Most payable policies mention vendor set-up. Fewer describe what happens when an existing supplier emails a new bank account “effective immediately.” That gap shows up again and again in our vendor master assessments.

Separate create from amend

The person who can add a new vendor should not be the only approver for bank detail amendments on live payees. Even in a three-person AP team, a second pair of eyes — finance manager or treasury — closes a common hole.

Call back on known numbers

A call-back to a phone number already on file beats replying to the email that requested the change. It sounds slow; it is faster than recovering a misdirected HKD 400,000 payment.

Keep a change log you can export

If your system cannot list bank amendments for a quarter, say so early in an audit. We can still sample from email archives, but the work takes longer and the findings will note the missing report.