Ask five UK finance teams what their accounts payable controls framework is and four will describe a set of habits, not a framework: someone checks invoices before they are paid, someone else releases the payment, and everyone hopes that is enough. It usually is not enough, and it is rarely written down. This is what a proportionate controls framework looks like when the team is five people, not fifty.
Key takeaways
What an accounts payable controls framework needs
An accounts payable controls framework does not need a Big-4 audit committee to run it. It needs seven things done consistently: verified supplier data, controlled bank detail changes, segregation of duties sized to the team you actually have, invoice approval with a three-way match, dual authorisation on payment release, regular reconciliation, and an audit trail that survives scrutiny. Get those seven right and the framework does the job of accounts payable fraud prevention whether the reviewer is an auditor, an insurer, or the bank asking why a payment bounced.
The reason this matters now is not abstract. UK Finance's Annual Fraud Report 2026 recorded £576.4 million lost to authorised push payment (APP) fraud in 2025, up 19 per cent year on year, with £75.6 million of that against businesses. None of that money moved because a criminal broke into a bank. It moved because someone, somewhere, authorised a payment to the wrong account. Controls are the only defence against that, because by the time the payment has gone, the bank cannot always get it back.
Supplier master data and verification
The control starts before the first invoice arrives: a supplier is not on the payment run until its identity has been verified against an independent source, not just the details it emailed over. That means checking the company against Companies House, confirming the bank account belongs to the entity you think you are paying, and recording who verified it and when.
This is the step most SMEs skip because it feels like paperwork rather than control. It is the opposite. A verified supplier profile is what everything downstream depends on: three-way match, payment release, reconciliation. If the supplier master is wrong, every later control is checking the wrong thing correctly. Accounting Links verifies suppliers against Companies House and bank data at onboarding and keeps that profile live rather than static, so the check that happened on day one is still true on day 400.
Bank detail change control
Controls in accounts payable fail most often at the point of change, not the point of onboarding. A supplier's bank details are verified once and then treated as fixed, so when an email arrives asking to update them, the request gets actioned on trust. That single moment accounts for a disproportionate share of invoice redirection fraud.
The control is simple to state and hard to run manually: any change to bank details triggers re-verification through a channel the supplier does not control, such as a callback to a known number or a re-check against Confirmation of Payee, before a single payment goes to the new account. For the specific patterns worth training a finance team to spot, see five red flags your supplier's bank details have been compromised. Accounting Links flags bank detail changes and prompts re-verification, with the change and its outcome recorded in the audit trail, rather than leaving the buyer to notice a change on the next invoice.
Segregation of duties for small teams
Segregation of duties is where most published frameworks stop being useful to an SME, because they assume separate people for requisition, approval, and payment release. A five-person finance function cannot always staff three separate roles for every transaction, and pretending otherwise produces a policy nobody follows.
A proportionate version does two things instead of three. First, no single person can both add or amend a supplier's bank details and release a payment to that supplier, full stop, even if the same person can do other parts of the process. Second, where true separation is not possible, a second reviewer signs off before release rather than after. That is not full segregation of duties. It is the version that catches the failure mode that actually costs money: one person quietly changing bank details and paying themselves or an accomplice.
Invoice approval and three-way match
Three-way match answers one direct question: does what was ordered, what was received, and what was invoiced actually agree? An invoice that does not tie back to a purchase order and a goods-or-services receipt is either an error or something worth a second look, and either way it should not clear automatically.
For most SMEs the practical version is lighter than an ERP-grade three-way match: a purchase order or approved quote, confirmation the work or goods were received, and an invoice that matches both on supplier, amount, and description. Anything that does not match goes to a named reviewer, not into a queue nobody owns. Accounting Links shows the invoice and its approval status to both buyer and supplier in real time, so a mismatch is visible to the supplier as well as the buyer instead of sitting silently in an inbox.
Payment release controls
Payment release is the last point where an accounts payable fraud prevention control can stop money leaving the business, and it should not depend on one person's judgement alone. Dual authorisation (one person prepares the payment run, a different person authorises it) catches the errors and the fraud that approval alone missed. Confirmation of Payee (checking the name on the account matches the name you intend to pay) catches the case where the account details are technically valid but attached to the wrong entity: what it catches and, just as usefully, what it misses is worth understanding before you rely on it as the only check.
The Payment Systems Regulator's mandatory reimbursement rules, in force since October 2024, cover individuals, micro-enterprises and charities that fall victim to APP fraud, not every business. A mid-sized SME making a payment to a fraudulent account may have no reimbursement route at all. That gap is the argument for controls at the point of release, not compensation after the fact.
Reconciliation and audit trail
Reconciliation closes the loop: bank statement against ledger, ledger against supplier statement, on a schedule short enough that a problem surfaces in weeks, not at year end. An audit trail is what makes every other control provable rather than assumed, recording who verified a supplier, who approved a bank detail change, who authorised a payment, and when. For a walkthrough of how these controls fail in sequence when nobody is watching, the anatomy of an AP fraud is worth reading alongside this framework. Under the Economic Crime and Corporate Transparency Act 2023, the new corporate offence of failing to prevent fraud came into force on 1 September 2025 for large organisations meeting two of three thresholds (turnover above £36 million, balance sheet above £18 million, more than 250 employees), and the statutory defence turns on having had reasonable prevention procedures in place. Most SMEs sit below that threshold today, but the same test (could you show a regulator or a bank what you did and why?) is the right bar to hold yourself to regardless of size, because it is also what an insurer or an acquirer will ask.
Where a connected network moves controls upstream
The seven controls above work. They also all depend on data that a single buyer usually has to collect and re-verify alone: company identity, bank details, payment history. A connected accounts payable network changes where supplier verification happens. When a supplier's identity and bank details are verified once and shared, with continuous re-verification rather than a one-off check, across every buyer they trade with, the control moves upstream of any single company's process. The buyer is not relying solely on their own checks; they are relying on a shared, continuously verified record.
That is the shift behind Accounting Links: supplier verification, bank detail change flagging, and payment status are built into the risk and exceptions control layer rather than left to a spreadsheet and an honesty system. It does not replace the framework above. It is what makes the framework realistic to run with the team you actually have.
If your accounts payable fraud prevention controls exist mainly as habits rather than a written framework, our AP fraud detection checklist is a practical place to start: it walks through the same seven areas at the level of detail a finance manager can action this week. For a wider look at how the underlying data problem gets solved, Accounting Links for finance teams sets out how supplier verification and payment behaviour data work together once they sit outside any one company's four walls.
Sources
FAQs
