What large firms actually do to speed up payment approvals

Large firms streamline treasury payment approvals by building a tiered system where most routine payments move through automatically, while only high-risk or high-dollar transactions require human review. The core method is segregation of duties—splitting the request, approval, and execution steps across different people so no single person can move money without oversight. Most firms also set dollar thresholds: a $5,000 vendor invoice might need one signature, a $50,000 wire might need two, and a $500,000 acquisition payment might need three plus a committee sign-off.

The second layer is payment automation software that sits between your accounting system and your bank. Tools like Kyriba, Bottomline, or Coupa Treasury let you define approval rules once, then the system enforces them automatically. When an invoice arrives, the software checks it against your vendor master file, matches it to a purchase order, and either approves it outright or routes it to the right person based on amount, vendor, and payment type. This removes the step where someone manually hunts down an approver and waits for an email response.

The third layer is bank-level controls. Most large firms use positive pay (you send the bank a list of checks you plan to issue, and the bank rejects anything that doesn't match) or ACH debit blocks (you tell the bank to reject any ACH pull from your account unless you pre-authorize it). These catch fraud and mistakes that slip through internal approvals.

Key Takeaways

  • Tiered approval thresholds—where smaller payments need fewer signatures than large ones—reduce bottlenecks while keeping high-risk transactions under control.
  • Segregation of duties means the person requesting a payment, the person approving it, and the person executing it must be different people to prevent fraud.
  • Payment automation software enforces approval rules consistently and routes transactions to the right approver without manual email chains.
  • Bank-level controls like positive pay and ACH debit blocks catch fraud and errors that internal approvals miss.
  • Vendor master file maintenance—keeping your list of approved suppliers current and accurate—prevents payments to fraudulent or outdated accounts.

Setting up approval thresholds that actually work

Thresholds need to reflect both your firm's risk tolerance and the cost of delay. A $1,000 threshold that requires three signatures might catch fraud, but it also means your accounts payable team spends half their day hunting down approvers for routine vendor payments. Most firms use a structure like: under $10,000 requires one approval (often delegated to a department head), $10,000 to $100,000 requires two (department head plus finance controller), and over $100,000 requires three plus a treasury committee or CFO sign-off.

The threshold should also vary by payment type. A recurring monthly utility bill to an established vendor might have a lower threshold than a one-time payment to a new supplier, even if the dollar amount is the same. A wire transfer to a new bank account should always require higher scrutiny than an ACH to an existing vendor account. Some firms use a matrix: routine payments to approved vendors get one approval, new vendors or new payment methods get two, and anything over a certain dollar amount gets three regardless of vendor status.

Document your thresholds in writing and update them annually. As your firm grows, your thresholds may need to shift. A $50,000 threshold that made sense when you had $10 million in annual spend might be too low when you have $100 million.

How segregation of duties prevents fraud and errors

Segregation of duties means no single person can request, approve, and execute a payment. The person who creates a purchase order should not be the person who approves the invoice. The person who approves the payment should not be the person who initiates the wire. The person who reconciles the bank statement should not be the person who approves payments.

This works because it forces collusion: a fraudster cannot simply request a fake invoice and approve it themselves. They need at least one other person to either not notice the fraud or actively participate in it. Most fraud happens because one person has too much control, not because multiple people conspired.

In practice, this means your payment approval workflow should look like: (1) department submits invoice or payment request, (2) accounts payable matches it to a purchase order and vendor master file, (3) a different person (finance manager or controller) approves based on your thresholds, (4) treasury or accounting executes the payment, (5) a fourth person reconciles it against the bank statement. If your firm is small and you cannot split all five roles, split at least three: request, approval, and execution must be different people.

Using automation software to enforce approvals consistently

Payment automation software replaces the email chain. Instead of an accounts payable clerk sending an approval request to a manager and waiting two days for a response, the software routes the transaction automatically based on rules you set once and never change.

The software connects to your accounting system (SAP, Oracle, NetSuite) and your bank. When an invoice is entered, the software checks it against your vendor master file, matches it to a purchase order if one exists, and calculates whether it needs approval. If it does, the software sends a notification to the right approver—not an email that might get lost, but an alert in the software itself that the approver must respond to. The approver sees the invoice, the PO, the vendor details, and the approval rule all in one place. They click approve or reject. If approved, the software schedules the payment for the right date and method (ACH, wire, check) and sends it to the bank.

The benefit is consistency and speed. Every $50,000 wire gets the same scrutiny. Every new vendor gets flagged for review. Every payment is logged with a timestamp and the approver's name. When the bank statement arrives, you can trace every transaction back to the approval record.

