Accounts payable SOX compliance software for AP controls under SOX 404, their evidence and the access review your auditor samples

SOX compliance in accounts payable is the set of documented internal controls over the invoice-to-payment process, and the evidence that they operated, which a public company needs for its Section 404 assessment of internal control over financial reporting. It typically covers invoice approval, three-way match, vendor master changes, segregation of duties, the AP to GL reconciliation and access to the AP system.

The controls most auditors treat as key in AP are invoice approval per the delegation of authority, three-way matching of invoice, purchase order and receipt, approval and review of vendor master changes, segregation of duties between entering, approving and paying, the monthly AP subledger to general ledger reconciliation, and a periodic review of user access to the AP system. Most small companies need three to eight of them.

Usually two tools, not one. An AP automation tool such as BILL, Ramp or Stampli enforces approvals and matching on each invoice. A control layer proves the periodic reviews happened: Optro or Workiva for companies with internal audit, or Complies for a small finance team at $119 to $299 a month. Pathlock adds ERP segregation-of-duties analysis where that risk is material.

No. SOX does not prescribe any specific control. It requires management to maintain and assess effective internal control over financial reporting, and three-way matching is the most common way companies address the risk of paying for goods never received. If you do not match, you need another control that covers the same risk, and your auditor will test that instead.

Segregation of duties in AP means no single person can create or change a vendor, enter an invoice and release the payment. Small teams that cannot fully separate those roles use compensating controls, typically an independent review of the vendor change log and of payments released, performed and documented every period by someone outside the process.

Most companies review access to financially significant systems, including the AP tool and ERP, quarterly. SOX itself does not set the interval; your risk assessment and your auditor do. Quarterly is the common default because it limits how long an inappropriate access could have gone unnoticed, and it produces four dated records a year that are easy to sample.

Not on its own. AP automation enforces rules on each invoice and keeps a strong transaction trail, which supports several controls. SOX compliance also needs the periodic controls around the tool: reconciliations, vendor master reviews, access reviews and exception reviews, each performed, reviewed and evidenced. Those live in a control register, not in the AP tool.

Section 404 does not apply to private companies. Companies preparing for an IPO, or to be acquired by a public company, are routinely asked to show SOX-ready AP controls well before they file, and lenders and investors increasingly ask for the same discipline. Management's first 404(a) assessment is due with the second annual report after going public.

It depends on the layer. AP automation runs from about $15 per user a month (Ramp Plus, plus a platform fee) to $89 per user a month (BILL Corporate). Enterprise SOX platforms are quote-only, with Vendr medians around $46,000 (Optro) and $49,420 (Workiva) a year. Complies publishes $119 and $299 a month at the yearly rate.

For each sampled period: the approved invoice with the approver visible, the match or the cleared exception, the vendor change log with the independent review sign-off, the reconciliation with preparer, reviewer and dates, and the access review decision for the AP system. Auditors reject evidence that has no reviewer, no date, or was created after the period it claims to cover.