Invoice approval with a digital workflow: from the manager's signature to the audit trail

The manager's physical signature worked for decades with 30 invoices a month and a single approver. Today volume arrives by email, several managers approve by amount and the auditor asks for traceability of every step. The handwritten signature no longer scales.

This article describes the operational design of a digital approval workflow: tiers, segregation of duties, audit trail and connection with touchless AP. No marketing. What a CFO can implement at a Spanish SME.

Why the physical signature stops scaling

The classic process has four weak points:

• Personal bottleneck. If the approver is travelling, the invoice waits. Late payment or lost discount.
• Zero traceability. A signature on paper does not say when it was signed or what was compared before.
• Role mixing. Whoever requests the purchase is often the one who approves. A classic weakness COSO identifies.
• Document loss. The invoice gets misfiled and reappears with a different recording date.

AEAT requires internal control to ensure integrity and authenticity of the received invoice. Without traceability, justifying it is hard.

Classic vs digital flow

The difference is easier to see in a table.

Stage	Classic flow (paper)	Digital flow
Receipt	Email → print → physical tray	Single inbox → automatic ingestion
Data capture	Manual re-keying into ERP	Structured OCR/IDP, signed data first
Validation	Visual matching against filed PO	Automatic line-by-line three-way matching
Approval	Manager's handwritten signature	Approval by a person, with user and timestamp
Filing	Physical folder + later scan	Digital repository with e-signature
Audit	Reconstruct the trail after the fact	Audit trail always available

The critical change is not getting rid of paper. It is that each decision is recorded with who, when and against what data.

Approval tiers and segregation of duties

A digital workflow stands on two pillars:

1. Tiers by amount. Three tiers cover most SME cases:

Tier	Amount (pre-VAT)	Approver	Target time
L1	EUR 0-1,000	Department head	24 business hours
L2	EUR 1,000-10,000	Head + CFO	48 business hours
L3	> EUR 10,000	CFO + CEO	72 business hours

The amounts are indicative. The universal rule is that the approver's limit covers their contractual spending power and no more. This matrix is your company’s policy: ininvoice does not route invoices by amount or category; it cross-checks each invoice and leaves it for a person to approve, recording who approved and when.

2. Segregation of duties. Whoever orders does not approve. The COSO internal control framework is clear: separate authorisation, recording and custody. In a small SME, segregation is softened with a compensating control: the final approver is not the buyer and a second person (CFO) reviews everything over a threshold.

Typical roles

• Buyer: issues the PO, receives goods, records the delivery note. Does not approve the invoice.
• Approver L1/L2/L3: validates that the invoice matches what was agreed and authorises payment.
• Administration / AP: records the invoice, does not decide amounts, executes the payment.
• Auditor (internal or external): reads, does not write.

Digital vs paper audit trail

A defensible audit trail needs these fields per event:

• Invoice ID + PO ID + delivery note ID.
• User executing the action (not a generic role).
• Exact action: ingested, matched, approved, rejected.
• UTC timestamp with second precision.
• Immutable document hash or reference of the approved document.
• Mandatory comment field on rejections and out-of-tolerance approvals.

An external audit asks three things: who approved, when and against what data. If the three fit on one screen, the control is well designed.

Workflow integration with touchless AP

Approval does not live in isolation. It fits within the full accounts payable process:

1. Ingestion from Gmail with dedupe by hash.
2. Structured reading of PDF, image and scanned invoices (reading of XML e-invoices is in development).
3. Three-way matching line by line against PO and delivery note.
4. Approval by a person, with user, date and comment in the audit trail.
5. Export of approved invoices as a CSV or Excel file that Holded, Sage or A3 can import.

When matching is clean (zero line-by-line variance), the invoice is marked as matching and ready for a person to approve, without anyone having to check it line by line.

