Disbursement Controls Resource · Assessment Tools

Disbursement Controls Checklist

A practical assessment & implementation tool for finance leaders

PDF Download printable version DOCX Download editable Word version

About this checklist: Designed as both a diagnostic tool and an implementation guide for CFOs, Controllers, Directors of Financial Operations, and AP managers who are building or strengthening their organization's disbursement control environment. It is organized into eight control domains that span the full disbursement lifecycle — from vendor onboarding through payment execution, fraud prevention, monitoring, and governance — and directly corresponds to the content at DisbursementControls.com. Use it to assess your current state, identify gaps, assign remediation priorities, and document evidence of control effectiveness for internal audit or management reporting purposes.

How to use it: For each control item, mark your rating using the guide below. Ratings update as you go and your score tallies live per section, with a running summary at the end.

Rating	What It Means
✓ In Place	Control is documented, consistently applied, and tested or verified.
◕ Partial	Control exists but has gaps in documentation, consistency, or scope. A priority for strengthening.
✗ Gap / Missing	Control is absent or not functioning — a vulnerability. Prioritize remediation by the risk exposure of that domain.
N/A	Control does not apply to this organization's structure or payment methods.

Section 1: Vendor Onboarding & Verification 0 / 12

Formal vendor request process in place with documented business justification

Vendor identity verified using primary source documentsW-9 (domestic) or W-8BEN (foreign) on file · Business registration / Secretary of State confirmation · EIN/TIN confirmed via IRS TIN Match or equivalent

Vendor authentication completed prior to onboardingLegal entity name matches government records · Business address independently verified · Beneficial ownership documented (where required)

Vendor banking information collected through secure channelEncrypted vendor portal OR signed, notarized bank letter · NOT collected via email or unencrypted web form

Banking details independently verified before first paymentCallback verification to known phone number on file · Micro-deposit confirmation for ACH · Verbal confirmation from authorized officer at vendor · Automated bank account verification system

OFAC/SDN sanctions screening completedRequired — strict liability

Excluded parties / debarment screening completed (SAM.gov for federal contractors; LEIE for health care)

Conflict of interest disclosure obtained from requesting employee

Vendor approved by authorized personnel per approval matrix

Vendor master record created only by authorized AP/procurement staff (not the requestor)

Segregation of duties enforced: vendor creation separated from payment authorization

Duplicate vendor check completed (name, TIN, phone, address, banking)

Section 2: Vendor Master File Management 0 / 9

Access to vendor master file restricted to designated personnel

All changes to vendor banking details require re-verification (callback + written confirmation)

Changes to vendor banking details require dual approval

Email requests to change banking information are never processed without out-of-band confirmationCritical BEC defense

Changes to banking details independently reverified before next paymentCritical disbursement control

Audit log maintained for all vendor record changes (who, what, when)

Periodic review of vendor master file conducted (at minimum annually)Identify dormant vendors for deactivation · Re-screen active vendors against OFAC/debarment lists · Confirm banking details for key vendors

Vendor portal access credentials reviewed and pruned regularly

Temporary or one-time vendors subject to same verification as ongoing vendors

Section 3: Invoice Processing Controls 0 / 10

Three-way match performed for goods-based invoices (PO + receipt + invoice)Where applicable

Invoice verified against approved purchase order or contract

Invoices submitted through official, documented channels (not personal email)

Invoice duplicates checked prior to approval (invoice number, amount, vendor, date)

Invoice amounts within authorized contract or PO scope

Invoices from unfamiliar or newly added vendors flagged for enhanced review

Round-number or recurring same-amount invoices reviewed for legitimacy

Invoice approver is independent of the vendor relationship and payment execution

Approval hierarchy enforced based on invoice dollar amountDocumented dollar-threshold approval matrix in place · CFO/executive approval required above defined threshold

Emergency or rush invoices subject to same controls as routine invoices (no exceptions)

Section 4: Payment Authorization & Execution 0 / 13

Dual authorization required for payments above defined threshold

Payment authorizers are independent of invoice preparers (segregation of duties)

Payment authorizers verify payee name matches approved vendor master record

Payment authorizers verify bank account details match vendor master recordDo not rely on email

Wire transfers above defined threshold require out-of-band executive confirmation

Urgent / same-day payment requests treated with heightened skepticismCommon BEC trigger

Payment method selected per documented policy (ACH, wire, check, virtual card)

