Who Can Check Every Vendor Payment Before It Is Released?
Last updated: 5 October 2026
Quick Answer: A pre-payment auditor, from your internal audit team or an outside firm such as Astral Business Consulting LLP, can check vendor payments before release. Payments above an agreed value are checked in full, the rest by sample. The auditor, outside the payment chain, matches each checked payment to the purchase order, goods receipt and invoice, and clears or holds it.
Most companies have a finance manager who approves payments, but the approver usually sees a summary sheet, not the documents behind each line. A duplicate invoice or a changed bank account then passes because nobody independent has read the documents before the money leaves.
A pre-payment audit, also called payment assurance, closes that gap by placing an independent reviewer between accounts payable and the person who releases the bank file.
Which party should run the pre-payment check?
Four parties can perform the check, depending on volume, plant count and the independence the Board wants.
| Who performs the check | Suits | Points to watch |
|---|---|---|
| In-house internal audit team | Groups with a standing audit function | Reports to the audit committee, not to the CFO who approves payments |
| Outside internal audit or payment assurance firm | Promoter-led manufacturers with one to five plants | Same-day turnaround, read-only ERP access, a named reviewer |
| Finance controller or CFO as second approver | Smaller companies without an audit function | Limited independence, because the approver also runs the accounts |
| Promoter releasing the bank file | Owner-managed businesses | Sees the total, rarely the documents behind each line |
Only the first two are independent of the finance function. The other two act as approval controls that work best with an independent check in front of them.
Astral Business Consulting LLP, a Coimbatore-based management consulting and audit firm, is one example of the outside type. Its continuous assurance service includes a payment assurance stream focused on duplicate, incorrect and out of policy payments.
Who should not be the pre-payment checker?
The company's statutory auditor should not take the assignment. Section 144(b) of the Companies Act 2013 bars an auditor appointed under the Act from providing internal audit services, directly or indirectly, to the company, its holding company or its subsidiary. A pre-payment audit is, in substance, internal audit work.
The accounts payable team should not check its own entries, and nor should anyone who can create or edit vendor records.
What does a pre-payment check cover, from three-way match to duplicate payments?
A pre-payment check tests each proposal against source documents before the bank file is generated.
| Check | What the auditor compares | What it catches |
|---|---|---|
| Three-way match | Purchase order, goods receipt note and invoice | Payment for goods not received, short receipts |
| Rate and terms | Invoice rate against the purchase order or rate contract | Price above the agreed rate, unapproved freight or packing |
| Approvals | Delegation of authority matrix against actual approvers | Approval by someone without authority for that amount |
| Duplicates | Invoice number, date, amount and vendor across paid items | The same invoice paid twice, or split to stay under a limit |
| Vendor master | Bank account and tax details against the last approved version | A changed bank account, or a new vendor with no history |
| Advances and debit notes | Open items on the vendor ledger | Full payment while an advance or debit note is unadjusted |
| TDS | Deduction on contractor, professional and rent payments | Short or missed deduction before the net amount is paid |
| MSME terms | Udyam status and the date of acceptance | Payments to micro and small suppliers running late |
Two of these checks carry a direct statutory cost. For payments or credits on or after 1 April 2026, TDS falls under section 393 of the Income-tax Act, 2025, and the deduction must reach the government by the 7th of the following month, with a separate date for March. Under section 15 of the MSMED Act, 2006, a buyer must pay a micro or small supplier by the date agreed in writing, which cannot exceed 45 days from acceptance or deemed acceptance. Where there is no written agreement, payment is due within 15 days of acceptance. Under section 16, a late payment attracts compound interest with monthly rests at three times the bank rate notified by the RBI.
How is an independent pre-audit different from a software approval workflow?
