Definitions of key accounts payable, vendor compliance, and fraud prevention terms used by AP teams and auditors.
Accounts payable refers to the money a company owes to its vendors and suppliers for goods or services received but not yet paid for. The AP function manages the process of receiving invoices, verifying them against purchase orders, obtaining approvals, and processing payments.
AP automation is the use of software to streamline and automate accounts payable processes — including invoice capture, data extraction, approval routing, and payment processing — reducing manual data entry and the risk of human error.
An audit trail is a chronological, tamper-evident record of every action taken in a system — who did what, when, and from which device. In accounts payable, a complete audit trail logs every vendor creation, bank account change, document upload, approval decision, and payment action.
Business Email Compromise (BEC) is a type of fraud in which an attacker impersonates a trusted party — typically a vendor, executive, or employee — via email to trick AP staff into changing a vendor's bank account details or processing a fraudulent payment. The FBI IC3 reported over $2.9 billion in BEC losses in 2023.
A compensating control is an alternative internal control that mitigates a risk when the primary control cannot be implemented. In accounts payable, a common compensating control for a segregation of duties violation is a mandatory manager review and sign-off on any payment processed by the same person who created the vendor.
An Employer Identification Number (EIN) is a nine-digit number assigned by the IRS to identify a business entity for tax purposes. Vendors provide their EIN on a W-9 form. AP teams use the EIN to issue 1099-NEC forms at year-end and to verify vendor identity.
A ghost vendor is a fictitious vendor record created in a company's vendor master file for the purpose of fraudulently diverting payments. Ghost vendors typically have no W-9 on file, no verifiable contact information, and no legitimate business relationship with the company.
Internal controls are the policies, procedures, and systems a company uses to safeguard assets, ensure the accuracy of financial records, and prevent fraud. In accounts payable, key internal controls include segregation of duties, vendor change approval workflows, W-9 collection requirements, payment authorization limits, and audit trail maintenance.
Form 1099-NEC (Nonemployee Compensation) is an IRS tax form used to report payments of $600 or more made to non-employee vendors, contractors, and service providers during a calendar year. A current W-9 on file for each vendor is required to issue a correct 1099-NEC.
A purchase order (PO) is a formal document issued by a buyer to a vendor that authorizes a specific purchase. It specifies the items, quantities, agreed prices, and delivery terms. In AP, purchase orders are used as part of the three-way match process.
Segregation of duties (SoD) is an internal control principle that requires critical business functions to be divided among multiple employees so that no single person has end-to-end control over a process. In accounts payable, SoD means the person who creates a vendor should not be the same person who approves or processes payments to that vendor.
Social engineering is the use of psychological manipulation to trick individuals into divulging confidential information or taking actions that compromise security. In AP fraud, social engineering typically involves impersonating a vendor or executive to convince an AP employee to update payment details.
The Sarbanes-Oxley Act (SOX) is a U.S. federal law that requires public companies to maintain and document internal controls over financial reporting. SOX Section 404 requires management to assess the effectiveness of internal controls annually. AP controls — including segregation of duties, approval workflows, and audit trails — are a key component of SOX compliance.
A Taxpayer Identification Number (TIN) is a unique identifier assigned by the IRS to individuals and businesses for tax purposes. For businesses, the TIN is typically the EIN. For individuals, it is the Social Security Number (SSN). AP teams collect TINs via W-9 forms to issue 1099s.
Three-way match is an AP control process that verifies an invoice by comparing it against three documents: the original purchase order, the receiving report, and the vendor invoice. All three must agree on quantity, price, and terms before payment is approved.
Vendor change monitoring is the practice of automatically detecting and alerting on changes to vendor records — including bank account numbers, payment methods, billing addresses, contact names, and email addresses. Automated monitoring is a key control for preventing BEC fraud and insider manipulation of the vendor master file.
Vendor fraud encompasses a range of fraudulent schemes targeting the accounts payable function, including ghost vendors, invoice fraud, BEC attacks, and insider manipulation of the vendor master file. The ACFE reports that AP fraud is among the most common and costly forms of occupational fraud.
The vendor master file is the central database of all approved vendors in an organization's accounting or AP system. It contains vendor names, addresses, payment details, tax IDs, and contact information. The vendor master file is a high-value target for fraud because unauthorized changes can redirect payments.
IRS Form W-9 (Request for Taxpayer Identification Number and Certification) is a form that vendors complete to provide their legal name, business type, and Tax ID (EIN or SSN). AP teams collect W-9s from every vendor paid $600 or more in a calendar year to support 1099-NEC filing at year-end.