Separate approval and payment duties: Purchase approvers must know what is being bought.; Payment checkers must verify invoice, amount and payee.; Bank detail changes require direct supplier contact via trusted number.
Image: Startup Operations Guide

Cash Controls

Part of Startup risk and access controls

Separating approval and payment responsibilities where practical

Split purchase approval, payment checks and release where possible, with a visible review when a small team combines roles.

Desk Cash · · 3 min read

Separate the decision to incur an expense from the steps that check and release its payment where staffing allows. The purchase approver should know what is being bought. The person releasing funds should see the approval and check the invoice, amount and payee. If one person handles several steps, arrange a visible review of their work by another authorised person.

Map one payment from request to bank record

Take a common supplier payment and record its route: request, approval of the commitment, invoice receipt, payee verification, preparation, release and review of the bank movement. Note who can act in each system. This shows where a second person provides a real check rather than a second name on a form.

Keep purchase approval distinct from checking the payment. A budget allocation or an earlier approval for another amount does not establish that this invoice matches the agreement. The checker needs the current terms, evidence of delivery where relevant and an explanation of differences.

Step / Question to answer

Approve commitment
Is the purchase authorised on these terms?
Check payment
Does the invoice match the approved obligation and verified payee?
Release funds
Is this the payment that was checked?
Review bank movement
Does the actual transaction match the recorded payment?

A small team may combine roles. Record who performed each step rather than claiming a separation that did not occur.

Map one payment from request to bank record

  1. Approve commitmentIs the purchase authorised on these terms?
  2. Check paymentDoes the invoice match the approved obligation and verified payee?
  3. Release fundsIs this the payment that was checked?
  4. Review bank movementDoes the actual transaction match the recorded payment?

Check bank-detail changes separately

An email appearing to come from a supplier is insufficient grounds to change payment details. Contact the supplier through a number already held in a trusted record or found independently. Record who verified the change, when and what was confirmed. Apply the same caution to an unusual urgent request appearing to come from a colleague.

If details cannot be verified before the due date, escalate the delay to the authorised person. An approaching deadline does not confirm the request is genuine. If money may have gone to fraudulent details, contact the bank promptly using its official number and follow the business's incident route. The bank may be able to act, but recovery is not assured.

Verify bank detail changes securely

  • Contact supplier via trusted numberUse a number from a pre-existing record or independently verified source
  • Record verification detailsWho, when, and what was confirmed
  • Escalate unverified urgent requestsIf details can't be verified before due date
  • Contact bank using official numberIf funds may have been sent fraudulently

Set a small-team exception in advance

Where a founder and one colleague handle finance, one workable route is for the founder to approve a purchase, the colleague to check the invoice and payee, and the founder to verify the prepared payment before release.

The colleague can then compare the bank movement with the approved record. If one person must prepare and release a payment, arrange a prompt review by another authorised person who can see the supporting record and bank movement.

State who may approve an absence or urgent exception, what evidence must be retained and when the review follows. The reviewer must be able to question a mismatch; a sign-off without access to the underlying record adds little.

Review the route after staff, bank permissions or supplier terms change. These checks can reduce exposure to error and fraud but cannot guarantee prevention.

Small-team exception workflow

  1. Founder approves purchaseAuthorises the expense on agreed terms
  2. Colleague checks invoice and payeeVerifies alignment with approval and delivery evidence
  3. Founder reviews prepared paymentConfirms release matches checked details
  4. Colleague reviews bank movementCompares actual transaction with approved record

More from Cash Controls