ACH debit blocks or filters in place to prevent unauthorized debits

Positive Pay enrolled for check paymentsVerify with your bank

Wire transfer callback procedures in place for large or first-time wires

Virtual cards used where feasible to limit exposure and enable easy cancellation

Real-time payment use governed by policy (irrecoverable; heightened pre-payment verification required)

Payment instructions received by email are verified through independent channel before execution

Section 5: Fraud Prevention — External Threats 0 / 10

Business Email Compromise (BEC) awareness training provided to all AP and treasury staffTraining includes recognition of urgency, authority and secrecy cues · Training updated at minimum annually

Email authentication protocols deployed (SPF, DKIM, DMARC)Engage IT

Domain monitoring in place to detect spoofed or lookalike domains

"No-exceptions" policy for email-only vendor bank account change requestsPolicy must be written

Vendor impersonation scenario included in training and tabletop exercises

Vendor portal uses multi-factor authentication for all submissions

Callbacks for account changes use phone numbers from independent records (not numbers in the request)

AI-generated communication awareness included in BEC trainingRapidly growing threat

Incident response procedure defined for suspected payment fraud

Incident response includes immediate bank contact for potential recall / SWIFT gpi trace

Section 6: Fraud Prevention — Internal Threats 0 / 10

Segregation of duties enforced across the full payment cycleVendor creation · Invoice approval · Payment authorization · Bank reconciliation

No single employee can both create a vendor and authorize payment to that vendor

Background checks conducted for employees with payment authority

Mandatory vacation policy in place for employees with access to payment systemsFraud detection tool

Job rotation or periodic re-assignment considered for AP/treasury roles

Confidential fraud reporting mechanism (hotline or equivalent) in place and communicated

System access provisioned on least-privilege basis; reviewed quarterly

Terminated employee access revoked immediately

Employee vendor relationships disclosed and reviewed for conflicts

Expense reimbursements subject to same controls as vendor payments

Section 7: Monitoring, Detection & Reconciliation 0 / 10

Bank account reconciliation performed daily or at minimum weekly

Payment exception reports reviewed regularly (amounts, timing, new payees, duplicates)

Automated anomaly detection in place (if ERP/AP platform supports it)

New vendor first-payment review: payments to recently added vendors reviewed for 90 days

Payments to vendors with addresses matching employee addresses flagged and reviewed

Payments to P.O. boxes or residential addresses reviewed

Vendor master file changes followed by immediate payments flagged for reviewKey fraud indicator

Data analytics run periodically on payment data (Benford's Law, duplicate analysis, threshold testing)

Internal audit covers disbursement controls at minimum annually

External audit / SOC review of payment controls conducted as applicable

Section 8: Policy, Governance & Culture 0 / 11

Written disbursement controls policy exists and is current (reviewed annually)

Approval authority matrix documented and enforced in the payment system

Disbursement policy communicated to all relevant staff

Finance leadership (CFO, Controller) actively champions fraud-aware culture

"Tone at the top" message on fraud prevention communicated at least annually

Controls not relaxed for senior executives or urgent requestsPolicy must be unambiguous

Vendor code of conduct or anti-bribery clause included in vendor agreements

Control failures reviewed in post-incident analysis; controls updated accordingly

Staff empowered to flag suspicious requests without fear of reprisal

Third-party payment service providers (outsourced AP, etc.) subject to equivalent controls review

Confidential Tip Line available for reporting possible fraud

Score Summary

Ratings update as you go and are saved in your browser only — nothing is transmitted or stored on our servers.

Next Steps & Resources

Gaps identified in this checklist should be prioritized for remediation in order of risk exposure. As a general guide:

Priority	What to Remediate
High Priority remediate within 30–60 days	Any gap in vendor banking verification, dual authorization, BEC awareness, segregation of duties, or sanctions screening.
Medium Priority remediate within 60–90 days	Gaps in monitoring, audit trail, vendor master review, and policy documentation.
Ongoing	Culture, training, and governance improvements should be treated as continuous-improvement priorities, not one-time projects.

For detailed guidance on each control domain — including implementation considerations, common failure modes, and real-world fraud case examples — visit DisbursementControls.com: Vendor Verification & Onboarding · Payment Methods & Risk · Fraud Prevention · Controls & Compliance.

This checklist is provided as an educational resource. Organizations should consult qualified legal, compliance, and financial advisory professionals when implementing or modifying internal control programs.