Supplier invoice approval workflow: how to design it from scratch

The supplier invoice approval workflow is not an administrative detail. It is the spine holding three things at once: that you only pay for what you actually bought, that every euro is traceable to a responsible party, and that month-end doesn't run until 1 AM.

When the design is right, an invoice comes in by email and is posted without anyone chasing signatures. When it isn't, the admin team lives in firefighting mode and the auditor finds gaps every year. This guide describes how to build the circuit from scratch: structure, levels, controls and migration.

Why a good workflow prevents 80% of errors

AP issues don't appear randomly. They cluster around four repeating failures:

• Overpayments through undetected variance. The supplier invoices a price or quantity different from the agreed one and nobody cross-checks line by line. The PDF amount gets paid.
• Duplicate payments. The same PDF arrives twice (supplier resend, internal copy) and is posted twice because the document hash isn't checked.
• Impersonation fraud. An email seemingly from the supplier changes the IBAN. Without segregation of duties, the same profile edits master data and approves payment.
• Incomplete month-end close. Invoices approved late, without documenting against which PO, hang between periods.

All four share a root cause: no formal workflow. A digital approval flow blocks each one at a different step. Variance gets caught when matching invoices against purchase orders, duplicates are filtered at intake by duplicate invoice controls, IBAN changes trigger a second approver, and close is measured against workflow steps. That's why a good workflow prevents most recurring errors — not magic, just turning scattered controls into a mandatory sequence.

The 5 canonical workflow steps

Regardless of software, every supplier invoice approval workflow chains the same five steps. Reorder or skip one and you leave a control gap.

Step 1. Intake

The invoice arrives at a single point: a shared mailbox (invoices@company.com), a supplier portal or an EDI channel. The universal rule is one single entry channel. With three personal email addresses, traceability dies at step one.

Step 2. Identification

The system extracts supplier, referenced PO number, total amount and checks if it already exists in master data. Here you decide whether the invoice has an associated PO or comes in as direct expense. Invoices without PO aren't rejected, but they are routed to a different sub-flow requiring justification.

Step 3. Validation (matching)

Line-by-line cross-check against PO and delivery note. The universal rule is to compare unit price and quantity per line, not the invoice footer total. The total always squares when suppliers offset differences between lines. Three-way matching is the technical control that prevents this kind of manipulation.

Step 4. Approval

The invoice is routed to the approver who matches by amount and expense category. If matching is clean and within tolerance, certain low bands can be auto-approved (touchless). If there's variance, the system escalates to the right human with the needed context.

Step 5. Posting

Once approved, data is exported to the ERP or accounting system (Holded, Sage, A3, Contasol…) with journal entry and due date. The audit trail is attached: who approved, when, against which PO and delivery note.

These five steps are universal. What changes between companies is who executes each step and how much is automated.

Amount-level design

Approval is segmented by amount to spread load without losing control. Three tiers cover 95% of cases in a typical SME.

Tier	Amount (pre-VAT)	Approver	SLA	Extra controls
L1	EUR 0 - 1,500	Department lead	24 business hours	Automatic match OK
L2	EUR 1,500 - 10,000	Lead + Finance Director	48 business hours	Four-eyes mandatory
L3	EUR 10,000 - 50,000	Finance Director + CEO	72 business hours	Budget justification
L4	> EUR 50,000	CEO + board	5 business days	Approval minutes attached

The amounts are guidance. Universal rule: each approver's limit should not exceed their contractual spend authority. If a warehouse lead can issue POs up to EUR 5,000, it makes no sense for them to approve EUR 50,000 invoices.

A useful variant: critical categories with override. Marketing, IT and external consulting are categories where it makes sense for the Finance Director to review everything, even below the L2 threshold. The system routes by category before amount when policy says so.

Segregation of duties (internal control)

The COSO internal control framework defines a key principle: separate authorization, recording and custody. In supplier invoices that translates into four practical rules.

• Whoever orders the purchase doesn't approve the invoice. The buyer issues the PO and receives the goods. The approver validates that what is billed matches. Two different roles, even if they're two people in the same department.
• Whoever approves doesn't execute payment. Approval authorizes the disbursement, but the payment is launched by treasury or the admin lead.
• Whoever edits supplier master data doesn't approve their invoices. Without this rule, changing an IBAN and approving the next payment is trivial.
• Whoever reconciles the bank doesn't post invoices. Allows discrepancies between what was approved and what was actually paid to be detected.

In SMEs with two or three people in admin, strict segregation is impossible. Compensating controls apply: the software prevents the same user from executing two incompatible steps, even if the button is on the same screen. A role matrix is documented and signed by management.

Real case: distributor SME 800 invoices/month

Electrical materials distributor, 45 employees, 800 supplier invoices per month. One person in admin plus a part-time Finance Director. Here's the split when the digital workflow is well designed.

Approximate monthly volume:

• 800 invoices received.
• 620 with associated PO (77.5%).
• 180 without PO: supplies, recurring services, direct expenses.
• Average amount: EUR 1,250.
• Total monthly amount handled: approximately EUR 1 million.

Distribution by approval tier:

Tier	Invoices/month	% of total	Approver
L1 (< EUR 1,500)	~560	70%	Department lead
L2 (EUR 1,500 - 10,000)	~190	23.8%	Lead + Finance Director
L3 (EUR 10,000 - 50,000)	~45	5.6%	Finance Director + CEO
L4 (> EUR 50,000)	~5	0.6%	CEO + board

Target touchless rate: 50% of L1 invoices with clean matching are auto-approved. That's about 280 invoices/month requiring no human intervention. The admin person stops touching 35% of total volume and focuses on exceptions.

