or send statements.
- **Mark statements and reminders as such.** A "past due" reminder is not a new invoice.
- **Pay only from the approved invoice record**, never from an email attachment.

## Vendor setup before the first payment

A new vendor should go through a short setup before you pay them anything:

- Legal name, address and contact details
- **Form W-9** for US vendors. The IRS describes W-9 as the form a payee uses to give its correct taxpayer identification number (TIN) to the business that has to file an information return. You keep it in your records; you do not send it to the IRS.
- Bank details for ACH, confirmed through a known contact (more on this below)
- Payment terms agreed in writing
- Whether the vendor will need a Form 1099-NEC at year end

The 1099-NEC is used to report payments for services to people and businesses that are not your employees. Payments to corporations are generally not reported, with exceptions such as payments for legal services. The reporting threshold changed for payments made after 2025 and may be adjusted for inflation from 2027, so check the current IRS instructions for Forms 1099-MISC and 1099-NEC instead of relying on an old number. The form is due to both the IRS and the recipient by January 31.

Why before the first payment: if a payee does not provide a TIN, the IRS backup withholding rules can require you to withhold from payments (the W-9 instructions describe the rate as 24% of reportable payments). Chasing W-9s in January from vendors you paid in March is the year-end task everyone dreads.

## Payment terms and early payment discounts

Payment terms tell you the latest date you can pay without being late. **Net 30** means the full amount is due 30 days after the invoice date. Net 15 and Net 60 work the same way.

Some vendors offer a discount for paying early. **2/10 net 30** (an example) means you can take 2% off if you pay within 10 days, otherwise the full amount is due in 30. On a $10,000 invoice, paying by day 10 costs $9,800.

That 2% is worth more than it looks: you give up the $200 to keep $9,800 for 20 more days. Annualized, that works out to roughly 37% (2/98 times 365/20), so if you have the cash, early payment discounts are usually worth taking. The workflow matters here: an invoice that waits a week for approval misses the discount window.

## Payment runs

Paying invoices one at a time, whenever someone asks, is how mistakes and fraud slip through. Most small and mid-sized teams pay in **scheduled payment runs**, weekly or twice a month:

1. Accounts payable lists approved invoices due before the next run (plus any with a discount date in between).
2. A second person, usually the controller, CFO or owner, reviews the list and approves the run.
3. Payments go out by ACH or check, and each invoice is marked paid with the date and reference.

A fixed run also gives vendors a predictable answer to "when will we be paid?".

## Fraud red flags

Invoice fraud is rarely sophisticated. It relies on someone being in a hurry. Watch for:

- **Changed bank details**, especially by email and especially with urgency. This is the classic business email compromise pattern.
- **A new vendor with an invoice but no purchase** behind it, or a vendor nobody on the team recognizes.
- **Slight variations** in the vendor's email domain, name or address.
- **Pressure to skip the process**: "the CEO needs this paid today", "do not call, I am in a meeting".
- **Round amounts** or invoices just under an approval limit, repeated.

The single most important control: **verify any change of bank details by calling the vendor at a phone number you already had**, such as the one in your vendor record or on an earlier contract, never the number in the email asking for the change. The FBI's Internet Crime Complaint Center gives the same advice: confirm requests for transfers of funds by phone using previously known numbers, not the numbers provided in the email request, and add a second sign-off for changes in vendor payment details. Record who called, when, and who confirmed.

## An invoice approval workflow you can copy

| Step | Owner | What happens |
|---|---|---|
| 1. Receive | Accounts payable | Invoice arrives at one address or form, vendor and invoice number recorded, duplicate check |
| 2. Match | Accounts payable | Compare with the purchase order (two-way) and the receiving record (three-way) |
| 3. Approve | Budget owner | Confirm the goods or service were received and the amount is right, or send back with the difference |
| 4. Extra approval | Department head or CFO | Only above your amount threshold |
| 5. Schedule | Accounts payable | Account coding, due date, discount date, added to the next payment run |
| 6. Approve the run | Controller, CFO or owner | Reviews the list of payments before release |
| 7. Pay and record | Accounts payable | ACH or check sent, invoice marked paid with date and reference |

It is a straight line on purpose. Exceptions, such as a disputed line or a credit note, are handled by sending the invoice back with a comment, not by inventing new paths.

## Frequently asked questions

### Who should approve vendor invoices?

The budget owner who requested the purchase confirms it was received and correct, and accounts payable checks the vendor, math and terms. Add a senior approver above an amount threshold. Keep vendor setup, invoice approval and payment release with different people where you can.

### What is the difference between two-way and three-way matching?

A two-way match compares the invoice with the purchase order. A three-way match also compares it with the receiving record, so you only pay for what actually arrived. Three-way is the standard for physical goods, two-way is usually enough for services and subscriptions.

### How do I prevent paying the same invoice twice?

Receive invoices in one place, check vendor plus invoice number before entering any invoice, and pay only from approved invoice records. A second check on vendor, amount and date catches vendors that reuse invoice numbers.

### When should I collect a W-9 from a vendor?

Before the first payment. The W-9 gives you the vendor's taxpayer identification number, which you need for Form 1099-NEC reporting, and missing TINs can trigger backup withholding requirements.

## Running it in Easyflow

The **Invoice approval** process in the gallery follows this path: the invoice is registered with supplier, invoice number, amount, due date, purchase order and the file; whoever asked for the purchase confirms the delivery from the email (a confirmation page opens first, so mail scanners cannot approve); a finance approval step only appears above an amount; and payment is scheduled with its proof. You can turn the supplier into a list of your own vendors, or replace the single threshold with approval limits by amount. **Supplier onboarding** collects the W-9, bank details and a finance check before the first purchase, and **Supplier payment** handles the payment itself. Each step can have a due date with reminders, so invoices stop missing their discount window, and every invoice keeps a timeline of who approved what and when, exportable to CSV and PDF.

For reimbursements to your own team, the equivalent is the [expense report approval process](https://easy.wf/blog/expense-approval-process).

Page: https://easy.wf/blog/invoice-approval-workflow