What IT Reviews Before Approving AP Automation Software

Before approving AP automation software, IT should review identity and access, the ERP connection, how payment and bank data is stored and encrypted, the vendor's independent reports, its testing evidence, and how the relationship ends.

That's the vendor security assessment in one sentence. The harder part is spending the two weeks you usually get in the right places. An AP platform holds every supplier's bank account number, writes to your general ledger, and sends money, so a review that treats it like any other SaaS questionnaire spends most of its time on the wrong questions.

Key Takeaways

• IT's review of AP software should follow the surfaces the platform touches, which are user identity, the ERP connection, payment and bank data, independent reports, testing, and exit.

• SSO with enforced MFA and automated deprovisioning matters more than any password policy the vendor describes.

• The ERP service account is the most overlooked risk in most reviews. Ask for its exact scopes and keep it out of administrator roles.

• Certifications answer only part of the question. A SOC 2 Type II report covers what the auditor tested, and PCI DSS applies to card data, so read the scope before you file the report.

• Plan offboarding before you sign, including data return, deletion, and revoking every ERP token.

What should IT evaluate before approving AP automation software?

IT should evaluate identity and access, ERP integration, payment and bank data handling, independent audit reports, security testing, and offboarding before approving AP automation software. Each one maps to something the platform actually does.

Third-party software is now the main door into most companies. Breaches involving a third party accounted for 48% of all breaches, up 60%, according to Verizon's 2026 Data Breach Investigations Report. That's the case for doing this review properly rather than signing off on a questionnaire score.

The review runs best in a fixed order:

1. Map the data flows. Get a diagram showing what moves between your ERP, the platform, your bank, and your suppliers, and in which direction.

2. Review identity. Confirm SSO, MFA, role design, and how users are added and removed.

3. Review the ERP connection. Name the service account, its scopes, and how its credentials rotate.

4. Review payment data handling. Find out where bank and card data lives and how it's encrypted.

5. Read the reports. Request the SOC 2 Type II report, any PCI DSS attestation, and the most recent pen test summary.

6. Agree the exit. Write data return, deletion, and access revocation into the contract.

Who owns the review, IT or finance?

IT owns the technical review, and finance owns the commercial diligence around it. Splitting it this way keeps the review from becoming one 300-question spreadsheet that nobody reads to the end.

Finance usually handles tiering, contract terms, and the business case, the territory of a vendor due diligence checklist, while IT handles everything in the table above. The handoff point is the data flow diagram. Once IT has signed off on what moves where, finance can negotiate around a known risk instead of a guessed one.

How should SSO, SAML, and user provisioning work?

AP software should support SAML or OIDC single sign-on through your identity provider, enforce MFA, and provision and remove users automatically through SCIM. If a former AP clerk can still log in a month after leaving, nothing else in the review matters much.

MFA is the cheapest control in this whole list. A Microsoft research team found that MFA reduced the risk of account compromise by 99.22% across the accounts it studied, and by 98.56% where credentials had already leaked, according to its 2023 paper "How effective is multifactor authentication at deterring cyberattacks?". The population was Azure AD accounts showing suspicious activity, so treat the figure as directional, but few controls come close.

Ask whether SSO is included in the plan you're buying, whether you can disable local passwords entirely, and whether deprovisioning ends active sessions or only blocks the next login.

Ask about patching too. Verizon's same report found that 31% of breaches started with vulnerability exploitation, which passed stolen credentials as the top entry point for the first time in the report's 19 years, so ask how quickly the vendor fixes critical vulnerabilities.

Which roles should the platform enforce?

The platform should enforce roles that separate invoice entry, approval, vendor master changes, and payment release. Those are the same lines your auditors expect to see in your own AP process.

Ask for the role matrix and test it in a sandbox. Can one user both add a vendor and approve a payment to that vendor? The answers should line up with your segregation of duties in AP, and every role change should land in the platform's audit log.

What about vendor portal logins?

Vendor portal logins need their own controls, because suppliers sit outside your identity provider. The portal is where a supplier enters or changes bank details, which makes it a target.