Common platforms include Kyriba (owned by Sage), Bottomline Technologies, Coupa Treasury, and Nuvei. Most integrate with major accounting systems and most major banks. Implementation usually takes three to six months and costs between $50,000 and $500,000 depending on your transaction volume and complexity.

Maintaining a vendor master file that prevents misdirected payments

A vendor master file is your list of approved suppliers, their addresses, and their bank account details. It is the single source of truth for where money should go. When an invoice arrives, your system checks it against this file. If the vendor is not on the list, or if the bank account number does not match the file, the payment gets flagged for review.

The file should include: vendor name, address, tax ID, primary contact, phone number, email, bank account number, routing number, payment terms, and approval limits (some vendors might be approved only up to $10,000 per transaction). Update it quarterly at minimum. Remove vendors you no longer use. When a vendor tells you their bank account has changed, verify the change directly with them—call the number on their website, not the number in their email—before updating the file.

A common fraud is a fake invoice from a vendor that looks real but directs payment to a different bank account. The vendor master file catches this: the payment system sees the account number does not match the file and flags it. This is why the file must be accurate and why changes must be verified.

Bank-level controls that catch what internal approvals miss

Positive pay is a service most banks offer. You send the bank a file each day listing every check you plan to issue: check number, amount, and payee. The bank compares incoming checks against this list. If a check arrives that is not on the list, the bank holds it and calls you. This catches forged checks and altered checks that your internal controls missed.

ACH debit blocks prevent anyone from pulling money from your account via ACH without your permission. You tell the bank to reject all ACH debits by default. When a legitimate vendor needs to pull a payment (payroll processor, insurance company), you pre-authorize that specific transaction or that specific vendor. This stops fraudsters from setting up fake ACH debits to drain your account.

Wire transfer limits let you set a daily or per-transaction cap on wire transfers. You might allow up to $500,000 per wire, but no more than $2 million per day. If someone tries to wire $10 million, the bank rejects it and calls you. This is especially useful for firms that do not wire large amounts regularly.

Dual control on wires means the bank requires two people from your firm to authorize any wire over a certain amount. You and your CFO both log into the bank portal and approve the wire independently. The bank will not execute it until both approvals are in.

What happens when approval breaks down

When a payment is approved but should not have been—a fraudulent invoice got through, or an approver made a mistake—your recovery options depend on the payment method and how quickly you catch it.

For checks, call your bank immediately and ask them to stop payment. If the check has not cleared, the bank can put a stop on it. If it has cleared, you can try to recover the money from the payee, but this is difficult and often unsuccessful.

For ACH transfers, you have one business day to dispute the transaction. Call your bank and file a dispute. The bank will attempt to recover the funds from the receiving bank. Success rates vary, but most banks will try. After one business day, your options are limited.

For wire transfers, recovery is nearly impossible. Wires are final. Once the money leaves your bank, the receiving bank has it. You can ask the receiving bank to return it, but they have no obligation to do so. This is why wires require the highest level of approval and the most scrutiny.

The lesson: prevention is far cheaper than recovery. Spend time on approvals, vendor verification, and bank controls upfront. Do not rely on catching fraud after the money has left your account.

Frequently Asked Questions

How many approval levels do we actually need?

Most firms use two to three levels based on dollar amount. Under $25,000 might need one approval, $25,000 to $250,000 might need two, and over $250,000 might need three. The exact thresholds depend on your firm size, risk tolerance, and industry. A financial services firm might use lower thresholds than a manufacturing firm. Review your thresholds annually and adjust as your firm grows.

Can we automate approvals for recurring payments?

Yes. Once you have approved a recurring payment (payroll, rent, insurance), you can set it to auto-approve in your payment software. The software will execute it on the scheduled date without human review each time. You should still reconcile it monthly against your bank statement to catch changes or fraud, but the approval step can be automated for truly routine payments.

What if an approver is out of the office?

Set up a delegation rule in your payment software. When an approver is out, their approval authority transfers to a backup person (usually their manager or a peer). Document this in writing and update it quarterly. Do not let payments pile up waiting for someone to return from vacation.

How do we handle payments to new vendors?

New vendors should always require higher approval and more scrutiny. Verify the vendor's tax ID and business registration. Call them directly to confirm their bank account details. Do not rely on information in an email. Have a policy that new vendors require two approvals regardless of dollar amount, and that the first payment to a new vendor is always reviewed by someone in finance or treasury.

What should we do if we discover a fraudulent payment?

Call your bank immediately. For checks and ACH, you may be able to stop or reverse the payment if you catch it quickly. For wires, contact the receiving bank and ask them to return the funds, though success is unlikely. File a police report and notify your insurance company. Review your approval logs to see how the fraud got through and tighten your controls to prevent it again.