An invoice approval workflow is the defined sequence of validation and sign-off an invoice passes through before it can be paid. It sets who authorizes the payment, in what order, and under what conditions.

Most finance teams treat a slow workflow as a routing problem. They buy software that sends faster notifications, and the invoices still sit. They sit because the approver cannot answer the question in front of them using the invoice alone.

This guide covers how to build an approval matrix from your own invoice data, where to draw segregation of duties when the team is too small to split three ways, how to classify the exceptions that create your backlog, and which steps belong in human hands no matter how good the software gets.

What is an invoice approval workflow?

An invoice approval workflow is the rules-based path an invoice follows from receipt to authorized-for-payment. The workflow enforces two things at once: that the right person signs off, and that the sign-off rests on evidence an auditor would accept.

Approval sits downstream of invoice processing and behaves differently. Processing captures and reads the document. Approval decides who authorizes the spend and records why.

Why invoices sit in approval

The delay happens before anyone clicks approve. An approver receives a document and a question: should the company pay this? The document carries the amount and the vendor name. The question needs six other things.

What an approver needs to decide

Call this set the approval packet. When the packet is complete, approval takes under a minute. When a piece is missing, the approver starts an email thread, and that thread becomes your cycle time.

Approval software delivers one of these seven items: the invoice. Everything else stays where it was, and the approver has to go get it. That is the work that routing speed cannot touch.

The alternative outcome is worse than delay. An approver who cannot assemble the packet and feels the pressure of a payment run approves anyway. The control still exists on the org chart and stops doing anything.

The approval matrix

An approval matrix maps invoice attributes to the approvers those attributes require. It is the core of a workflow that survives growth. Most matrices get built from round numbers in the first month of an ERP implementation and never get revisited. Oracle Fusion ships a predefined rule that routes any invoice at or above $1,000 to the requester's supervisor, and plenty of companies run that default for years.

Which attributes should drive routing

Amount alone produces a workflow that treats a $9,000 office refit like a $9,000 legal retainer. Add these:

• PO-backed or not. A matched PO invoice carries its own approval history. A non-PO invoice carries nothing.
• GL account or cost center. Budget ownership follows the cost center, not the invoice size.
• Legal entity. Multi-entity groups need entity-level signing authority.
• Vendor risk tier. New vendors, single-source vendors, and vendors added in the last 90 days deserve a different path.
• Contract coverage. Spend inside a signed contract needs less scrutiny than spend outside one.

How to size your tiers

Build the matrix from your own distribution rather than from a template:

1. Export 12 months of posted invoices with amount, vendor, and cost center.
2. Sort by amount. Find the value below which 80% of your invoice count sits. That is your volume break.
3. Find the value above which 80% of your invoice spend sits. That is your spend break.
4. Tier one ends at the volume break. Your top tier starts at the spend break. Everything between becomes tier two.

In most mid-market AP functions the two breaks sit far apart, which is the point. Round-number thresholds push hundreds of small invoices toward executives and leave the handful of invoices that carry real money in the same queue as a stationery bill.

Bands are illustrative. Derive yours from step 2 and step 3.

When a threshold fails

A threshold set too low creates approval fatigue. Senior approvers face hundreds of items a month, stop reading them, and clear the queue in batches. The audit trail looks healthy and the review stopped months ago.

You can measure this. Pull the median seconds between invoice open and approval decision, grouped by approver. Anyone clearing items in under ten seconds has told you where your threshold is wrong.

The cost of losing that review is measurable too. The ACFE studied 2,402 occupational fraud cases investigated between January 2024 and September 2025 and found that organizations with management review in place had a median fraud loss of $84,000 against $186,000 for those without, a 55% reduction. A review that has degraded into clicking buys you none of that.

Segregation of duties

Three duties must not sit with one person: recording the payable, approving it, and releasing payment. A fourth duty belongs on the same list and rarely appears on it. Whoever maintains the vendor master, including bank details, can create a payee and then pay it.

Billing schemes bear this out. In the ACFE study, billing schemes accounted for 508 cases, 21% of all cases, with a median loss of $90,000 and a median duration of 14 months before detection. A billing scheme is an invoice that passed approval.

When the team is too small to split three ways

A four-person finance team cannot staff five separate duties. Compensating controls carry the weight instead:

• Route the payment run to the owner or CFO for sign-off above a fixed amount, even when AP prepared it.
• Export the vendor master change log monthly and tie every change to a source document.
• Require two people for any bank detail change, with one of them outside AP.
• Turn on positive pay with your bank.
• Rotate who performs the monthly AP reconciliation.

The internal control weaknesses behind these cases are ordinary. The ACFE found a lack of internal controls behind 33% of frauds, an override of existing controls behind 19%, and a lack of management review behind 18%. Together those three account for 70% of cases.

Public companies and their subsidiaries carry SOX 404 obligations here, and the design documentation an auditor asks for is the matrix and the duty split described above.

PO-backed and non-PO invoices need different workflows

A three-way match compares invoice, purchase order, and goods receipt. Where all three agree inside your tolerance band, the invoice can release without a human approval step, because the approval already happened when someone raised the PO.

