# Procure-to-Pay and Expense Policy: [Entity name]

> Finance control policy for the payables side of the business: vendor
> master data, purchase orders and receipts, invoice processing and
> three-way match, payment runs, employee travel and expenses, and
> corporate cards. Control design follows the five components of
> internal control in the GAO Standards for Internal Control in the
> Federal Government (the Green Book, 2025 revision, GAO-25-107721,
> effective from fiscal year 2026), which mirror the COSO Internal
> Control framework, and can be used by private and public entities.
> Sourcing and supplier selection rules sit in the procurement policy.
> Replace every `[bracketed]` value and every row marked *Example*. This
> is a documentation format, not legal, tax or financial advice: check
> the current official text and a qualified professional.

<!--
Guidance: How to use this template
- Purpose: one set of rules that stops paying the wrong party, paying
  twice, paying for goods never received, or reimbursing personal
  spending, while keeping suppliers and employees paid on time.
- Scope boundary: what to buy and from whom (competition, tenders,
  contracts) is in the procurement policy (`procurement/procurement-policy`).
  This policy starts once a supplier is approved and a need is approved.
- Fill section 3 (authority thresholds) and the match tolerances in
  section 6 first, aligned with the Delegation of Authority Matrix
  (`finance/delegation-of-authority-matrix`).
- The worked example uses the fictional Fenmarsh Retail Group (UK and
  Ireland, GBP and EUR). Every number is recomputed and marked *Example*.
- Related templates: Purchase Requisition and PO (`procurement/purchase-requisition-po`),
  Fraud Risk Assessment (`compliance/fraud-risk-assessment`), Risk
  Control Matrix (`compliance/risk-control-matrix`), Month-End Close
  Checklist (`finance/month-end-close-checklist`), Account
  Reconciliation (`finance/account-reconciliation`), Treasury Policy
  (`finance/treasury-policy`).
-->

## Document control

<!-- Guidance: The policy owner is normally the financial controller or head of shared services. Record which ERP and card programme the rules apply to. -->

| Field | Value |
|---|---|
| Document ID | [POL-P2P-NNN] *Example:* POL-P2P-002 |
| Version | [1.0] |
| Status | [Draft / In review / Approved] |
| Owner | [@financial-controller] |
| Approvers/reviewers | [@cfo], [@head-of-procurement], [@head-of-hr], [@internal-audit] |
| Entities in scope | [Legal entities] |
| Systems | [ERP, expense tool, card programme] |
| Effective date | YYYY-MM-DD |
| Last updated | YYYY-MM-DD |
| Next review | YYYY-MM-DD (annually) |
| Classification | [Internal] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Policy owner | [@name] | [Prepared] | YYYY-MM-DD |
| Head of procurement | [@name] | [Reviewed] | YYYY-MM-DD |
| CFO | [@name] | [Approved] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change summary |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@name] | First draft |
| 1.0 | YYYY-MM-DD | [@name] | *Example:* Approved, card controls added |

## 1. Purpose, scope and control framework

<!-- Guidance: Name the framework and the main risks. Pitfall: a policy written only as rules for staff, with no link to the risks and controls auditors will test. -->

This policy applies to every purchase of goods and services, every
supplier payment and every employee expense claim or card transaction
of the entities in scope.

The control design maps to the five components of internal control in
the Green Book (2025): control environment, risk assessment, control
activities, information and communication, and monitoring. The 2025
revision adds an explicit expectation to consider improper payment and
information security risks during risk assessment; both are central to
payables. Private companies may map the same controls to COSO Internal
Control, Integrated Framework (2013).

Main risks addressed:

| Risk ID | Risk |
|---|---|
| P2P-R01 | Payment to a fictitious or unapproved supplier |
| P2P-R02 | Payment diverted by fraudulent bank detail change (payment redirection) |
| P2P-R03 | Duplicate payment of the same invoice |
| P2P-R04 | Payment for goods or services not received or not as ordered |
| P2P-R05 | Spending without approval or split to avoid thresholds |
| P2P-R06 | Personal or non-business expenses reimbursed |
| P2P-R07 | Incorrect VAT, sales tax or withholding tax |
| P2P-R08 | Late payment breaching terms or law, losing discounts |

UK note: since 2025-09-01 large organisations can be liable for the
offence of failure to prevent fraud under the Economic Crime and
Corporate Transparency Act 2023, with a defence of reasonable fraud
prevention procedures; payables controls form part of that evidence.

