7 Approval Rules to Set Before You Hand Bill Pay to an Outside Team

7 Approval Rules to Set Before You Hand Bill Pay to an Outside Team

The day you give an outside provider the ability to move money, your approval process stops being a habit and becomes a contract.

Most owners do not notice the change. Internally the control was you: invoices passed your desk, you knew every vendor, and nothing left the building unseen. Outsourced bill pay controls have to do that same job in writing, executed by people who have never met your vendors and cannot tell that the landscaping invoice looks wrong.

Write these seven rules before the handoff. Each costs you something, and each cost is named here, because a control nobody can live with gets bypassed in week three.

1. The Party Who Sets Up a Vendor Cannot Be the Party Who Pays One

Nearly every payment fraud that survives outsourcing runs on one party controlling both the vendor record and the payment.

If the same person can create "Northgate Supply LLC" with their brother-in-law's bank account and then release a payment to it, no downstream review matters. Split it: one side creates or edits vendor records, the other executes payments, and neither can do the other's job in the system.

The cost: a new vendor takes a day or two instead of an hour, and someone on your side has to be available to approve setups. Accept the friction, because every other rule on this list depends on this split.

2. A Dollar Threshold Is the Weakest of Your Outsourced Bill Pay Controls

Everybody's first policy is a number. Anything over $5,000 needs the owner's approval. Sounds sensible, catches nothing.

Anything can be split. Two invoices of $4,800 clear a $5,000 threshold without a glance, and a payment run with sixteen small items is exactly where an added one hides. A threshold is a triage tool, not a control.

What makes it work is a second dimension that cannot be split: new vendors regardless of amount, any payment to a vendor with no history, any change to payment details, anything outside a vendor's usual pattern.

The cost: more items get flagged and most of them will be boring. Set that second dimension too wide and you produce a queue nobody clears, which is its own failure. Start narrow and widen once you see what shows up.

3. New Bank Details for an Existing Vendor Get Their Own Rule

If you write one rule from this list, write this one. A change of bank details on a vendor you already trust is the highest-risk event in accounts payable, because every other check has been passed already.

The attack is not exotic. An email arrives from an address one character off, the tone is right, the invoice format is right, and it says the account has changed. Nothing trips a threshold, because the amount and the vendor are exactly what you expected.

The rule: any change to payment details is verified by voice, with a human at the vendor, on a number you already had before the request arrived. Not the number in the email. Then it is logged with who verified it and when.

The cost: this one is genuinely annoying. Real vendors change banks, they are impatient, and you will chase a controller who does not return calls while a legitimate payment sits. It is still the trade worth making.

4. Decide the Exception Path Before You Need It

Your approval process will meet a Friday afternoon wire, an approver on a plane, and a vendor threatening to stop shipping. What happens next is your real policy, whatever the document says. So write it now, while nobody is under pressure.

Name a backup approver with the same authority. Say what the outside team may do when they cannot reach anybody, which is usually nothing, and say it plainly so they are not guessing. Define what counts as urgent, because if the requester defines it, everything is.

The cost: a designated backup widens who can move money, and you will sometimes hold a payment that was legitimately urgent. The alternative is a workaround invented mid-crisis, which is how exceptions become the default.

5. Recurring Payments Need a Renewal Date, Not Just an Approval

An approved recurring payment is approved once and paid forever. Nobody notices the difference until a subscription with nine unused seats turns up in a cleanup three years later.

Fix it by attaching an expiry to the approval. Every recurring item gets a date on which it stops unless somebody re-approves it, and that date lives with the vendor record where the person processing payments can see it.

The cost: real administrative overhead, and a nonzero chance a missed renewal shuts off something you need. Stagger the dates rather than putting them all in January, and keep critical items on a longer cycle than discretionary ones.

6. The Owner Reviews an Exception Report, Not the Whole List

Owners often ask to see everything after the handoff. It feels like control and is mostly the opposite, because a complete list gets skimmed, and skimming is indistinguishable from not reading.

Ask for the short version: new vendors this period, changed bank details, payments outside a vendor's normal range, anything paid under an exception. Five items you actually read beat two hundred you scroll.

The cost: an exception report is only as good as the rules defining an exception, so something genuinely odd that fits no rule will not appear. Once a quarter, pull the full register and read it properly.

7. Write Down Who Can Change the Rules

This is the control people forget, and the one that quietly undoes the other six. A policy that anybody can amend by email is not a policy.

Say who may change approval authority, who may add a payment method, who may raise a threshold, and how the change is recorded. The bar should be higher than for any single payment, because changing the rule is worth more to a bad actor than one invoice. Tell your provider that rule changes arriving by email are not valid, whoever they appear to be from.

The cost: small but real. Changes that ought to take a minute take a day, and the person with authority to amend becomes a bottleneck when they travel.

Where an Outside Provider Fits in Outsourced Bill Pay Controls

Here is the part owners get backwards. You are not hiring a provider to supply your controls. You are adding a party who sits inside them, so the separation in rule one now describes the line between your team and theirs.

System Six names bill pay among the day-to-day finance work it runs, alongside bookkeeping, payroll processing and invoicing, for businesses in the $1 million to $10 million revenue range. The firm is in Seattle, was founded in 2009, has 41 employees, and works with clients nationwide. A staffed team makes rules one and four easier to hold: separating setup from execution is simpler when two people already do two jobs, and a backup approver is something a team has and a solo bookkeeper does not.

The limitation, stated carefully. A provider can execute your rules and cannot write them, because approval authority is yours and stays yours, and no provider can verify itself. Rule seven has to be enforced from your side or it is decorative. System Six also lists a $1 million revenue minimum, so a smaller business is looking at a different provider and should ask that provider the same questions: who on your team can create a vendor, who can release a payment, are those the same person, and what reaches me when something does not fit the rules.

Frequently Asked Questions

Can I just require my approval on every single payment?

You can, and it usually collapses within a month. Approving everything means reviewing nothing carefully, and the moment you are on vacation someone invents an exception path. A rule that survives a busy quarter beats a strict one that gets abandoned. Approve the categories that carry risk and let routine ones run through a documented process.

Should my provider have access to my bank account?

That depends on how the arrangement is structured and what your bank permits, and there is more than one legitimate answer. What matters is knowing exactly which permission exists: initiate only, initiate and release, or full access. Ask your bank what each level allows and read what your provider's agreement says about liability.

How do I check any of this is actually happening?

Test it. Pick a payment from last month and ask for the approval trail: who set the vendor up, who approved it, who released it, and when. If that takes a week to produce, you do not have a control, you have an intention. Repeat at random twice a year.

Approval rules are cheapest to write before the handoff and most expensive to add after something has gone out the door. If you are choosing a provider for bill pay, you can browse accountants and fractional CFOs on Sam's List and ask each one who on their team does what.

---

About the author: Kimberly Green is the cofounder of Sam's List, where business owners and high earners find vetted CPAs, financial advisors, and fractional CFOs. She's met one-on-one with 400+ financial professionals and writes from the real data behind thousands of client-advisor matches. Ask her anything about finding an accountant - she's heard it all, including the questions people are afraid to ask.