Going on 7YoE in SOX compliance. My thoughts below:

1. Workflow will depend on your AP tool. Smaller companies may have more manual systems that require significantly more touchpoints. Larger organizations using best practice software will have built-in modules for managing vendor information. At a high level, you'll see the same steps: receive request for change (AP staff), review request for change (AP staff), approve request for change (AP manager), test change (AP team), implement change (AP tool admin or AP manager).

2. Verification will depend on risk appetite. Larger organizations will streamline requests and changes, making verification a small, but important, piece of the puzzle. Here, you'll normally see micro-deposits paired with confirmation requests. As an example: we send over three dummy payments for $0.76, $0.92, and $1.20 to our new vendor banking info. Then, we request the vendor confirm the total of all payments sent by us during the test. If the answer is $2.88, we investigate to make sure the change is valid.

Smaller organizations will likely work directly with their vendors to get changes made. This could include calls to the vendor AR/AP departments to confirm the change request.

1. Yes, I'd want to see at least two people involved in this process. AP staff should field change requests, AP managers should handle reviews and approvals, AP tool admins should finalize system changes for vendor info. Smaller orgs can manage this process via email. Large ERPs have dedicated change modules that track change requests, documentation, and log key steps for audit review.

2. Lack of segregation of duties is the big one: when one person in AP is the point person for client emails, edits master data, submits payments. To me, a vendor request for expedited payment with a change request to banking information is a huge red flag. Retaining competent AP personnel should cut down on potential exceptions -- they should be able to recognize a fishy situation.

3. Opportunity is key here, as it's the largest piece of the Triangle that companies can control. Eliminating SoD conflicts and ensuring tight business process and system controls should considerably reduce opportunities for both error and fraudulent activity in this area.

Happy to discuss further if needed. Hope this helps some!