Payment controls are the deliberate checks a company applies before money moves — who can request a payment, what gets verified, who approves it, what gets documented, and who is allowed to release it. They don’t require software or a large finance team. They require a written, repeatable process.
The Control Problem
Most businesses already have payment controls — informally. One person knows they shouldn’t pay an invoice without a PO. Another knows to double-check anything urgent. The problem is that informal knowledge lives in people’s heads, varies by who happens to be handling the request, and disappears the day that person is out sick or leaves the company.
This matters because payment risk is overwhelmingly a process problem, not a technology problem. According to the 2026 AFP Payments Fraud and Control Survey, 76% of U.S. organizations experienced attempted or actual payments fraud in 2025, and 48% of organizations under $1 billion in revenue reported an actual financial loss. Almost none of that is stopped by antivirus software — it is stopped, when it is stopped, by someone following a process that catches the request before the money moves.
The Six Moments Every Payment Passes Through
XAMVEN organizes payment controls around a single repeatable sequence, because every payment — routine or unusual — passes through the same six decision points:
- Request — What is being asked for, and by whom?
- Freeze — Does anything about this request need a second look before it moves forward?
- Verify — Can the key facts be confirmed independently, through a channel the requester doesn’t control?
- Approve — Is the right person, at the right authority level, signing off?
- Document — Is there a record of what was checked and who approved it?
- Pay — Does the payment only go out once the steps above are actually complete?
A control system doesn’t need a name for each of these to work. But naming them makes it possible to ask a precise question: which of these six steps, specifically, is missing or inconsistent in how your company handles payments today?
Practical Example
Illustrative example — not a real company. A 12-person company has one bookkeeper who handles all payments. There is no written approval process — the owner verbally approves anything "that looks right." When the owner is traveling, payments either wait or get approved by text message with no other check. This is not a documentation problem to fix later; it is a live gap at the Approve and Document steps, and it is exactly the kind of gap that a single urgent, well-written fraudulent request is built to exploit.
Common Mistakes
- Assuming controls require new software. Most of what’s missing in a small company is a decision and a piece of paper, not a purchase.
- Writing a policy once and never testing whether it’s actually followed.
- Concentrating every step — request, verify, approve, release — in one person, with no independent check anywhere in the chain.
- Treating "we’re too small for this" as a reason to have no process, rather than a reason to design a smaller one. See the guidance on segregation of duties with a small team for that specific problem.
When to Escalate
If you’re reading this because something already feels wrong with a specific payment — an unusual request, a change that hasn’t been verified, or a payment you suspect may already have gone to the wrong place — stop reading and go directly to the vendor bank-change guide or, if a payment may already be affected, contact your financial institution immediately.
Sourced from the 2026 AFP Payments Fraud and Control Survey (Association for Financial Professionals).
See which of the six steps needs attention first
The Payment Control Readiness Check walks through all six areas in about five minutes and shows you where to start.
Related Resources
This guide is educational and operational in nature. It is not legal, accounting, or cybersecurity advice, and following it does not guarantee that fraud, error, or loss will not occur.