Factory Payment Controls: Separate Request, Receipt, Approval and Release

A carton invoice can be correct while the payment is wrong. The price may match the purchase order and the cartons may have arrived. A manager may also have approved the expense. Yet the factory could still pay twice or forget an advance. It could also send money to an account the supplier never authorised.

Factory payment controls must follow the transaction beyond the invoice. They connect the need to buy, the agreed terms, the receipt, the amount due, the payee, and the bank result. Each step answers a different question. A signature at one step does not settle the questions at the others.

The worked case below uses invented figures in currency units, shown as CU. It follows one carton purchase through a partial delivery, a return, a credit, and an advance. These are management control examples. The contract and applicable law still determine the factory's payment duties.

Decide what each approval means

An approved request means that someone with the right authority accepts the proposed purchase. It does not prove that the supplier delivered it. A receiving record confirms what arrived. The quality decision states what the factory accepted for the agreed purpose. Those records may be completed at different times.

The invoice review checks the supplier's claim against the order and receipt. Payment approval accepts a specific amount, payee, and date. Bank release sends the instruction. The later bank result shows whether the transfer succeeded.

This sequence gives a payment file a clear history. When a supplier asks about an unpaid bill, finance can find the open step. Staff need not collect the same signatures again. Stores staff can also see what their signature means. A receipt form should not quietly grant permission to pay.

The GAO Green Book sets out which duties to keep apart: authority, custody and accounting. Where staffing is limited, other controls may be needed. This is a US federal framework, used here as a design reference. It is not a legal rule for every apparel factory.

Give each handoff a named owner

The control should make sense to the person doing the work. A storekeeper can count cartons and record damage. Checking an overseas bank account may be outside that person's role. So may deciding which advance applies to this delivery.

A practical division might look like this:

This table describes roles, not a minimum headcount. In a small factory, one person may prepare invoices and draft the payment list. An owner or finance manager can then review the records. That person releases payment using their own authorised user account. The reviewer needs access to the evidence, rather than a summary prepared by the same person.

Two approvals add little if both people rely on the same unchecked email. A deputy using the first approver's password adds no independent check. Set up named access and a planned substitute for leave or absence. Otherwise a routine payment deadline can become the excuse for losing the separation.

No design guarantees that fraud or mistakes will never occur. Collusion and management override remain limits, as the Green Book explains. The review needs to show that the control worked on this payment. The number of signatures in the policy cannot prove that.

Apply authority to the whole commitment

An approval limit needs a clear basis. Does it cover the purchase price alone, or the total including freight and tax? Which currency is used, and who checks the conversion for an overseas order? Without those rules, two managers can apply the same limit to different amounts.

Review the commitment being made, not just the invoice currently on the desk. A contract paid in instalments can commit the factory to more than any one payment. Show related purchases and later order changes to the person who can approve the full commitment. Dividing the paperwork does not reduce the obligation.

The chart should also distinguish budget approval from permission to release cash. A budget may allow the purchase, but the invoice can still contain an error. A valid invoice may be due before the planned cash receipt arrives. Finance needs an approved way to resolve the cash gap. Changing the receipt or invoice evidence will not solve it.

A manager with a personal interest in a supplier should declare it. Route the decision to a suitable independent reviewer. The record should show who made the decision and on what basis. A low value does not remove a conflict, and a senior job title does not make a personal purchase a factory expense.

Follow the quantity before calculating the payment

Suppose a factory orders 10,000 cartons at CU0.80 each. The original order value is CU8,000. The example excludes tax, freight and bank fees. It also excludes exchange differences, so the goods balance is clear.

The supplier delivers 6,000 cartons. Receiving and quality staff accept 5,800 and identify 200 damaged cartons. The damaged cartons are returned. The supplier agrees to cancel those 200 units and issues a credit at the original price. The approved order is changed to reflect this agreement. The supplier will still deliver the remaining 4,000 cartons.

The original quantity reconciles: 5,800 + 200 + 4,000 = 10,000 cartons. The revised supply commitment is 9,800 cartons, comprising the accepted 5,800 and the 4,000 still due. There is no replacement order for the returned 200 in this case.

Those details matter. If the supplier had promised replacements, the open quantity would be different. If the goods were merely on hold at the factory, describing them as returned would be wrong. If the credit were still disputed, finance could not treat it as agreed.

For fabric purchases, the same distinction appears at roll level. ApparelDiary's receiving checklist separates identification, quantity, condition, and acceptance evidence. Use the status that those checks produced. Do not change it just to make an invoice match.

Reconcile the amount due with the advance

Assume the contract allows payment for accepted parts of an order. The stated terms still apply. The factory has already paid CU2,000 in advance. Both parties agree to apply the whole advance to the first shipment. These terms belong to this example. Check the agreement before applying them to another supplier.

