Cash disbursement controls stop bad payments at four points: an approval limit that matches the amount, supporting documents checked before approval, a release step done by someone other than the preparer, and reports reviewed after the money leaves. The first three stop a bad payment before it is sent. The fourth catches what got through.
What should cash disbursement controls prevent?
Cash disbursement controls should prevent five kinds of bad payment: payments to vendors that do not exist, payments for goods never received, the same invoice paid twice, amounts changed after approval, and payments nobody with authority approved. Each control in a disbursement process exists to block at least one of these.
Five bad payments, and the control aimed at each
| Bad payment | Typical cause | Control that blocks it |
|---|---|---|
| Fictitious vendor | An employee adds a vendor they control | Vendor setup approved by someone outside payables |
| Goods or services never received | An invoice is paid on the vendor's word | Receiving evidence matched to the invoice |
| Duplicate payment | The same invoice entered twice, or paid by check and ACH | Invoice number checks and a duplicate report |
| Altered amount or payee | A change made between approval and release | Release by a person who compares to the approved list |
| Unapproved payment | Someone pays outside the normal run | Bank roles that require a second approver |
Errors matter as much as fraud here. A duplicate payment caused by a tired clerk costs exactly as much as one caused by a dishonest one, and the same controls stop both.
Where disbursements sit among the cash controls
Disbursements are the outgoing half of cash. The incoming half has its own risks, such as a check deposited twice through a phone app, and its own controls; remote deposit capture controls cover the receipts side for businesses that scan checks.
Approval limits for cash disbursements by amount and payment type
Approval limits set who may approve a disbursement based on its amount and how it is paid. Small, routine payments can be approved by a manager. Large or unusual payments need a senior approver, and wires or payments to new vendors need two. The limits should be written down, and the bank's settings should enforce them.
An example approval limit matrix
The figures below are examples for a business with a few million dollars in annual spending. Scale them to your own payment sizes. The point is the shape: limits rise with risk, and some payment types get extra steps whatever the amount.
| Payment | Up to 2,500 | 2,500 to 25,000 | Over 25,000 |
|---|---|---|---|
| Check or ACH to an existing vendor, against a purchase order | Department manager | Controller | Controller and owner or CFO |
| Check or ACH to an existing vendor, no purchase order | Controller | Controller and owner or CFO | Owner or CFO, plus board notice |
| First payment to a new vendor | Controller and a second approver | Controller and owner or CFO | Owner or CFO, plus callback to the vendor |
| Wire transfer, any vendor | Two approvers | Two approvers | Two approvers, plus callback |
| Refund to a customer | Controller | Controller and owner or CFO | Owner or CFO |
Making the limits stick
A limit that lives only in a policy binder is a suggestion. Three steps make it real:
- Set the same thresholds in the accounting system's bill approval workflow, if it has one.
- Set matching user limits in online banking, so a user cannot release a payment above their level.
- Watch for payments split to stay under a threshold, such as three 2,400.00 payments to one vendor in a week.
Online banking roles are where most businesses can enforce limits at the bank itself. How to set online banking user permissions explains the view, initiate and approve roles and how to set dual approval.
Supporting documents a cash disbursement needs before payment
A cash disbursement needs three documents before anyone approves it: evidence the business ordered the item, evidence it arrived, and an invoice that matches both. Accountants call this the three-way match. For services, the receiving evidence is a sign-off from the person who used the service.
What counts as support
- Order evidence: a purchase order, a signed contract or an approved quote. For recurring bills such as rent or utilities, the lease or service agreement stands in.
- Receiving evidence: a packing slip signed by whoever received the goods, a receiving entry in the inventory system, or a manager's note confirming the work was done.
- Invoice: from the vendor, with an invoice number, a date, the vendor's legal name and the amount.
What the approver checks
The approver reads the support, not just the total. A reviewer working through a payment batch should confirm that:
- The vendor on the invoice matches the vendor in the system, including the name and remit-to address.
- The quantity and price agree with the purchase order.
- The invoice number has not been paid before.
- The coding to the expense account makes sense for the item.
- The payment method and bank details are those on file, not ones printed on this invoice.
