Why Your Company Needs an Account Payable Risk and Control Matrix

Accounts payable (AP) departments face risks every day, even ones they’ve taken careful steps to mitigate.

Running an AP department means knowing there’s always a chance that faulty records or unfamiliar financial territory can lead to unnecessary or fraudulent business-to-business (B2B) payments. It also means that sometimes, no matter what controls a company puts into place, some amount of residual risk will remain.

That said, companies don’t have to simply accept risk and sit helplessly awaiting the inevitable.

With the help of an accounts payable risk and control matrix, companies can enhance their internal controls process and become more risk-aware. Join us as we explore why to start doing this today, how to do it, and how AP automation software can help with this task.

Why You Need an Accounts Payable Risk and Control Matrix

Many accounts payable partners take risk assessment on an informal, case-by-case basis, figuring out what they need to do as they go. While it’s smart for businesses to be agile and ready to adapt whenever necessary, it’s also wise to have a ready-made plan.

Two reasons to start developing an accounts payable risk and control matrix today? To proactively address two pesky problems in accounting: inherent and residual risk.

Reason No. 1: Inherent Risk is Common in Accounts Payable

The average accounts payable department processes hundreds, if not thousands of invoices each month, with PYMNTS.com noting that on average, businesses need 14.1 days and the input of anywhere from 2-5 people to process each invoice. Within all of this, a lot can go wrong, particularly when it comes to less-than-routine accounting. This work carries increased inherent risk.

Investopedia defines inherent risk “as the possibility of incorrect or misleading information in accounting statements resulting from something other than the failure of controls.” While inherent risk is likely often the result of ignorance, it’s also commonly associated with complex or unusual calculations.

Inherent risk in accounts payable can lead to all sorts of less-than-ideal outcomes including, according to Small Business Chronicle, incorrect over or underpayments to vendors and remittance to fraudsters.

Of course, some degree of inherent risk will probably always be present in business, as no company has the proverbial crystal ball or ability to know every variable or motivation in a complex transaction or deal. All the same, as we’ll show in a little while, there are steps a business can take to reduce inherent risk.

Reason No. 2: Residual Risk is also Prevalent

Sometimes, though, even with a good degree of caution and careful accounting, risk will remain for companies. This is known as residual risk, which Compliance Week defines as “the exposure that remains after you’ve assessed the existing controls.”

Also known as audit risk, residual risk comes about when a company has taken some steps to address a potential problem but, in one way or another, hasn’t dealt with the issue fully. It’s like when a company upgrades the servers for its internal accounting network but neglects to invest in off-site data backups in the event of a natural disaster (or to consider cloud-based accounting software that does this automatically).

Residual risk also doesn’t have to be the result of negligence. Similar to inherent risk, some risk will likely remain no matter what a business does or doesn’t do. To operate a business is to accept some degree of calculated risk. As Sarah Blakely in her MasterClass for Entrepreneurship notes, “Calculated risk is an unavoidable component of business success, so it is wise to mentally embrace the idea before you even draft a business plan.”

The key is to reduce inherent or residual risk wherever possible. An accounts payable risk and control matrix is a great way to do this.

Building Your Accounts Payable Risk and Control Matrix: How to Do It

Now that we’ve established the need to deal with both inherent and residual risk in accounting, here’s how to create matrices that will help you rate each type of risk.

Creating an Inherent Risk Matrix

It’s worth noting that inherent and residual risk matrices work in tandem, with the tabulated level of inherent risk helping to determine residual risk. Thus, it’s smart to compute inherent risk ahead of trying to assess residual risk.

To start with, make a chart. On the Y-axis, place a scale of how often a possible risk might occur, starting with “Rare” at the bottom and getting progressively more frequent the higher the chart goes. On the X-axis, place a scale rating the impact that the risk would have, from “Minimal” at the beginning of the X-axis to higher and higher the further out it goes.

There isn’t necessarily a defined number of squares that need to be in the inherent risk matrix. Some sources online are 3-by-3, others are 4-by-4, and others 5-by-5. A common thread between all, however, is that inherent risk increases the higher and further to the right that a risk scores, with the lowest risk in the lower-left corner and the greatest risk in the upper right corner.

Creating a Residual Risk Matrix

Once an inherent risk matrix has been created, it can be used to help create a residual risk matrix. On the Y-axis, place a scale related to the estimated effectiveness of whatever control mechanism your team has devised, going from strong at the bottom to progressively weaker the higher the Y-axis goes. On the X-axis, create a scale of the calculated inherent risk from minimal to high.

Again, as with the inherent risk matrix, there aren’t a set number of squares that need to be in a residual risk matrix. That said, for the sake of consistency, it’s wise to use the same number of squares in a residual risk matrix as whatever you’ve opted for with your inherent risk matrix, for the sake of consistency and comparison.

Inherent and Residual Risk Matrices: Good, But Not Enough on Their Own

So for all the talk of how to calculate inherent and residual risk matrices in accounting, here’s something else to consider.

While being able to compute each type of matrix and incorporate it into a broader risk assessment strategy is a great start for running a more efficient and error-free accounting department; without the help of other essential tools, it might not be enough.

How an Accounts Payable Risk and Control Matrix is Part of a Broader Risk Assessment Strategy

While inherent and residual risk matrices are powerful tools for helping rate accounting risks, they’re best deployed as part of a comprehensive risk assessment strategy. After all, while the computational logic that goes into matrices somewhat removes subjective judgment from risk assessment, it doesn’t eliminate it.

In this final section, we’ll look at what to use in addition to matrices to enhance accounting control and awareness.

Accounting Tools to Wield Alongside Inherent and Residual Risk Matrices

Know how to compute inherent and residual matrices? Great. Here are a few other best practices to be sure to incorporate into your accounting department.

• Regular accounts payable audits, both planned and unplanned, which dive into an AP department’s records and, as Investopedia notes, “make sure that the financial records are a fair and accurate representation of the transactions they claim to represent.”

• Batch processing, where invoices are sent through in large groups. This can help ensure that the same procedures are followed with each invoice and also that the most adept clerks within an AP department handle data entry, a loathed process that can be rife with errors.

• Developing accounts payable internal control checklists, policies or rules that lessen the potential for rogue spending, where unscrupulous AP clerks or others can clandestinely rack up fraudulent charges for their companies. Volt Consulting describes rogue spending “like an invisible leak, draining your financials and causing real headaches in both finance and procurement departments.”

But finally, the smartest risk assessment strategy of all in accounting might be to look to automation software.

How AP Automation Software Guards Against Inherent and Residual Risks

To really take accounting risk control to the next level, it’s wise to think about investing in AP automation software.

With the help of its artificial intelligence, cloud-based accounting automation software can guard against numerous risks both inherent and residual. It can use artificial intelligence and machine learning to pore through hundreds or thousands of digital invoices, flagging potential signs of accounts payable fraud. It can control spend, perform pre-audit preparation work, and streamline invoice processing and routing to prevent approvals from becoming a quagmire.

The best risk awareness strategies might be those that are sophisticated and multi-faceted. AP automation software, like accounting matrices, is just a part of it. But in a business world where the next unforeseen challenge is usually right around the corner, it doesn’t hurt to have invoice management automation or matrices at the ready.

Minimize your accounting risks. Try Stampli’s AP automation solution today.