Philippines AP staffing guide
Review a supplier invoice contact change without weakening payment controls
Authenticate a changed billing contact, preserve the old contact history, and keep correspondence maintenance separate from bank-detail authority.
Direct answer
What this role should do
Treat a new invoice contact as a controlled supplier-record change. Verify the request through an established channel, record its scope and effective date, preserve the previous contact, and route bank, tax, contract, and payment changes through their separate approval paths.
Define what the contact is allowed to change
A supplier may ask AP to replace the person who receives remittance notices, answers invoice questions, or sends monthly statements. That sounds administrative, but the request can affect what the team trusts later. Start by naming the exact role being changed. A billing contact does not automatically have authority to amend a contract, redirect payment, change a tax record, approve a credit, or provide new bank instructions. Put those boundaries in the case before updating an address book or supplier profile.
Record the supplier legal name, internal vendor ID, affected company entity, current contact, proposed contact, email domain, phone number, stated reason, request date, requested effective date, and systems where the contact appears. Attach the original request without editing it. If the message also asks for a remit-to or bank change, split that work into the company's approved verification process. Keeping the requests separate makes it harder for a harmless contact update to become implied approval for a payment change.
Verify through a channel that existed before the request
Do not verify a new email address by replying to that address and asking whether it is genuine. Use a supplier portal, contract record, previously verified phone number, established account manager, or another channel approved by the company. The person completing the verification should record the channel, time, contact reached, question asked, and result. If the old contact has left, the case should show how the replacement was confirmed without depending on the new contact alone.
Domain similarities deserve a careful look. A changed address may use a subsidiary domain after a merger, a regional domain for another supplier entity, or a misspelled lookalike. AP support should document what it observes and route uncertainty to the vendor-master or security owner. It should not declare a message fraudulent based only on appearance. Likewise, a familiar display name is not proof of identity. Keep the full sender address and relevant message headers in the approved evidence location.
Check account and entity ownership
One supplier group can have several accounts, legal entities, currencies, and purchasing relationships. Confirm which account the new contact represents and whether the person should see information for all company entities or only one. A regional billing contact may need invoice-status responses for a single account, while a global contact may be authorized for consolidated statements. Do not broaden access because the supplier names look similar. The request and verification should support the exact scope entered in the system.
Review open disputes, credits, duplicate cases, and recent payment inquiries before the change takes effect. A contact update during a dispute may be legitimate, yet it can also break the history if old messages and commitments disappear. Link the new contact to the open cases and tell the assigned owner what changed. Preserve the former contact with an inactive date and reason instead of deleting the record. That history helps a reviewer understand why correspondence moved and which promises came from whom.
Update each system with an audit trail
List every place where the contact is stored: vendor master, AP mailbox rules, statement request list, supplier portal, purchasing system, ticket queue, and remittance distribution list. Not every system needs the same fields or the same access. Assign an owner for each update, record completion evidence, and note systems that intentionally remain unchanged. This prevents a partial update in which invoices go to one address while statement requests and remittance messages continue to another.
Use a second review when the company policy requires it, especially if the new contact will receive financial details. Limit the profile to the permissions needed for the stated role. A person who answers invoice questions may not need bank status, employee expense data, or documents belonging to another supplier account. If the system cannot express that limit, record the constraint and send it to the access owner. Do not solve a system limitation by quietly granting a broader role.
Test the handoff without exposing sensitive data
A short confirmation can verify that the new channel works, but the test should not include protected bank, tax, employee, or identity data. Ask the supplier to acknowledge the contact role and account scope. Then monitor the next ordinary invoice or statement exchange. Check that automated mailbox rules place the reply in the right queue and that the case still shows the supplier account and company entity. Keep the test result with the original request so a later reviewer can see the whole sequence. If messages bounce, route to an unexpected domain, or produce conflicting replies, reopen the case rather than creating another unlinked contact record. Record the failed delivery and the safe channel used for follow-up. The first successful email alone does not prove every downstream system is correct, and a delivery receipt does not prove that the intended person reviewed the message.
Close the review with the verified scope, effective date, systems changed, reviewers, confirmation result, and remaining exceptions. Notify the internal owners who rely on the contact, including purchasing or treasury only when their workflow is affected. Set a review date when the change is temporary, such as maternity cover or a short supplier transition. When the first statement or invoice arrives through the new contact, compare its account and remit information with the verified supplier record. A mismatch should reopen the case; it should not be accepted merely because the sender now appears on the contact list. For an outsourced AP handoff, keep the role narrow: the specialist gathers the request, completes approved verification steps, updates permitted fields, and routes exceptions. The company retains authority over vendor master approval, contractual changes, tax decisions, bank data, and payment release.
Continue with vendor onboarding administration and the define the supplier-maintenance scope.
Review the contact change record
- Contact role and account scope are explicit
- Verification used a previously established channel
- Bank, tax, and contract changes follow separate controls
- Former contact and effective dates remain in history
- Every affected system has an owner and completion record
- The new channel was tested without sensitive data
Common questions
Accounts payable virtual assistant FAQs
Is replying to the new address enough verification?
No. Verify the change through a channel that existed before the request, such as an approved portal, known phone number, established account manager, or other company-approved source.
Should the old supplier contact be deleted?
Keep the former contact, inactive date, and reason when the system permits it. The history helps explain earlier correspondence, disputes, and commitments.
Can the same request change bank information?
A contact-change request should not authorize bank changes. Route bank details through the company's separate verification and approval process.
Factual checks
Sources
These sources support the tax-form, access-control, and phishing guidance in this article. The planning numbers above are labeled examples and do not come from these sources.
- CISA guidance on phishingGovernment guidance supporting independent checks of suspicious or changed communication channels.
- NIST least privilege glossarySupports limiting supplier-contact access and AP preparation permissions to the assigned task.
- FBI business email compromise guidanceGovernment guidance supporting out-of-band verification when business correspondence changes.
International Labour Organization guidance on remote work arrangements reinforces why remote role briefs should document expectations, communication rhythms, and accountable handoffs.
Contact Us to turn this article into a scoped Philippines-based staffing brief.