## 2. Roles and segregation of duties

<!-- Guidance: No single person may create a supplier, raise a PO, receive goods and release payment. Pitfall: system administrators with all roles "for support". -->

| Activity | Performed by | Must not also perform |
|---|---|---|
| Create or change vendor master | Master data team | Invoice entry, payment release |
| Raise requisition or PO | Requester or buyer | Approve own PO, receive own order above [GBP 5,000] |
| Record goods receipt | Receiving location or service owner | Approve invoice for payment |
| Enter and match invoices | Accounts payable | Vendor master change, payment release |
| Approve payment run | Financial controller | Vendor master change |
| Release payment in bank | Treasury, two signatories | Invoice entry |

User access to these roles is reviewed every [quarter]; conflicts are
listed with a compensating control or removed.

## 3. Approval authority

<!-- Guidance: Align with the delegation of authority matrix and state that splitting a purchase to avoid a threshold is a breach. -->

| Commitment value (excl. tax) | Approver |
|---|---|
| Up to [GBP 5,000] | Budget holder |
| [GBP 5,001 to 50,000] | Department head |
| [GBP 50,001 to 250,000] | Finance director |
| Above [GBP 250,000] | CFO, and CEO where the matrix requires |

The value is the full commitment over the contract term. Splitting one
need into several orders to stay under a threshold is a breach of this
policy and is monitored by a monthly report of orders to the same
supplier just below a threshold.

## 4. Vendor master data

<!-- Guidance: Most payables fraud enters through vendor master changes. Make the verification step independent of the email that requested the change. -->

| Control ID | Control |
|---|---|
| VM-01 | New suppliers are created only from an approved onboarding record (see `procurement/supplier-onboarding-due-diligence`) |
| VM-02 | Legal name, registration and tax numbers are checked against official registers |
| VM-03 | Bank detail creation and changes are verified by a call-back to a phone number already on file or from an independent source, never the number in the request |
| VM-04 | Every master data change is reviewed daily by a second person from a change report |
| VM-05 | Suppliers with no activity for [18] months are blocked |
| VM-06 | Duplicate supplier check on name, tax number and bank account before creation |

## 5. Purchase orders and receipts

<!-- Guidance: Define where a PO is mandatory and the narrow list of exceptions. Pitfall: retrospective POs raised after the invoice arrives, which defeat the approval control. -->

A PO approved before commitment is mandatory for all purchases except
the "no PO" categories: [utilities, rates and taxes, regulator fees,
payroll-related payments, intercompany charges]. Each exception category
has a named approver for invoices.

Goods receipts are recorded when goods arrive, against the PO line, with
quantity accepted. Service receipts are confirmed by the service owner
on evidence of delivery (timesheet, milestone sign-off). Retrospective
POs (dated after the invoice) are reported monthly by department.

## 6. Invoice processing and three-way match

<!-- Guidance: Set tolerances explicitly. Quantity variances should never be auto-accepted above the received quantity. -->

Invoices are received only through [the AP mailbox or e-invoicing
channel], registered on the day of receipt and matched:

```mermaid
flowchart TD
  A["Invoice received and registered"] --> B{"PO invoice?"}
  B -- "No" --> N["Route to named approver for no-PO category"]
  B -- "Yes" --> C["Match to PO line and goods receipt"]
  C --> D{"Quantity invoiced within received?"}
  D -- "No" --> H["Hold excess quantity, query supplier"]
  D -- "Yes" --> E{"Price within tolerance?"}
  H --> E
  E -- "Yes" --> P["Post and schedule for payment"]
  E -- "No" --> Q["Buyer approves variance or requests credit note"]
  Q --> P
  N --> P
```

Tolerances: price variance accepted automatically up to the lower of
[2%] of the line value or [GBP 250]; no automatic acceptance of
quantity above received quantity.

*Example:* PO for 100 units at GBP 48.00 (GBP 4,800.00); receipt of 98
units; invoice for 100 units at GBP 48.50 (GBP 4,850.00). The price
variance is GBP 0.50 per unit, 1.04% of PO price, within tolerance. AP
posts 98 x 48.50 = GBP 4,753.00 and holds 2 x 48.50 = GBP 97.00 until
the remaining units arrive or a credit note is received.

Duplicate checks run on supplier, invoice number (normalised), date and
amount before posting, and as a monthly analytic over paid invoices.
Tax on the invoice is checked for the required content of the
jurisdiction (for example VAT invoice requirements in the UK and EU).