That last check deserves weight. An invoice that arrives with new bank details is a classic opening for payment fraud, and a change should go through a separate verification process before any payment uses it.
Marking support as used
After payment, mark each invoice paid, with the date and the check or payment reference. A stamp or an electronic flag stops the same paper from supporting a second payment.
Payment release: the disbursement step where money actually leaves
Payment release is the step where approved payments are sent to the bank: checks are signed and mailed, or an ACH or wire batch is transmitted. The person who releases payments should not be the person who entered the bills or set up the vendors. Release is the last point where a change can be caught before money leaves.
A payment run, step by step
Here is an example of a weekly payment run for a small finance team. Names of roles are illustrative.
- Payables clerk enters approved invoices and attaches the support.
- Payables clerk builds the payment run in the accounting system and prints the proposed payment list.
- Controller reviews the list against the support and approves it, initialing each page or approving in the system.
- Payables clerk creates the ACH batch in online banking or prints the checks.
- Owner or CFO, logged in under their own credentials, compares the bank batch total and the payee list to the approved list, then releases it.
- Owner or CFO signs any checks after comparing them to the list, and the checks go into the mail without returning to the clerk.
- Payables clerk records the payments and marks the invoices paid.
Why step 5 matters
Between approval and release, someone could add a payment, change an amount or swap a bank account. The releaser's comparison catches that, but only if they compare the bank's own screen to the approved list, not a second printout from the person who built the batch.
Payments in other currencies or from accounts abroad
International payments add exchange rates, foreign bank details and sometimes accounts the head office rarely sees. Apply the same release rules to them, and make sure those accounts appear in the monthly review. Auditors give these accounts special attention; auditing foreign bank accounts shows what they test and why statements from abroad take longer to verify.
Which reports should you review after disbursements go out?
After disbursements go out, review four reports each month: the check register for gaps and voids, the vendor master change log, a duplicate payment report, and the bank statement itself, read by someone outside payables. Prevention controls fail sometimes. These reports put a time limit on how long a failure can stay hidden.
The monthly after-the-fact review
| Report | What to look for | Who reviews it |
|---|---|---|
| Check register | Missing check numbers, voids without the voided check, checks out of sequence | Controller |
| Vendor change log | New vendors, changed bank details, changed addresses | Someone outside payables |
| Duplicate payment report | Same vendor, same amount, close dates, or the same invoice number twice | Controller |
| Bank statement | Unknown payees, payments to individuals, payee names that differ from the check register | Owner or CFO |
| Payments by vendor, year to date | Vendors whose spend jumped, round amounts, payments just under a limit | Controller or outside accountant |
Reading the bank statement against the books
The bank statement is the one report the payables team does not produce, which is why it is the strongest check. Compare the payees and amounts on the statement to the check register and ACH history. A check that cleared for a different amount or to a different payee than the books show is a red flag, whatever the explanation turns out to be.
Doing this by hand across many accounts is slow. PreciseBankFlow extracts each statement, confirms it foots, matches statement lines to the register and lists possible duplicates and check-number gaps, so the reviewer spends the time on the exceptions rather than on ticking.
Urgent payment requests that bypass disbursement controls
Urgent payment requests are the edge case that tempts staff to skip disbursement controls. A request arrives late on a Friday, from someone senior or claiming to be, asking for a payment today outside the normal run. The right response is a faster version of the same controls, never a skipped one.
Signs a rush request needs extra checking
- The request comes by email or text and asks you not to call or not to tell anyone.
- The payee is new, or the bank details differ from those on file.
- The sender is traveling or "in a meeting" and cannot be reached by phone.
- The amount is just under a threshold that would need a second approver.
An emergency path that keeps the controls
Write a short procedure for genuine emergencies, before you need one:
- The requester confirms the request by phone, using a number already on file.
- The usual approver approves it, even if from a phone, with the support attached.
- A second person releases it in online banking.
- The payment is flagged for review at the next monthly close, with the reason it was rushed.
An executive who asks to skip these steps is asking the finance team to take the risk personally. A policy that says no one may skip them, including the owner, protects the staff who have to say no.