The supplier invoices the 6,000 delivered cartons at CU0.80, giving CU4,800. The approved credit for the 200 returned cartons is CU160. The accepted first shipment therefore has a net value of CU4,640.

List the record numbers for the invoice, credit and advance in the payment proposal. CU2,640 alone does not explain the deduction. The bank approver needs to see why the full invoice amount is not being paid.

The remaining 4,000 cartons have a value of CU3,200. Once those goods are supplied and paid under the assumed terms, the amended order is fully settled. Total cash paid is CU2,000 + CU2,640 + CU3,200 = CU7,840. That equals 9,800 × CU0.80. The cancellation reduces the original commitment by CU160. This matches the agreed return credit.

ACCA's example shows two sets of records: the supplier account and the general ledger. Both change when purchases and payments are entered. In this factory case, the supplier account connects the invoice, credit and advance. It also shows the final payment.

A hold on payment does not by itself erase an accounting liability. Nor does the control team gain a right to delay a valid contractual payment. Finance must check the terms of each dispute and the payment due date. It must also choose the right accounting treatment. Keep those decisions visible alongside the operational hold.

Treat duplicate alerts as questions to resolve

Now suppose the carton invoice arrives by email and through a supplier portal. Both copies are genuine, but they represent one claim. Two clerks may miss that link and prepare separate CU2,640 payments. Each worksheet could apply the same credit and advance.

If both transfers succeed, the extra cash paid is CU2,640. With the earlier advance, total cash paid is CU7,280. The first shipment's net value is only CU4,640. A later supplier refund may correct the cash position, but it does not make the duplicate payment harmless.

Build the check around supplier identity, invoice reference, currency, amount, and date. A search field may ignore spaces or punctuation to find possible matches. Still keep the original invoice reference. Similar references can belong to different invoices, so an alert needs review before anyone deletes or merges a record.

The reviewer should be able to see why the alert was cleared. A duplicate copy can point to the original approved invoice. A valid second invoice needs its own evidence, such as a different delivery or service period. A credit note should retain its link to the invoice that it adjusts.

Supplier statements help reveal missing bills and unapplied credits. The statement total is not a new invoice to pay. Reconcile its lines with the factory's supplier account. Otherwise a statement payment can settle items already included in an invoice run.

Verify bank changes through a separate route

An invoice can survive every price and quantity check while carrying a false bank account. The FBI's fraud guidance describes false requests from apparently familiar contacts. It recommends checking payment changes through a separate route. Avoid contact details supplied by a possible scammer.

Apply that principle before changing the supplier master record. Use a trusted contact route established earlier or obtained independently. Record who confirmed the request, how contact was made, what changed, and who approved the update. If someone has gained access to that email account, another reply within it is not an independent check.

In the carton case, a request to change the bank account arrives after the invoice approval. The approved CU2,640 amount remains supported, but the destination is unresolved. Keep the payment on hold until the change passes the agreed check. Do not make the change appear older by replacing the original bank record without a history.

The verification should cover the exact account to be used. A supplier's legal name may differ from its trading or bank account name. There can be valid reasons, but an unexplained difference needs review. Payment to a factor or other third party needs proof that the arrangement is approved. A familiar logo on a letter is not enough.

Approve the list that the bank will receive

The next payment batch includes the carton amount of CU2,640. It also contains two approved payments of CU960 and CU400. The proposed total is CU4,000 across three payments. The carton account change remains unresolved, so only the other two are released.

Both controls reconcile. The three proposed payments become one held plus two released. The CU4,000 becomes CU2,640 plus CU1,360. The held amount stays on the exception list. It does not quietly disappear when finance reports the completed run.

A total is necessary but cannot prove the destinations are right. Someone could change an account number without changing CU1,360. The bank approver must compare payees, amounts and references with the approved list. Any later changes also need review.

The Charity Commission's CC8 guidance gives examples of order, receipt and invoice checks. It also covers dual online approval and controls over batch files. The files should stay unchanged from preparation to upload. CC8's legal audience is charities in England and Wales. These features can inform factory controls without creating factory-specific legal duties.

If a payment status is unclear, check the bank result before sending it again. A screen timeout does not establish that the bank rejected the transfer. Mark each payment as accepted, rejected, pending or returned. Keep its reference and resolve each open item. Retrying an uncertain instruction can create the duplicate that the invoice check prevented.

Design routes for services, advances, and emergencies

Not every purchase produces a stack of cartons. A machine repair needs evidence of the agreed work and completion, with any open defects stated. For a regular utility bill, check the account, period and terms. Review any unusual charges. These routes need suitable evidence even when no goods receipt exists.