That covers the half of your volume that was never the problem. Approval labor concentrates in non-PO spend: professional services, subscriptions, utilities, insurance, rent, anything bought by someone who has never opened a procurement system. Non-PO invoices arrive with no prior approval attached, so the approver has to construct the packet from scratch every time.

Teams that automate matching and leave non-PO spend untouched report a faster workflow and the same backlog. Raising PO coverage on recurring non-PO categories moves more than any routing change will.

Exception handling

Most AP backlogs consist of four or five exception types repeating. Classify them and the backlog stops being mysterious.

The seven AP exception types

Resolution belongs to whoever created the discrepancy. AP can chase a price variance for a week without authority to settle it. Procurement settles it in an hour.

Route exceptions out of the main queue

An exception sitting in the approval queue blocks the clean invoices behind it. Give exceptions a separate queue, a named owner per type, and their own SLA. Report exception volume by type every month, because the top two types are a procurement problem wearing an AP costume.

Reminders, escalation, and delegation

Reminders stop working around week two. Approvers learn the cadence and build a filter rule, and the reminder becomes background noise that proves the system tried.

Escalation works when it moves the invoice rather than raising the volume. Set a days-in-queue trigger per tier, name the next approver in advance, and let the invoice move to them without AP sending an email.

Auto-delegation during absence fixes the quietest cause of stuck invoices. An approver goes on leave with no backup configured and their queue freezes for two weeks. Every approver in the matrix needs a named delegate and a calendar-linked handover.

Mobile approval deserves a control question before you enable it. Approving from a phone screen means approving without the packet. Restrict it to tier one, or accept that your tier two review now happens in a taxi.

What to automate, and what to never automate

Automate the evidence assembly first and the routing second. Most teams do the reverse, which makes a slow decision arrive faster.

The hard stops

Never auto-approve:

• A new vendor's first invoice.
• Any invoice following a change to vendor bank details.
• Any invoice from a vendor added in the last 30 days.
• Anything outside your agreed tolerance band.
• Anything above the delegation of authority ceiling.
• Non-PO spend above tier one.

The bank detail rule matters most. The FBI's Internet Crime Complaint Center recorded 24,768 business email compromise complaints in 2025 with reported losses of $3,046,598,558, second only to investment fraud among all crime types. The scheme targets exactly the companies described in this article: businesses that pay suppliers by wire on the strength of an emailed instruction.

One 2025 case in the IC3 report shows the mechanics. An Oregon city government office wired more than $6 million against fraudulent instructions. The money came back because the FBI had already frozen the same recipient account after an earlier victim reported it, not because anyone caught it in the approval workflow.

A callback to a number already on file, performed by someone outside AP, costs two minutes and is the only control in this article that pays for itself on a single incident.

How to measure the workflow

Why public benchmarks will mislead you here

APQC puts the cross-industry median total cost to process an AP invoice at $6.00, drawn from 5,846 organizations, where total cost covers personnel, systems, overhead, outsourcing and other costs. That figure is sound and it describes the whole process.

Approval is a segment inside that process with its own start timestamp, and the public benchmark set does not expose a value for it. APQC maintains the matching measure, cycle time in days from receipt of invoice until approved and scheduled for payment, and publishes the definition without the number. Every benchmark you can read for free measures receipt to payment.

So a company comparing its approval time to a best-in-class cycle figure is comparing different clocks. Define approval cycle time as the gap between ready-for-approval and approved, baseline your own, and measure against that. Any vendor who quotes you a benchmark for approval speed should be asked where the clock starts.

A 30-day fix for a stuck approval workflow

Week 1. Export 90 days of invoices with approval timestamps. Classify every item that breached your SLA into one of the seven exception types or into "waiting on evidence." The split tells you whether you have a routing problem or a packet problem.

Week 2. Rebuild the matrix from your volume and spend breaks. Retire the round numbers. Agree tolerance bands with procurement in the same conversation.

Week 3. Define the packet per tier. For each piece of evidence, write down which system holds it and who can reach it today. The gaps on that list are your automation scope.

Week 4. Split the exception queue by type with a named owner each. Configure escalation and absence delegation for every approver in the matrix. Re-baseline approval cycle time and set the monthly report.

Where configuring the ERP stops being enough

ERP approval engines route well. Oracle, NetSuite, SAP and their peers handle hierarchies, monetary limits, and audit trails without customization.

What they do not do is assemble the packet, because the packet does not live in the ERP. The contract sits in a repository or a shared drive. The goods receipt sits in a receiving system or a project tool. The budget line sits in an FP&A model. The prior-period comparison sits in a report nobody runs. Approval waits on a human to walk between those systems.

Codebridge builds that assembly against the systems a company already runs. We take the evidence the approver needs, pull it from wherever it lives, and present it with the invoice so the decision takes a minute. Our engineers come out of Big Four finance practice, so the control design comes first and the automation follows it.

If approval is where your AP process slows down, a 30-minute call is enough to tell whether your problem is routing or evidence.