The accounts payable process is the sequence a business follows to record what it owes vendors and pay them correctly: set up the vendor with a W-9 and terms, verify each purchase against a purchase order and receiving report, run a three-way match and route the invoice for approval, release payment through the appropriate channel, protect that payment from fraud, and feed the year’s data into 1099 reporting. Each step carries its own compliance requirements, and skipping any of them creates either a tax problem, a control weakness, or an opening for fraud.
Step 1: Set Up the Vendor Before the First Payment
Nothing else in AP works if the vendor record is wrong. Before you pay anyone for the first time, capture the vendor’s legal entity name, mailing address, billing address, and Taxpayer Identification Number. That TIN is a Social Security Number for a sole proprietor or an Employer Identification Number for a corporation or other business entity.1Internal Revenue Service. Taxpayer Identification Numbers (TIN)
The document that collects all of this is IRS Form W-9. A completed W-9 gives you the vendor’s certified TIN and confirms they aren’t subject to backup withholding. If the vendor never returns the form, or the TIN they provide turns out to be wrong, you’re required to withhold 24% from every reportable payment and send it to the IRS.2Office of the Law Revision Counsel. 26 USC 3406 – Backup Withholding That amount comes off the top of the invoice, and unwinding it later is painful. Collecting the W-9 before the first payment is not optional.3Internal Revenue Service. Instructions for the Requester of Form W-9
Setup is also where you lock in payment terms. Net 30 means the full invoice is due within 30 days of receipt; Net 60 gives you 60 days. Many vendors offer early payment discounts written as shorthand like “2/10 Net 30” — 2% off if you pay within 10 days, full balance in 30. That 2% sounds small, but annualized it works out to roughly 36%, far more than most businesses earn on their cash. When cash flow permits, capturing those discounts is one of the easiest wins in AP. Record the terms in the accounting system at setup so it can flag invoices approaching a discount deadline and calculate correct due dates automatically.
Step 2: Verify the Purchase Against Source Documents
Three documents form the backbone of every AP transaction, and each originates from a different source. Purchasing issues a purchase order locking in what was ordered, how many units, and the agreed price. When the shipment arrives, receiving personnel create a receiving report or sign the packing slip, confirming the quantity and condition of what actually showed up. The vendor then sends an invoice requesting payment based on what they shipped.
Your AP staff compares all three line by line. Do the quantities on the invoice match the purchase order? Does the receiving report confirm everything arrived? Are the unit prices consistent across all three records? Any discrepancy gets resolved with the vendor or the purchasing team before the invoice moves forward. This comparison is the single most important fraud-prevention control in AP, because it ensures you only pay for goods and services you actually ordered and received.
Watch for Missing Use Tax
While reviewing invoices, AP teams in most states need to watch for a common gap: purchases where the vendor didn’t charge sales tax. When you buy taxable goods or services from an out-of-state vendor with no obligation to collect your state’s sales tax, you owe use tax at the same rate as your local sales tax. The same applies when your company pulls items from resale inventory for internal use. The responsibility to report and remit falls on the buyer, and AP is typically the department that catches the missing charge. Build a use-tax flag into invoice review so the liability doesn’t accumulate unnoticed until a state audit surfaces it.
Step 3: Run the Three-Way Match and Route for Approval
The formal comparison of purchase order, receiving report, and invoice is called a three-way match. Most accounting systems let you set a tolerance threshold, a small dollar amount or percentage, so trivial rounding differences don’t hold up payment. If the three documents agree within tolerance, the invoice is ready for coding and approval.
Coding means assigning the expense to the right account in your chart of accounts: office supplies to one code, raw materials to another, software licenses to a third. Getting this right matters for tax deductions and for internal financial reporting that actually reflects where money is going. After coding, the invoice routes for authorization. Most companies set dollar thresholds. A department manager might approve anything under $5,000, while larger amounts require a senior executive’s sign-off.
For publicly traded companies, this approval chain is a legal obligation. The Sarbanes-Oxley Act requires management to maintain adequate internal controls over financial reporting and to assess their effectiveness annually.4Office of the Law Revision Counsel. 15 USC 7262 – Management Assessment of Internal Controls In AP that translates to separation of duties: the person who enters an invoice should not be the same person who approves it, and neither should be the person who releases the payment. Private companies aren’t bound by SOX, but adopting the same controls is smart practice at any size.
