Research · Published:
Can an AP approval packet be reconstructed after the decision?
Research on whether invoice approval evidence lets a later reviewer distinguish preparation, judgment, and authorization.
Methodology
Campaign date: 2026-08-21. Research question: if a later reviewer sees an approved invoice, can they reconstruct what was known, compared, and authorized at the time? Approval evidence is more than a green status. This study examines invoice packets containing the source document, matching records, exception notes, approval identity, decision date, and any change after approval. The scope is evidence reconstruction, not a claim about whether a sampled approval was economically wise or legally sufficient.
Evidence and scope
Methodology: the method uses a retrospective sample with three strata: ordinary matched invoices, invoices approved after an exception, and invoices changed after the first review. Select a period and entity before opening examples. Preserve immutable source links and approval history. GAO control principles frame the need for documented activities and reliable information. NIST guidance frames attribution and least privilege. These authorities support the test design; they do not dictate the organization’s thresholds or delegation matrix.
Key Stats
For each packet, distinguish source facts from preparation. The invoice states a supplier, amount, and date. A purchase order may state an order quantity. A receipt may show acceptance. A preparer may calculate a difference or highlight missing evidence. An approver decides whether the organization accepts the exception under its policy. If those layers are merged into one edited field, a later reviewer cannot tell whether an amount was sourced, calculated, or authorized.
Research-to-practice
Reconstruction should begin with a blank chronology. Ask a reviewer who did not prepare the item to identify intake, comparison, exception creation, approval request, approval response, and posting or payment handoff from the retained records. Record the first point at which the reviewer needs an explanation unavailable in the packet. That point is a practical evidence gap. It should not be repaired by asking the original worker to recreate a memory without labeling the reconstruction as retrospective.
Implementation
The outsourced support boundary is central. A support role may assemble the packet, calculate a stated variance, route a question, and record the approver’s response. It should not approve its own preparation, alter source values to match an expected result, or treat a manager’s informal message as a formal delegation unless policy says it is valid. The finance owner remains responsible for judgment, unusual terms, entity treatment, and release authority.
Key Takeaways
CISA’s phishing guidance is relevant when approval arrives through an unusual or urgent message. The sample should ask whether identity and channel were trusted, whether a request to bypass normal review was preserved, and whether an independent confirmation was required. Tone is not evidence of fraud, and a missing control record is not proof of malicious intent. The research identifies whether the process maintained a safe route for doubt and escalation.
Findings
Measurements should stay descriptive: percentage of sampled packets with a source link, decision owner, decision date, exception rationale, and post-approval change history. Report the denominator and strata. Do not present the result as an approval accuracy rate or assurance of compliance. Compare the evidence pattern across ordinary and exception items only to guide the next control test. A high completion count can coexist with weak reconstruction if the decision rationale is absent.
Findings
A useful remediation may be a structured decision note with separate fields for question, evidence reviewed, decision, authority, date, and follow-up. The note should preserve the prior proposal if the owner changes it. Avoid a free-text box that says “approved” without identifying what was approved. Avoid broad access that lets preparation staff delete or overwrite the trail. The system should make the safe route easier while leaving the owner’s authority intact.
Findings
Limitations include missing historical records, platform migrations, delegated approvals that vary by entity, and policies that changed during the sample. A reconstruction test cannot prove that a person read every attachment or that a financial decision was correct. It can show whether the retained packet supports later review. Keep those claims separate. If the evidence cannot answer a question, report the gap and the responsible policy owner instead of inventing certainty.
Findings
Evidence-led conclusion: an approval is reviewable when the packet shows source facts, preparation, exception reasoning, authorized decision, and later changes as separate events. Outsourced AP can make that packet coherent and searchable. Finance must retain approval judgment and the authority to accept exceptions. The best result of the study may be a stopped or escalated item, because stopping preserves the distinction between evidence preparation and authorization.
Findings
Repeat the reconstruction with a small set of changed packets after the decision-note fields are introduced. Ask whether the second reviewer can identify what changed and why without contacting the preparer. Keep the before-and-after findings together. This gives the finance owner evidence about the control itself and prevents a new form from being mistaken for a working approval process. Include one packet that was stopped and one that was approved after an exception. A design that records only successful approvals may look complete because it excludes the moments where judgment and escalation matter most. The review should make those boundary cases legible. Also retain the original proposal when a reviewer changes a coding note, amount, or route. The change history should explain the decision without blaming the preparer for raising a reasonable question.
Findings
Route-local sources: the GAO Green Book is available at https://www.gao.gov/greenbook, NIST SP 800-53 Rev. 5 is available at https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final, and CISA phishing guidance is available at https://www.cisa.gov/secure-our-world/recognize-and-report-phishing. They inform evidence, attribution, and verification questions; they do not decide the organization’s approval matrix.
Sources
These primary sources support the control principles and evidence boundaries in this report.
FAQs
Are the planning numbers benchmarks?
No. They describe a testable workflow shape and are not promises, market averages, or production targets.
What should an outsourced AP assistant own?
Repeatable preparation, documentation, status tracking, and follow-up within least-privilege access. Named finance owners retain approval and payment decisions.
When should an item be escalated?
When evidence is missing, a request changes payment details, a duplicate or fraud signal appears, or the item falls outside the written rule.