Invoice approval workflow: routing rules, thresholds and delegation that survive audit

An invoice approval workflow decides who must sign off on a supplier invoice before it is paid, based on rules such as amount, cost center and supplier. Build the approval matrix first, then the software. Automation routes invoices and records decisions. People still approve.

Approval projects usually stall on the matrix: nobody agreed it, or it contradicts how the business really works. This playbook starts there.

#Write the approval matrix first

An approval matrix is a table that answers one question for every invoice: who signs? Write it before you open any software, because the software will enforce whatever you give it, including rules nobody agrees with.

Here is an illustrative matrix. The amounts are examples only. Your policy and your risk appetite set the real ones.

Each row has a reason. Auto-approval for clean matches exists because routing a $60 matched invoice to a busy manager costs more than the risk. Non-PO invoices need an owner because no purchase order vouched for them. New suppliers and bank changes get extra steps because those are where payment fraud usually happens.

#Dimensions to decide

The matrix has to settle five inputs.

Amount. Decide whether bands apply to the invoice total or the supplier's cumulative spend. Splitting a $12,000 job into three $4,000 invoices to stay under a limit is an old trick, and a rule on cumulative spend per supplier per month catches it.

Cost center. Every cost center needs one named owner, and the list needs a review whenever the org chart changes. A routing rule that sends invoices to someone who left in March is the most common reason approvals stall.

Invoice type. PO-backed and non-PO invoices carry different risk, so treat them differently. A matched PO invoice has already been approved once, at the PO. Our accounts payable automation guide covers how matching and approval fit together.

Supplier risk. New suppliers, suppliers with recent bank changes and suppliers in sensitive categories (legal, consulting, anything touching customer data) deserve a second look.

Coding. If the invoice is coded to the wrong cost center, it goes to the wrong approver. Fix coding first or have the approver confirm it.

#Delegation and absence cover

Approval stalls when people go on holiday. Plan for it.

Let approvers name a delegate for a date range, with a limit. A delegate shouldn't gain a higher limit than the person they're covering for. When someone leaves, remove them and reassign their queue the same day.

Never share logins to "cover" an absence. An approval logged under the wrong name is worse than a late one, because it breaks the audit trail.

Escalation timers handle the rest. For example: a reminder after two working days, a nudge to the approver's manager after five, and a note to AP if the invoice nears its discount or due date. The exact numbers are your policy. What matters is that every invoice has a clock and nobody can leave one sitting unseen.

#What an agent can propose, and what it can't

An agent is useful at the edges of the workflow. It shouldn't sit at the center.

It can propose a cost center or an approver when the invoice is ambiguous ("this freight invoice matches the last four from the Rotterdam warehouse, coded to 5120"). Summaries are another job: the invoice and the match result boiled down to three lines the approver reads in ten seconds. It can chase approvers through email, Slack or Teams, and it can spot patterns such as the same approver rejecting every invoice from one supplier, or an invoice 30% above the supplier's usual.

It can't approve. Approval is an accountable act by a named person, and your auditors and your insurers will expect that. An agent can recommend, but the approver should see the recommendation as one input with its reasoning, and the approve button should never arrive pre-ticked. We'd rather make the approver's job faster than remove it. Our human in the loop AI guide covers the design patterns for review screens.

Key point: Automate the routing and the evidence, never the accountability. If you can't point to a named person who approved each payment, the workflow won't survive an audit.

#Segregation of duties in the rules

Encode these as hard blocks:

• The person who raised the PO can't approve the matching invoice.
• Nobody approves an invoice for a supplier whose bank details they edited.
• An approver can't approve an invoice they entered or coded themselves.
• Approval limits apply to the person, even if a delegate or a deputy is active.

A rule that only warns will be overridden at month-end. Block it, and let finance grant a logged exception.

#What the audit trail should show

An auditor asking about one payment wants to reconstruct it in minutes. Log these for each invoice, and keep them read-only:

• The invoice image and the extracted values at the time of approval.
• The match result and any variance accepted.
• Who approved, when, from which channel, and under which rule version.
• Whether the approver was acting as a delegate, and for whom.
• Any change the approver made to coding or amounts, with before and after values.
• The reason for each rejection.

The rule version matters more than people expect. If you change the matrix in June, you need to show which version applied to an invoice approved in May. See our glossary entry on the audit trail.

Approving by email reply is common and weak. A reply is easy to spoof and tough to tie to a person. Use single-sign-on links or approvals inside a work tool with proper identity.

#Exceptions

Some invoices won't fit the matrix: a disputed amount, a missing PO, a rejected coding. Send them to an exception queue with an owner, a reason code and a due date. Without those three, they pile up in the AP inbox.

#How to build it

1. Export a year of invoices with amounts, cost centers and approvers. See what approvals really happened.
2. Draft the matrix with finance, procurement and two or three business approvers. Test it against the export: how many invoices would each row have caught?
3. List cost center owners and delegates. Fix gaps now.
4. Encode the matrix and segregation rules in a workflow tool. Version the rules.
5. Add reminders, escalation and delegation.
6. Run in shadow mode for a few weeks: route as normal, while the new workflow shows who it would have sent each invoice to.
7. Go live for one invoice type, such as PO-backed invoices over a set value, then widen.
8. Review quarterly: approval time by approver, override rate, rejection reasons and invoices that skipped a row.

For the end-to-end flow around approval, see the procure to pay blueprint.

#When software is enough

If you have three approvers and a hundred invoices a month, the approval feature in your accounting system, plus a clear policy, is probably enough. Custom routing starts to pay for itself with several entities, project-based approvals, more cost centers than a spreadsheet can track, or a policy that your current tool can't express.

If your approvals are slow or hard to audit, book a strategy call. Bring your current matrix, or the policy that stands in for one, and we'll show you what could be automated.

#Frequently asked questions

#What is an invoice approval workflow?

It's the set of rules and steps that route a supplier invoice to the right people for sign-off before payment. It usually depends on amount, cost center, invoice type and supplier risk, and it records who approved what and when.

#What should an approval matrix include?

Approval bands by amount, a named owner for every cost center, extra rules for non-PO invoices and new suppliers, delegation limits and escalation timers. It should also list who owns the matrix and when it is reviewed.

#Can invoices be approved automatically?

Low-value invoices that match a PO and pass every check can be auto-approved under a written policy. Log each auto-approval, sample them regularly and set a clear ceiling. Anything outside the policy goes to a person.

#How do we handle approvers who are away?

Let them assign a delegate for set dates, with the same or a lower limit than their own. Add escalation so an invoice moves to a manager or AP if it waits too long. Don't share logins.

#Is approving invoices by email secure enough?

Plain email replies are weak evidence of identity. Prefer approval links tied to single sign-on, or approvals inside a tool such as Teams or Slack where the user is authenticated.