Ask how suppliers authenticate, whether MFA is required for them, and what happens when a supplier user changes the bank account on file. A good answer includes a hold on the change and an out-of-band confirmation before any payment goes to the new account.

What ERP access does AP automation need?

AP automation needs a dedicated ERP service account with the narrowest scopes that let it read vendors, invoices, and purchase orders and write back bills and payment records. It shouldn't need administrator rights, and it shouldn't share credentials with a human user.

I'd spend the most review time on this account. The integration user is the platform's way into your general ledger, and it's easy to get wrong during a rushed go-live. It's common for an integration user created with full administrator rights "just for go-live" to keep those rights for years, long after anyone remembers why. Nobody does anything wrong with it. It simply becomes the most powerful account in the ERP, with its password sitting in a vendor's configuration screen.

Ask for these specifics before approving:

• The exact roles, permissions, or API scopes the connector uses, by record type

• Whether it authenticates with OAuth tokens, token-based authentication, or a stored password

• How often credentials rotate, and who rotates them

• Whether the connector writes to the ledger, and which records it can create or change

• Whether you can test the whole integration in an ERP sandbox before production

Integration breadth matters here only as a proxy for maturity. Corpay offers 100+ ERP integrations, among them NetSuite and Sage Intacct, and a vendor with that many connectors should be able to hand you a scope list for your ERP the same day. If the scope list takes two weeks, the connector is probably newer than the sales deck suggests. If you're mid-migration, ask how the connector behaves during an ERP migration, when two ledgers run at once.

Protect cash flow with modern AP

Modernize AP to cut costs, speed approvals, and mitigate payment risk — gaining the real-time visibility to protect cash flow and scale with confidence.

Download the whitepaper

How does the integration method change IT's review?

The integration method changes what IT has to secure. A native connector runs inside the ERP under ERP permissions, an API integration uses credentials or tokens held by the vendor, and a file transfer moves payment and vendor files over SFTP.

Each has a different weak point. Native connectors inherit whatever role you assign, so scope creep is the risk. API integrations depend on token storage at the vendor. File-based integrations depend on who can read the transfer folder, which often holds full bank account numbers. Review the controls for the method your ERP will actually use.

How do B2B payment platforms handle bank data storage and encryption?

B2B payment platforms should encrypt bank and card data in transit with TLS and at rest with strong encryption, store encryption keys in a managed vault with restricted access, tokenize card numbers, and mask account numbers on screen. Ask the vendor to show you each of these in its data flow diagram.

That answers the "PPI" or personal-information question most buyers ask, but bank data deserves more attention than personal data, because a supplier's routing and account number is what a criminal needs to redirect a payment. Ask which vendor employees can see it unmasked, and how long it's kept after a supplier is deactivated.

Card data has a cleaner answer. Single-use virtual cards limit what any stolen card number is worth, and if card data passes through the platform at all, its handling falls under PCI DSS, as the guide to virtual card security and PCI explains.

Where does vendor bank data live?

Vendor bank data usually lives in two places, the AP platform's vendor master and your ERP's vendor record, and sometimes in a third, the payment file sent to your bank. Every copy needs the same protection.

Ask which system is the source of truth when the two disagree. A sync that overwrites the ERP from the platform, or the reverse, can quietly change a bank account without anyone approving it. Map that sync direction during the review and confirm that a bank-detail change in either system shows up in an AP audit trail with a named user and a timestamp.

How should bank-detail changes be controlled?

Bank-detail changes should require verification through a channel the requester didn't supply, a second person's approval, and a hold before the first payment goes to the new account. That control stops more fraud than any encryption setting.

The pressure on it is constant. AFP's 2026 Payments Fraud and Control Survey found that 74% of organizations were affected by business email compromise in 2025, and the FBI's 2025 Internet Crime Report counted $3,046,598,558 in reported BEC losses for the year. Most of those schemes end with a request to change where a payment goes, which is why Corpay's fully managed AP collects and confirms supplier payment details as part of the service. Ask any vendor whether it runs bank account validation on new and changed accounts, and test the change workflow yourself in the sandbox. The playbook criminals use is laid out in this guide to business email compromise in AP.

