Procure to pay — the controls that stop you paying twice

Procure to pay runs from deciding to buy something to the money leaving your account. It is the mirror of order to cash, and it fails differently: the receivables side loses money slowly through inattention, the payables side loses it quickly through duplication.

The entries#

Recording a bill recognises the cost and the liability:

Account	Debit	Credit
6300 · Professional Fees	2,000.00
1310 · GST/HST Recoverable	260.00
2100 · Accounts Payable		2,260.00
Total	2,260.00	2,260.00

Paying it touches no expense account:

Account	Debit	Credit
2100 · Accounts Payable	2,260.00
1000 · Bank		2,260.00
Total	2,260.00	2,260.00

The double-count is the most common error in small-business payables, and it is self-concealing: expenses look high, payables never clear, and both look like ordinary growth until someone reconciles the control account.

The three-way match#

The classic control compares three documents before payment:

• The purchase order — what you agreed to buy, at what price.
• The receipt — what actually arrived.
• The invoice — what you are being asked to pay.

All three should agree. Where they do not, you have either a delivery problem or a billing problem, and finding out before payment is considerably cheaper than after.

Most small companies do not run purchase orders, and that is a reasonable trade — the overhead is real. But dropping the PO means dropping the only record of what price was agreed, so the invoice becomes self-certifying. If you skip it, at least keep the quote or the contract, and check the invoice against it for anything material.

Where duplicate payments come from#

Rarely from fraud. Almost always from these:

The same invoice entered twice — once from a PDF, once from a statement, or twice by two people. Enforcing unique supplier invoice numbers catches nearly all of it, and most systems will if you let them.

Paying from a statement rather than an invoice. A supplier statement lists everything outstanding, including things already paid but not yet cleared on their side.

Paying an invoice that was already paid by card. The card payment went through the bank feed as an expense; the invoice went through payables. Two records, one purchase, two payments.

Supplier setup is the security boundary#

The highest-risk action in payables is not paying an invoice. It is changing where a supplier's money goes.

Payment-redirection fraud works by emailing a plausible request to update bank details, usually from a lookalike address, usually referencing a real invoice. It succeeds because updating a payee feels administrative rather than financial.

The control is to verify any change to banking details out of band — a phone call to a number you already had, not the one in the email — and to keep supplier setup separate from payment approval wherever the team is big enough to allow it. Segregation of duties covers what to do when it is not.

What to watch#

Aged payables tell you what you owe and when it fell due — and, read the other way, whether you are quietly funding the business on supplier credit.

Unrecorded liabilities are the reverse of unbilled revenue: costs incurred, invoice not yet arrived. They belong in the period they were incurred, which is what the accrual step in the close exists for.

Duplicate supplier records. "ACME Ltd" and "Acme Limited" are two suppliers as far as any duplicate-detection goes, and one of the reasons the same invoice can be entered twice without anything objecting.