Step 4: Release the Payment
Once the invoice has final approval, AP releases funds through one of several channels. The most common for routine vendor payments is an ACH transfer. These electronic payments move through the Automated Clearing House network and follow the operating rules set by Nacha, the organization that governs that system.5Nacha. How ACH Payments Work ACH is cost-effective and handles the bulk of recurring business payments. Wire transfers are faster but more expensive, useful mainly for high-value or time-sensitive transactions. Physical checks still circulate, though they’re declining because of the fraud risks below.
Virtual credit cards are a newer option. Your company generates a single-use card number tied to a specific invoice amount, sends it to the vendor, and the vendor processes it like any card payment. The number expires after use. The appeal is that many card programs return a cash rebate on every transaction, turning AP spend into a small revenue stream. The catch is that vendors absorb card processing fees, so not every supplier will accept them.
After the payment clears, your accounting system zeroes out the liability in the AP ledger and reflects the corresponding decrease in cash. This reconciliation creates the audit trail that tax authorities and external auditors rely on.
Step 5: Protect Payments From Fraud
Accounts payable departments are a favorite target for criminals, and the most dangerous scheme is business email compromise. Between 2013 and 2023, BEC scams caused over $55 billion in reported losses worldwide.6Federal Bureau of Investigation. Business Email Compromise: The $55 Billion Scam The typical attack is simple: a fraudster impersonates a vendor or executive by email and asks to change the bank account where payments are sent. If AP updates the routing without independent verification, the next payment goes to the criminal’s account.
The FBI’s recommended defense is equally simple: verify every bank account change request by calling the vendor at a phone number you already have on file, not a number from the suspicious email.7Federal Bureau of Investigation. Business Email Compromise Build this into your procedures as an absolute rule. No email, however convincing or urgent, is enough to change payment routing on its own.
For companies that still issue paper checks, Positive Pay is a banking service that catches altered or counterfeit checks before they clear. You upload a file to your bank listing the check numbers and amounts you’ve issued. When a check is presented, the bank compares it against your list, and if anything doesn’t match — wrong amount, wrong check number, wrong payee — the bank flags it and lets you decide whether to pay or reject. There’s a monthly fee, but it’s far cheaper than absorbing a fraudulent check.
Step 6: Report Vendor Payments on Form 1099-NEC
Your AP data feeds directly into your company’s IRS reporting obligations. For tax years beginning after 2025, when you pay an unincorporated vendor $2,000 or more during the year, you must report those payments on Form 1099-NEC. That threshold was $600 for decades, so the jump to $2,000 is significant and reduces the number of forms most companies need to file. The threshold will adjust for inflation starting in 2027.8Internal Revenue Service. Publication 1099 (2026)
Both the recipient copy and the IRS copy of Form 1099-NEC are due by January 31 of the following year. Missing that deadline triggers tiered penalties that escalate the longer you wait:
- Up to 30 days late: $60 per return
- 31 days through August 1: $130 per return
- After August 1 or never filed: $340 per return
- Intentional disregard: $680 per return, with no maximum cap
Those penalties apply per form, so a company that misses the deadline on 200 vendor returns faces real money.9Internal Revenue Service. Information Return Penalties Accurate W-9 collection during vendor setup is what makes clean 1099 filing possible. If the vendor’s name or TIN on your 1099 doesn’t match IRS records, you’ll receive a notice and potentially owe penalties on top of the mismatch.3Internal Revenue Service. Instructions for the Requester of Form W-9
Keep the Payment Package Together
The common advice to “keep everything for seven years” oversimplifies what the IRS actually requires. The default retention period for records supporting items on your tax return is three years from the filing date. If you fail to report more than 25% of your gross income, the IRS has six years to assess additional tax, so records relevant to that scenario should be held for six years. The seven-year period applies only in narrow situations, such as claiming a deduction for a bad debt or worthless securities.10Internal Revenue Service. How Long Should I Keep Records Employment tax records require a minimum of four years.11Internal Revenue Service. Topic No. 305, Recordkeeping
Many businesses adopt a blanket seven-year policy to cover the longest scenario, which is a reasonable conservative approach. What matters more than the exact number of years is keeping the complete payment package together: the purchase order, receiving report, invoice, approval documentation, and proof of payment. When an auditor pulls a file three years from now, every document in the chain should be there.
One more piece of housekeeping catches many AP teams off guard. When a vendor never cashes a check, the money doesn’t stay in your account forever. Every state has unclaimed property laws requiring businesses to turn over stale-dated checks to the state after a dormancy period, generally two to five years for vendor payments, with three and five years the most common windows. Run an outstanding-check report at least quarterly and follow up on anything uncashed for 90 days. Catching stale checks early is far simpler than working through the escheatment process after dormancy has passed.