An advance approval should explain why payment is due before delivery. Link it to the agreement and state how the money will be recovered or applied. Assign an owner to follow the open advance. Otherwise staff may pay the delivery in full. The old advance can remain hidden in another account.

An urgent spare-part purchase should use a defined exception route. Explain why the spare is needed and how the supplier and price were chosen. Record the approved amount and who will accept delivery. Agree emergency authority before a breakdown. Include who can act outside normal hours.

The exception cannot become permission to invent a receipt or approve a blank payment. If normal evidence is late, record what is missing and why payment is going ahead. Name the person who will close the gap. Any route still has to respect the contract, local law, and the bank's controls.

Repeated emergencies deserve a separate operating review. Critical spare-parts planning can reduce some urgent purchases. It does not replace the payment evidence for an emergency that has already occurred.

Match system access to the real roles

A written approval chart can be undermined by broad system access. Can a payment preparer create a supplier and edit its bank account? Can that person also approve an invoice and release the transfer? The issue is what the account permits, not the user's job title.

Remove unnecessary rights and review access when staff move roles or leave. Shared accounts make it hard to establish who changed a record. Log changes made through privileged access. Give an independent person a clear way to review them.

Protect finance email and banking access with suitable multi-factor authentication. The Canadian Centre for Cyber Security explains why phishing-resistant methods matter. Some attacks can defeat other forms of authentication. The IT team should assess the supported options for each service.

Strong login protection and sound commercial approval address different questions. A valid user can still authorise the wrong invoice. Conversely, a valid invoice can be redirected through a compromised account. The factory needs both kinds of protection. Its access-recovery plan should also work when the usual person is absent.

Review exceptions without rewarding delay

An exception log should show the supplier, amount, reason, owner, due date, and next action. Distinguish an unverified bank change from a damaged-goods dispute or an invoice missing its receipt. Different problems need different evidence and people.

Review overdue items against contractual dates. A growing queue can mean nobody is able to find the approver. Keeping money in the bank does not make that a sound control. Escalation should help staff resolve the evidence rather than encourage them to bypass it.

Monitor the age of open advances and overdue credits. Also track returned transfers, repeated invoice alerts and payments released through exceptions. Define what each count includes. A duplicate alert that turns out to be a valid bill is not a confirmed saving. A held payment is not proof of fraud.

After release, compare the bank record with the authorised list and supplier account. Give unexplained differences an owner. A sound batch approval can still be followed by a rejected transfer or an extra fee. The review can also find payments posted to the wrong supplier.

Respond quickly when money may have gone astray

If staff suspect a fraudulent payment, contact the bank at once through its official channel. Involve the responsible IT person too. That is consistent with the UK NCSC's payment-fraud response guidance. Acting quickly may help the bank recover the money. It does not guarantee a refund.

Preserve the payment reference, messages, bank-change records, and approval history for the investigation. Follow the reporting route that applies to the factory's jurisdiction and incident. The NCSC's reporting instructions apply to UK organisations. Other countries have their own routes.

Avoid another payment based only on an urgent claim that the first one failed. Establish the bank status and confirm the supplier's position through the trusted route. The response must stop the problem from spreading while the first transaction is investigated.

Test the complete route before relying on it

Choose one ordinary payment and follow it from request to bank statement. Then test a partial receipt with an advance and a credit. Use further controlled cases for a repeated invoice and a bank change. Use a test environment or a documented walkthrough; do not release real test payments by accident.

Ask the person covering an absence to complete the same review. If only the usual clerk knows where evidence is stored, the process is fragile. If the approver cannot see a changed account, the approval screen is incomplete.

Even without an ERP, a factory can keep a controlled payment register. Link it to a shared evidence folder. Give each payment a unique reference and link the supporting files to it. Separate editable working sheets from the approved version used for release. Restrict who can change the approved file and retain corrections rather than silently replacing the record.

For paper evidence, use the same reference on the payment cover sheet and each supporting document. Record where the originals are held. A scanned approval must show which version and amount were approved. The reviewer needs to be able to trace both. These arrangements need testing just as much as an automated workflow does.

The aim is a payment that another authorised reviewer can reconstruct. For the carton order, that means explaining the revised 9,800-unit commitment and CU4,640 accepted shipment. It also means tracing the CU2,000 advance and CU2,640 due. The record must show where the amount went and what the bank reported. That complete trail makes the control useful in daily factory work.

References

• GAO: Standards for Internal Control in the Federal Government, 2025.

• ACCA: Sales and purchases in a computerised accounting system.

• FBI: Business Email Compromise.

• Charity Commission: Internal financial controls for charities, CC8.

• Canadian Centre for Cyber Security: Phishing-resistant multi-factor authentication.

• NCSC: Business payment fraud.