Sustainable Business Management Shared Interest Group

Internal control - Purchase order creator and Vendor payment roles

  • 1.  Internal control - Purchase order creator and Vendor payment roles

    Posted 10-29-2025 07:47 PM

    To establish internal control that prevents a purchase order (PO) creator from also making payments to vendors, you can implement a segregation of duties (SoD) framework. Here's a simple and effective approach:

    Internal Control Framework: PO Creation vs. Vendor Payment

    1. Segregation of Duties (SoD)

    • PO Creator Role: Responsible for initiating and approving purchase orders.
    • Payment Processor Role: Responsible for verifying invoices and executing payments.
    • These roles should be assigned to different individuals or departments in your ERP system (e.g., SAP S/4HANA).

    2. Role-Based Access Control (RBAC)

    • Configure system roles so that users with PO creation rights cannot access payment functions.
    • Use authorization objects (e.g., object level authorization) to restrict access.

    3. Workflow Approval

    • Implement multi-level approval workflows:
      • PO approval by a manager or procurement head.
      • Invoice verification by accounts payable.
      • Payment release by treasury or finance controller.

    4. Audit Trail and Logging

    • Ensure all actions (PO creation, invoice posting, payment execution) are logged and auditable.
    • Use SAP audit logs or GRC tools to monitor for violations.

    5. Exception Reporting

    • Set up automated reports to flag any user who has access to both PO creation and payment functions.
    • Review these reports periodically for compliance.

    6. Periodic Access Review

    • Conduct quarterly or bi-annual reviews of user roles and access rights.
    • Remove any conflicting access to maintain control integrity.


    ------------------------------
    Eashwar Seshadri CMA
    Director/Manager
    IBM India Ltd
    Norristown PA
    United States
    ------------------------------