Where exceptions appear:

• Price variance (~80 invoices/month): rebates not applied, outdated price lists, supplier errors.
• Quantity variance (~35 invoices/month): partially fulfilled POs, pending delivery notes.
• Duplicates detected (~10 invoices/month): resends, copies by mistake, double-billing attempts.
• Invoices without PO flagged as anomaly (~25 invoices/month): new suppliers, unbudgeted spend.

The bottleneck moves from "who signs" to "who resolves exceptions". The Finance Director no longer spends mornings reviewing small invoices; they focus on the 150 that actually need judgement.

Tech: ERP vs AP automation

Classic confusion when designing the workflow: assuming the ERP covers approval. It doesn't, in most cases. Each layer does a different job.

Layer	What it does	Examples
ERP / accounting	Journal entry, VAT, due date, balance sheet, full financial cycle	Holded, Sage, A3, Contasol, Quipu, Anfix
AP automation	Email intake, OCR, line-by-line matching, amount routing, duplicates, audit trail	ininvoice and similar tools in the category
Banking / payments	Scheduled payment execution, bank reconciliation	Corporate bank, B2B payment platforms

The ERP stores the accounting result. The AP automation layer governs the path to that result. When the ERP tries to also cover the approval workflow it falls short on three fronts: email intake, line-by-line matching (most compare totals) and granular audit trail.

The typical combination in Spanish SMEs: long-standing ERP/accounting + AP automation layer on top + bidirectional integration. The ERP isn't replaced. It's complemented with the layer that covers the circuit.

Typical design errors

Five repeated mistakes in companies launching a new workflow:

• Skipping levels when the approver is away. If L2 is on holiday, someone approves L3 without authority. Fix: define backups with the same authority and block lateral escalation.
• Not documenting the approval policy in writing. Amounts and approvers live in the Finance Director's head. When the Finance Director leaves, the flow falls apart. Fix: a policy signed by the board, reviewed annually.
• Not logging the audit trail. The system approves but doesn't store who, when, against which data. External audit finds it. Fix: each step logs user, timestamp and document reference.
• Approving before reconciling. The invoice is approved on amount without checking matching against PO and delivery note. Overpayments slip through. Fix: matching mandatory before routing to approver.
• Measuring nothing. The workflow runs, but you don't know how many invoices are touchless, what the average cycle is, or how many exceptions appear. Fix: a dashboard with at least five KPIs (touchless rate, average time, average variance, duplicates detected, invoices outside SLA).

Each of these errors coexists with the workflow for months before blowing up. An external audit catches them all at once.

How to migrate from Excel + email to a digital workflow

Most SMEs still manage approval with a master Excel of pending invoices and email forwards between departments. Migrating to the digital workflow happens in blocks, not big bang.

6-week migration checklist:

1. Week 1 — As-is map. Document the workflow as it exists: who signs what, what amounts, what tools. Without this, you don't know what to improve.
2. Week 2 — Approval policy. Define amount tiers, primary and backup approvers, SLA per tier. Sign policy.
3. Week 3 — Single mailbox. Create invoices@company.com and communicate it to the 20 main suppliers. They cover 80% of volume.
4. Week 4 — Connect tool. Configure the AP automation layer: mailbox intake, matching against POs, amount-based routing.
5. Week 5 — Pilot with top 20 suppliers. Validate matching, adjust tolerances, debug exceptions. Without affecting real accounting.
6. Week 6 — Progressive go-live. Activate the digital workflow for the 20 pilot suppliers. Keep Excel as backup only the first month. From the second, all volume.

Migration mistakes to avoid: launching for all 200 suppliers on day one, keeping the Excel running in parallel indefinitely (nobody uses the new system if the old one is still alive), and not training approvers on what variance flags mean.

Frequently asked questions

What's the difference between approval workflow and approval circuit?

They're synonymous in practice. "Workflow" emphasizes the invoice moving step by step; "circuit" emphasizes the closed set of controls. International terminology says invoice approval workflow. In formal documentation all three are used interchangeably.

How many approval levels does an SME need?

Three tiers cover 95% of cases. Four if there are board-level decisions. More than four adds bureaucracy without value. Rule: as many levels as distinct spend authorities exist in the company, not one more.

Who should design the workflow: Finance Director or IT lead?

The Finance Director, supported by operations. IT rolls out the tool; doesn't decide who approves what. The workflow is a financial policy, not technical. Final approval by the board or general management.

Does the same workflow work for direct expenses without PO?

The skeleton, yes, but step 3 (validation) changes. Instead of matching against PO, you validate against budget or cost center. A separate sub-flow is recommended for invoices without PO with mandatory justification from the approver.

How long does it take to roll out a digital workflow from scratch?

4 to 6 weeks for an SME with 200-1,000 invoices/month that already has an ERP and digital POs. Longer if POs are on paper or don't exist as such. Block-by-block migration (top 20 suppliers first) shortens risk.

How is success measured?

Five baseline KPIs: touchless rate (invoices approved without human intervention), average approval time, average variance detected, duplicates detected per month and percentage of invoices outside SLA. Top-quartile in these indicators processes most invoices in hours, not weeks.

Three takeaways

1. The five canonical steps — intake, identification, validation, approval, posting — are universal. What changes between companies is who executes them and how many are automated.
2. The workflow rests on three simultaneous pillars: amount-based levels, segregation of duties and audit trail. Drop one and control gets weak.
3. Migrating from Excel + email to digital is a 4-6 week operation if done in blocks. Starting with the top 20 suppliers brings risk down to the minimum.

To see how everything fits on your real invoices, see the AP automation pillar. You can also check pricing.

Related content

• Automating supplier invoice approval: complete guide
• Three-way matching: cross-check invoice, PO and delivery note line by line
• Invoice without PO: how to handle it in the workflow
• Exception management for AP
• How the invoice risk score works