A payment request can look routine while carrying a serious problem. A supplier has changed bank accounts, a familiar colleague wants an urgent transfer, or an invoice arrives in a conversation staff recognize. In a municipal office, several people may touch the request before anyone has responsibility for verifying it.
Trace the supplier-change approval
The FBI's reporting on business email compromise explains why payment instructions deserve independent checks. Familiar wording and a familiar message history do not establish that a change is authorized. A compromised account can carry a request through an ordinary channel. The verification process must give staff a way to check the instruction outside that channel.
Review how a supplier change reaches finance. Identify who receives the request, who maintains the supplier record, and who authorizes payment. Look for handoffs where each person assumes someone else has checked it. A written procedure should make the approval and its evidence visible to the next person. It should also explain what happens when the usual approver is absent.
Verify changes against an approved record
Use an independently established contact route to verify sensitive changes. A telephone number added to the request is part of the request, so it should not become the basis for trusting it. Staff need access to the approved supplier record and a clear way to document the check. Decide which changes need another authorized reviewer, in line with the organization's financial controls.
Check whether procurement, finance, and departmental records agree about the supplier. Multiple copies create opportunities for an approved change to reach one system while an unverified instruction reaches another. Assign ownership of the authoritative record. Ask the relevant teams how they will update it, preserve the decision history, and handle a discrepancy without rushing a payment through because a deadline is close.
Connect finance controls with technical support
Technical support has a role alongside those procedures. Ask the provider to review access to finance accounts, recovery arrangements, and the process for removing access when responsibilities change. Include contractors or external services where applicable. Any assessment should respect the authority of the finance team and the organization's approval requirements. Account controls support verification; they cannot make a payment decision on their own.
Plan the reporting handoff before a questionable request appears. Employees should know how to raise a concern without first proving that fraud occurred. Finance and technical staff need a way to coordinate, and bank contacts should be available through an approved source. Follow the organization's incident and financial procedures if money has already moved. Record which existing contact verified the change.
Walk through an approver's absence
Include the absence of the usual approver in a walkthrough. A colleague covering the role should know which records to use, which verification steps still apply, and who can resolve a disputed instruction. Urgency should lead to the agreed escalation route. It should not require the covering employee to invent a new approval process at the payment deadline.
Review the written procedure with the departments that send requests to finance. They need to understand which information supports an approval and why a familiar email thread does not settle verification by itself.
Discuss the payment process
All Ways Better can help frame a discussion about the gaps between the payment process and its supporting systems. Bring an anonymized example and describe the roles involved. We can discuss suitable specialist support, with assessment or implementation scope, responsibilities, fees, and timing agreed separately.
Sign up today for a free initial implementation consultation. Our team will follow up to arrange a conversation about your requirements. This offer covers that initial call; it does not include a financial investigation, an audit opinion, incident response, or delivery work.
