The six checks, in the order that catches the most
Run them in this sequence, because each one filters what the next has to look at.
- Authority. Someone with the standing to commit this money agreed to it before the invoice arrived. A signed quote, a purchase order, a contract, a board or shareholder resolution for anything unusual. An invoice is a request for payment, not evidence that the purchase was ever approved.
- Receipt. The goods arrived or the work was done, confirmed by the person who would know, not by the person paying. For services, that means someone naming what was delivered. This is the check that stops you paying for a shipment that was short, cancelled or never made.
- Duplicate. The invoice number is new to your system and the amount does not match anything paid in the last few months. Duplicate payments are the most common expensive error in a growing business, because invoices arrive twice through different channels and each looks legitimate.
- Payee and banking details. The name on the payment matches the name on the invoice and the name in your vendor file, and the account details match what you have on record. Any change to those details is treated as a security event, not a data-entry task.
- Cash and timing. The payment fits the cash you actually have in that week, alongside payroll, remittances and anything else already committed. Large payments are what turn a profitable month into an overdraft.
- Coding and tax. The right account, the right entity if you have more than one, HST treated correctly, and a decision made about whether this is an expense or an addition to a capital asset. Getting this right on the way in is far cheaper than untangling it later.
Everything below is detail on the three checks that stop real losses, and on the parts owners most often skip.
Receipt, duplicate and banking details do most of the protecting
These three are the checks that pay for the process. Receipt works because it introduces a second person with independent knowledge: the site supervisor, the office manager, the person who ordered the equipment. The approver is confirming somebody else confirmed. Without it, approval is just a signature on a number.
The duplicate check is unglamorous and quietly valuable. It catches the same invoice submitted twice, the statement paid alongside the invoices that make it up, and the deposit paid again when the final bill arrives showing the full contract value. Two habits prevent nearly all of it: never pay from a statement, only from invoices, and always enter the supplier invoice number so the system refuses a second use of it.
Banking details is the one that stops the loss that actually hurts. The common pattern is an email, often from a real address that has been compromised, saying a supplier has changed banks and asking you to update the details before the next payment. It arrives when a large payment is genuinely due, and it reads perfectly. The rule is absolute: any change to payee banking information is verified by voice, on a number you already had in your file before the request arrived, with a person you can identify, and the verification is recorded. Never call the number in the email. Never accept the change because the invoice is overdue and the supplier sounds annoyed. Urgency is the tell, not the excuse.
The same applies to a first payment to a brand new vendor. Confirm the business exists, that the person requesting it is authorized to have engaged them, and that the account details came from a source other than the invoice itself. If you have not yet decided who is allowed to approve what, start with the approval matrix in how to prevent payment and approval errors in a growing business.
Different payments fail in different ways
A generic checklist misses the specific weakness of each payment type. The table below is the version we would tape to the wall of a growing owner-managed business.
| Payment | How it usually goes wrong | The check that catches it |
|---|---|---|
| First invoice from a new supplier | The supplier is not real, or is real but was never engaged by anyone with authority | Independent confirmation the business exists, plus the name of who approved the engagement |
| Long-standing supplier, banking details changed | Payment redirected after a convincing email from a compromised or spoofed account | Voice verification on a number you already had, recorded in the vendor file |
| Deposit or progress payment on equipment or construction | Paid ahead of delivery with no security, or the deposit is forgotten and the final invoice pays it twice | A milestone schedule in the contract, and deposits tracked against the contract total |
| Subcontractor or trade payment | Amounts differ from the agreed rate, WSIB clearance has lapsed, or holdback is released early | Rate checked to the contract, clearance confirmed, holdback released only on the contract terms |
| Off-cycle payroll payment or a new employee | A pay change or a person entered without independent approval | Any new employee or pay change approved by someone who cannot enter it in the system |
| Transfer to a related company or to the owner | Treated as an errand rather than a transaction, so it lands in the shareholder loan account by accident | Stated purpose before release, coded deliberately, reviewed at the close |
That last row matters more than it looks. Money moving between your corporations, or out to you personally, has real tax consequences depending on whether it is a loan, a dividend, salary or a repayment of capital. Deciding after the fact is how shareholder loan balances become a year-end problem.
What counts as large, and who should be approving it
Large is defined by your business, not by a round number in an article. A practical way to set it: pick a level where an error would be genuinely painful for a month of cash, and require a second approver above it. Then set a higher level where the owner or a director signs personally. Most owner-managed businesses end up with two or three tiers, and the exact numbers matter far less than writing them down and applying them without exception.
Some payments deserve the full review regardless of size, because size is not what makes them risky:
- Any first payment to a new payee
- Any change to banking details, at any amount
- Any wire or e-transfer, because both are effectively irreversible
- Any payment to a related party, employee or the owner
- Any payment made outside the normal payment run
The approver should also be someone who did not initiate the payment. That separation is the foundation the whole checklist sits on, and it is covered in segregation of duties in a small finance team and in why internal controls matter even in an owner-managed business.
The cash and tax questions people skip
Two of the six checks get dropped most often, and both cost money. The first is cash flow. A large payment should be tested against the forward view, not the current bank balance, because the balance today says nothing about the payroll, HST remittance and instalment sitting in the next three weeks. Businesses with a rolling forecast answer this in seconds; businesses without one find out later.
The second is coding and tax. Three decisions get made at approval whether or not anyone makes them consciously. Is the HST recoverable, which requires a proper invoice carrying the supplier registration number and the tax shown correctly. Is this an expense or a capital asset, which changes when the deduction is taken and how the balance sheet reads for your lender. And which entity is paying, because a cost paid by the wrong company in a group creates an intercompany balance somebody has to unwind. None of these are hard at the moment of approval. All of them are tedious at year-end, which is why we prefer coding reviewed at the month-end close while the transaction is still recent.
This is where the checklist stops being a control exercise and becomes ordinary full-cycle accounting. In an outsourced finance and accounting department for an established business in Ontario, the payment file arrives already assembled: invoice matched to the order, receipt confirmed, duplicate check run, coding proposed, cash impact shown against the forecast. The owner approves rather than investigates. That is the whole design of an ongoing financial partnership, and the reason payables, payroll and the compliance calendar sit together in End-to-End Accounting.
What changes the answer, and what to do next
How deep the review needs to be depends on a few facts:
- How the payment leaves. Wires and e-transfers cannot be recalled; cheques and pre-authorized debits give you time and a paper trail.
- Whether you are paying ahead of delivery. Deposits transfer risk to you, so they deserve contract terms rather than trust.
- How new the relationship is. A supplier you have paid monthly for six years carries a different risk than one you met last week.
- Your cash headroom. The tighter the runway, the more the timing question matters relative to everything else.
- Whether covenants or funders are watching. Lender covenants, grant terms and franchise agreements can turn a routine purchase into a reporting event.
- How many people can release money. More hands means more discipline required, which is why payment risk belongs on the monthly review alongside cash and receivables.
If you want the practical version of this working in your business, the fastest starting point is a written approval tier, a rule that no banking change is accepted by email, and a payment file that arrives complete. We can build all three around your existing software, or run the whole payables cycle for you. A free 15-minute discovery call is enough to tell which one you need.