Approval and Spanish tax compliance

Three regulatory fronts touching the flow:

• SII (AEAT). Received invoices are reported within four days, excluding Saturdays, Sundays and national holidays (Royal Decree 596/2016). A traceable digital flow meets the deadline without a marathon.
• Verifactu. Verifiable invoicing system. The receiver approving the invoice can verify the QR against the AEAT as an optional control; it is not a legal obligation, and ininvoice does not verify it. The original document stays linked to the approval trail.
• Crea y Crece (Law 18/2022). Mandates B2B e-invoicing. Anyone with a digital workflow has a smooth transition.

A digital workflow makes it much easier to show the control AEAT expects (integrity, authenticity, legibility, retention).

Risks of not having a digital workflow

It is not just efficiency. There are quantifiable risks:

• Duplicate payment. Without digital dedupe, the same PDF gets paid twice.
• Fraud. IBAN changes without traceability, fake invoices, overcharges netted across lines.
• Lost discounts. Prompt-payment terms expire before the invoice reaches the approver.
• SII penalties. Reporting out of deadline costs money per invoice.
• Audit findings. "Missing approval evidence" is typical when there is only a handwritten signature.

Example: SME with 300 invoices/month

Distributor with 25 employees, 300 invoices/month and one admin person. Here is the flow:

1. Single inbox invoices@company.com connected to the system. Zero manual forwarding.
2. Each invoice is cross-checked with PO and delivery note. Invoices with zero variance are marked as matching, ready for a person to approve.
3. Exceptions show their reason, so the team knows who should answer: procurement for price variance, warehouse for quantity, CFO for > EUR 1,000.
4. Each step records user, timestamp and document reference.
5. Month-end: the auditor reads the audit trail of each invoice.

The bottleneck shifts from "who signs" to "who resolves exceptions".

Controller checklist before rollout

• Current map of the approval flow: who signs what and since when.
• Amount tiers defined in writing and approved by the board.
• Approver list with backups for holidays and absences.
• Clear segregation policy: buyer ≠ approver.
• Documented three-way matching tolerance (2% / EUR 1.50 OR-mode by default).
• Migration plan: which suppliers go first (top 20 by volume).
• Filing plan: how prior paper invoices coexist with the digital flow.
• Connection with accounting (Holded, Sage, A3): approved invoices exported as CSV or Excel.
• Approver training: what variance and duplicate flags mean.
• Quarterly review of the approval matrix.

Frequently asked questions

Do I need a qualified e-signature to approve invoices internally?

Not for internal approval. Authenticity is guaranteed by the system through login, audit trail and access control. The qualified signature applies to the issuer in B2G e-invoicing and, progressively, B2B with Crea y Crece.

How do I cover segregation if I only have two people in administration?

With compensating controls. Even if the people are few, your policy can separate roles: whoever created the PO does not approve the associated invoice, and a second person (CFO or manager) reviews everything above a threshold.

What if the L2 approver is on holiday?

Your policy should name a backup with the same authority. The audit trail records who actually approved, when and with what comment.

Does it work for paper invoices arriving by postal mail?

It does. They are digitised by scanning and enter the same flow. The AEAT accepts certified digitisation as a substitute for the original.

What indicators are used to evaluate workflow maturity?

Touchless processing rate, cost per invoice, average approval-to-payment cycle, exception percentage, duplicate detection rate. Sector benchmarks report them as percentile ranges.

Who decides the amounts for each tier?

The board or financial leadership. Best to formalise them in a signed spending policy reviewed annually.

How does the digital auditor fit with a human auditor?

The digital auditor does not replace the external one. It hands over the full trail in a queryable format. The human validates samples and conclusions; the digital provides the evidence.

Three things to remember

1. The digital flow stands on tiers by amount + segregation of duties + audit trail. All three at once. Miss one and the control is weak.
2. The shift to digital is not archiving PDFs. It is recording every decision with who, when and against what data.
3. Start with the top 20 suppliers. They cover 80% of volume and let you test the flow risk-free. Then extend.

To see how all this fits on your real invoices, run a test with real invoices. Pricing is tailored: a proposal 48 hours after we see your invoices.

Related content

• Three-way matching: the complete walkthrough
• Touchless AP: how far automation really goes
• Price variance between invoice and PO: how to compute it