## 7. Payment runs

<!-- Guidance: State the payment calendar, who approves the run and how bank files are protected. -->

| Control ID | Control |
|---|---|
| PAY-01 | Payment runs [twice weekly], only for posted, approved, due invoices |
| PAY-02 | Run proposal reviewed by the financial controller with exception report (new suppliers, changed bank details in last [30] days, amounts above [GBP 50,000]) |
| PAY-03 | Bank file generated from ERP without manual edit, integrity-protected in transfer |
| PAY-04 | Two authorisers release in the bank portal; neither can edit vendor master |
| PAY-05 | Urgent manual payments need CFO approval and are listed monthly |
| PAY-06 | Payment terms honoured; early payment discounts taken where the return exceeds the cost of funds |

Pay suppliers on the agreed terms and within any statutory maximum (see
`finance/credit-control-collections-policy` for EU and UK late payment
rules). In the UK, large companies must also report payment practices
under the Reporting on Payment Practices and Performance Regulations;
check the current reporting fields.

## 8. Travel and expenses

<!-- Guidance: Keep rules short and checkable. State tax treatment by reference to the official rules of each country. Pitfall: approvers signing claims without looking at receipts. -->

Rules:

1. Book travel through [the travel tool]; economy class for flights
   under [6] hours.
2. Hotel nightly caps by city tier: [Tier 1 GBP 220, Tier 2 GBP 150].
3. Meals while travelling at actual cost up to [GBP 50] per day, with
   itemised receipts.
4. Mileage for business use of a private car at [the approved rate];
   check HMRC approved mileage allowance payments in the UK or the IRS
   standard mileage rate in the US for the current year.
5. Client entertainment pre-approved above [GBP 250] and recorded in
   the gifts and hospitality register.
6. Claims submitted within [30] days with itemised receipts; approved by
   the claimant's manager, never by the claimant or a subordinate.
7. Not reimbursed: fines, personal travel extensions, alcohol without a
   client present, [other items].

Tax: reimbursements are structured to meet local rules (for example an
accountable plan under US Treas. Reg. 1.62-2, or HMRC rules on expenses
and benefits in the UK). Payroll and tax review any allowance paid
without receipts.

## 9. Corporate cards

<!-- Guidance: Cards bypass the PO process, so the controls are limits, merchant blocks and timely review. -->

| Control ID | Control |
|---|---|
| CARD-01 | Cards issued only on manager and finance approval, to named employees who sign the cardholder agreement |
| CARD-02 | Per-transaction and monthly limits; merchant category blocks for cash, gambling and [other categories] |
| CARD-03 | Transactions coded with receipt in the expense tool within [10] days of statement |
| CARD-04 | Manager reviews and approves each statement; finance samples [5%] monthly |
| CARD-05 | Cards cancelled on the leaver's last day; unused cards for [6] months closed |
| CARD-06 | Personal use repaid within [30] days; repeated personal use leads to withdrawal |

## 10. Monitoring and metrics

<!-- Guidance: Report a short dashboard monthly and feed exceptions into the risk control matrix. -->

| Metric | Definition | Target |
|---|---|---|
| PO compliance | Spend with PO before invoice / total addressable spend | [above 95%] |
| First-pass match rate | Invoices matched without manual intervention / invoices received | [above 80%] |
| Duplicate payments | Count and value recovered | [zero] |
| On-time payment | Invoices paid by due date / invoices paid | [above 95%] |
| Expense claims late | Claims submitted after [30] days | [below 5%] |
| Card receipts missing | Transactions without receipt after [10] days | [below 2%] |

Internal audit tests the key controls annually using the control IDs
in this policy.

## 11. Glossary and references

<!-- Guidance: Short definitions in your own words. -->

| Term | Meaning in this policy |
|---|---|
| Three-way match | Comparison of invoice, purchase order and goods receipt before payment |
| Vendor master | Supplier records in the ERP, including bank details |
| Payment redirection | Fraud in which a supplier's bank details are changed to an account the fraudster controls |
| No-PO category | Spend type allowed without a purchase order, with a named invoice approver |

| Reference | Version or date | URL |
|---|---|---|
| GAO, Standards for Internal Control in the Federal Government (GAO-25-107721) | Published 2025-05-15, effective from FY2026, supersedes GAO-14-704G | https://www.gao.gov/products/gao-25-107721 |
| COSO Internal Control, Integrated Framework | 2013 | https://www.coso.org/ |
| UK Economic Crime and Corporate Transparency Act 2023, failure to prevent fraud | In force 2025-09-01 | https://www.legislation.gov.uk/ukpga/2023/56 |
| US Treas. Reg. 1.62-2 (accountable plans) | Current | https://www.ecfr.gov/current/title-26/section-1.62-2 |

## Standard and licence note

Based on the GAO Standards for Internal Control in the Federal
Government (2025 revision, a public US government publication), with
control components named and summarised in original words; COSO, UK and
US instruments are cited by name only. Check the current official text
of each source and local tax rules before adoption. Fenmarsh Retail
Group and all figures are fictional. The text is original and is not
legal, tax or financial advice. Template licence: MIT.