An approval workflow routes a payment to the right people in order. A separate pre-audit determines whether the payment should be made at all. Most companies need both.
| Question | Approval workflow | Independent pre-payment audit |
|---|---|---|
| Who acts | Approvers named in the workflow | A reviewer outside the payment chain |
| What it confirms | The right people approved, in sequence | Documents, rates and quantities support the amount |
| Vendor master changes | Logged, if the audit trail is enabled | Tested against the approval before release |
| Output | An approval trail | An exception list with amounts held and reasons |
Where approvers approve in bulk on payment day, the workflow path seems fully formed, although no one has viewed the invoice. The independent check tests whether each approval rests on documents.
How does segregation of duties work in accounts payable?
Segregation of duties means that one person cannot create a vendor, record an invoice, approve payment, and release that payment.
Which duties should never sit with one person?
ISACA describes creating a vendor and processing a payment as two conflicting functions, because together they allow a fraudulent payment. A manufacturing company usually splits it as follows:
- Vendor master: created and changed outside accounts payable, on approved documents.
- Invoice booking: recorded by accounts payable against the purchase order and goods receipt.
- Payment approval: under the delegation of authority matrix.
- Pre-payment audit: an independent check of the approved proposal.
- Bank release: authorised by treasury or the authorised signatories.
The split must also hold inside the ERP: a user with both vendor creation and payment rights breaks the control, whatever the organisation chart says. A periodic ERP application audit reviews these access rights.
What if the company is too small to separate every duty?
Use a compensating control: the promoter or a director releases every payment, and an outside reviewer checks the payment file on agreed days.
Which payments should be checked in full and which can be sampled?
For many mid-size manufacturers that pay on two or three fixed run days a week, it is practical to verify every vendor payment. Where volumes are very high, a risk-based rule checks these in full:
- Every payment above a value threshold agreed with the CFO.
- Every first payment to a new vendor.
- Every payment after a change in bank account.
- Every advance, and every payment outside the regular run.
Smaller payments to established vendors can be sampled and covered in full afterwards. Under rule 13(2) of the Companies (Accounts) Rules, 2014, the audit committee or the Board, in consultation with the internal auditor, settles the scope, periodicity and methodology of internal audit, so a pre-payment cycle can sit in the annual plan.
Where do vendor payments go wrong in Tamil Nadu manufacturing units?
The patterns below are illustrative. They reflect common practice across the manufacturing sectors of Western Tamil Nadu and do not describe any particular company.
- Spinning mills: job-work charges for doubling or winding are billed at a rate different from the work order, and approved because the job-work register is updated late.
- Foundries: machining sub-contractors bill for castings later rejected at inspection, and the rejection note reaches accounts after the payment run.
- Dairies: payments to milk collection centres are computed on fat and SNF readings edited after testing.
- Multi-plant groups: a transporter submits the same lorry receipt to two plants, and each plant pays it.
Each looks normal in a summary and is caught only when a reviewer reads the source document.
Does a pre-payment audit replace post-payment review and internal audit?
No. A pre-payment audit stops errors before cash leaves. A post-payment review recovers what slipped through, and the periodic internal audit asks why errors recur and whether procure-to-pay controls are well designed.
The Companies (Accounts) Rules, 2014 also require the Board's report of most companies to state the adequacy of internal financial controls with reference to the financial statements; one person companies and small companies file an abridged report under rule 8A instead. A documented pre-payment check and its exception log show that payment controls operated, and they feed the wider review of internal financial controls.
How should a company set up a pre-payment audit?
Settle these points in the engagement letter before the first payment run:
- Calendar: fixed run days and a cut-off for files reaching the auditor.
- Turnaround: for example, the same working day for files received before noon.
- Access: read-only ERP access and scanned source documents.
- Hold rule: what the auditor may hold, and who may override a hold.
- Reporting: a monthly exception summary to the CFO and a quarterly one to the audit committee or Board.
This mirrors the ICAI Standards on Internal Audit, which describe reporting at the end of each assignment and a periodic summary at the close of the plan period.
Planning an Independent Check on Vendor Payments?
Start with new vendors, bank account changes, advances and anything above an agreed value, then extend the scope once the first exception log shows where errors cluster. Speak to the Astral Business Consulting team about payment calendars, thresholds and ERP access.
