How to set up a payment approval process in South Africa

What is a payment approval process?

It is the set of steps every outgoing payment must pass before money leaves your bank account. It answers four questions: who may ask for a payment, who must agree to it, what proof must be attached, and who actually pays.

The point is not paperwork. It is that no single person can create a payment and send it out alone. When a supplier is paid twice or a fraudster changes bank details, a clear process is what catches it, and it lets you show your auditor that payments are under control.

Who should request, approve and pay?

Segregation of duties means different people ask for, approve and release a payment. This split works for most businesses with a small finance team.

In a very small business the same person may wear two hats. That is fine if you add a compensating check: for example, the owner reviews every line on the bank statement each month and signs it off. Write the exception into the policy so it is a decision, not an accident.

How many approvers do you need?

For most businesses the answer is two different people: the manager who knows the goods or service arrived, and someone in finance or management who checks the price, the supplier and the paperwork.

• One approver can be enough in a small team, if a different person releases the payment in the bank.
• Two approvers is the common choice. It catches most mistakes and most internal fraud.
• Three or more rarely adds control. It adds waiting time, and approvers start signing because "someone else will check".

Keep one rule for everyone. If you add a written rule that a director signs off anything above, say, R100 000, check it at month-end, because a rule nobody checks is not a control. One person approving twice counts once.

What evidence should each payment have?

Approvers should see the evidence before they approve, not after. The classic check is a three-way match: the order, the proof of delivery and the invoice must agree on the supplier, the items and the amount.

If you are a VAT vendor, you can only claim input VAT with a valid tax invoice. Before approving, check that it says "tax invoice", shows the supplier's VAT number and has your company's details. SARS's VAT guidance lists the full requirements.

How should you handle new or changed supplier bank details?

This is where the big losses happen. In a business email compromise, a fraudster gets into a supplier's mailbox, or makes one that looks the same, and sends a real-looking invoice with "our new bank details". The amount is right and the money goes to the wrong account.

1. Never act on the email alone. Letterheads and PDFs are easy to fake.
2. Phone the supplier on a number you already had. Use the number from your supplier file, the contract or an older invoice. Never use the phone number in the email that announced the change.
3. Speak to someone you know at the supplier, and ask them to confirm the new account number and branch code out loud.
4. Get a bank confirmation letter for the new account and keep it with the supplier record.
5. Let a second person update the record. The person who took the call should not be the only one who changes the details.
6. Record the check: who phoned, which number, who they spoke to and when.

Be extra careful with any payment approved before the bank details changed. The approver agreed to pay a supplier, not a new account.

What should you check at month-end?

• Approved but not paid. Find out why.
• Stuck approvals. Requests waiting for a second approver for more than a few days need a nudge.
• Paid versus bank statement. Every payment on the statement should match an approved request, and the other way round.
• Edits and rejections. Look at requests that were changed after approval or rejected more than once.
• Supplier changes. Review every bank detail change made during the month and confirm each one was verified.

What will your auditor ask for?

Auditors usually pick a sample of payments and follow each one back. They want the request, who captured it, the evidence, who approved it and when, proof those people were allowed to approve, and a bank payment that matches what was approved.

An approval they can rely on is tied to a named person who signed in with their own details, at a recorded time, on a specific request with the documents attached. A "yes" on WhatsApp is much weaker, as our guide on why WhatsApp and email approvals fail at audit time explains.

Setting it up in EzeFlow

EzeFlow was built around this process. Here is the order we suggest.

1. Create your organizations (branches, divisions or companies) and assign each user to the ones they work in. Users only see payments of their own organizations.
2. Give everyone a role: admin, finance, accountant or submitter, or on Professional and Enterprise build your own from 24 permissions.
3. Choose the number of approvers: how many different people must approve, from 1 to 10. Until then the request shows as "partially approved".
4. Turn on "enforce approvers" so nothing can be marked paid without enough approvals. Leave "allow skip approval" off unless you have a clear reason.
5. Make two-factor sign-in compulsory for finance and admin roles, with an emailed code or a free authenticator app.
6. Ask staff to attach the evidence. EzeFlow sorts and renames documents as Quote, PO, GRN, Invoice, Statement or Sundry, and flags a file that was uploaded before.
7. Set up bank payments (Professional and Enterprise): name your bank team, load the supplier master file and upload your FNB beneficiary export.
8. Switch on email alerts for new requests, and for requesters when theirs is approved, rejected or paid.

Frequently asked questions

How many people should approve a supplier payment?

Most small and mid-sized South African businesses use two approvers: someone who knows the purchase was real, and someone in finance or management. More than two usually slows payments down without adding much control.

Can the person who requested a payment also approve it?

They should not. Your policy should say an approval by the requester does not count. In EzeFlow you choose how many different people must approve, so setting it to two or more means at least one person other than the requester has to sign off before the payment is approved.

How long must we keep invoices and payment records in South Africa?

SARS generally expects records to be kept for five years from the date the relevant return was submitted, under the Tax Administration Act. Other laws or your auditor can require longer, so agree the period with your accountant.

What should we do if a supplier emails new bank details?

Change nothing based on the email. Phone the supplier on a number you already had on file, confirm the change with someone you know and ask for a bank confirmation letter. A second person should update the supplier record.

Do we still need bank authorisers if payments are approved in software?

Yes. Approval software proves the payment was requested, supported and approved. The bank authoriser is the last check that the right amount goes to the right account.