What security certifications and reports should AP software have?

AP software should have a current SOC 2 Type II report, a PCI DSS Attestation of Compliance if it stores, processes, or transmits card data, and a recent third-party penetration test. An ISO 27001 certificate is a useful supplement, not a substitute.

Certifications are the easy part of the review, since they're documents you request and read. For a SOC 2 Type II report, check four things:

• The audit period, and whether it ended within the last 12 months, with a bridge letter covering the gap

• The scope, and whether the product you're buying and its hosting provider are both in it

• Any exceptions the auditor noted, and management's response to each

• The complementary user entity controls, which are the controls the vendor expects you to run

That last item gets skipped more than any other, and it's the one that lands back on IT. A SOC 2 checklist for AP automation walks through reading the report section by section.

PCI DSS is narrower than buyers assume. It applies to card data, and a vendor shows compliance with an Attestation of Compliance, not a logo. The standard also moved recently. Of the 64 new requirements in PCI DSS v4.0, 51 were future-dated and became effective March 31, 2025, according to the PCI Security Standards Council. An attestation dated before then was assessed against a lighter version. How the standard applies to payment programs is covered in PCI DSS for B2B payment automation, and the finance-side view of all of this sits in the guide to AP automation security.

What should a pen test summary show?

A pen test summary should name the tester, the test date, and the scope. It should also count the critical and high findings and give the date each was fixed. Findings without remediation dates tell you little about how the vendor works.

Most vendors won't share the full report, and that's reasonable. A dated executive summary on the tester's letterhead is a fair ask, and a self-written statement means the testing is unverified.

What happens at offboarding?

At offboarding, the vendor should return your data in a usable format, delete it on a written timeline with a certificate, and you should revoke every credential the platform used in your SSO, ERP, and file transfer setup. Agree all of it before you sign, while you still have leverage.

Leaving access open is expensive. The global average cost of a data breach reached $4.99 million, up 12% year over year, according to IBM's Cost of a Data Breach Report 2026. An ERP integration account nobody remembers is exactly the kind of access that turns up in those breaches.

Public companies have a second reason to care. Under the SEC's 2023 cybersecurity disclosure rules, a public company must generally file a Form 8-K within four business days of determining that a cybersecurity incident is material. If the incident starts at your AP vendor, those four days start only once you know about it, so the contract's breach notification window matters as much as any control in the platform.

One loose end rarely gets settled. Vendors delete production data on request, but backups roll off on their own schedule, and I honestly don't know of a clean answer to that. Ask for the backup retention period in writing and decide whether you can live with it, then build the exit steps into the AP automation implementation timeline from the start.

See how Corpay connects to your ERP and pays your vendors

The review above comes down to two questions IT keeps asking. What does the platform need from our ERP, and what happens to our suppliers' bank details once it has them?

Corpay AP automation connects through 100+ ERP integrations, including NetSuite, Sage Intacct, Business Central, and Acumatica, so your team can review a connector built for your ledger. Corpay pays suppliers by virtual card, ACH, or check from one approval flow, and its fully managed AP handles supplier enrollment and follow-up so bank-detail collection doesn't land on your AP team's inbox. Card payments use single-use virtual cards. With Corpay payments automation, AP teams save about 40% of the time they spend on processing, and most customers are live in weeks.

Frequently Asked Questions

What is a vendor security assessment for AP software?

A vendor security assessment for AP software is IT's review of how the platform handles identity, ERP access, payment and bank data, independent audit reports, security testing, and offboarding. It decides whether the platform can safely hold supplier bank details and connect to your ledger.

What security certifications should AP software have?

AP software should have a current SOC 2 Type II report and, if it handles card data, a PCI DSS Attestation of Compliance. Ask for a recent penetration test summary too. ISO 27001 is a helpful supplement but doesn't replace the SOC 2 report.

Does AP automation software need SSO?

Yes. AP automation software should support SAML or OIDC single sign-on with enforced MFA, plus SCIM provisioning so users are removed automatically when they leave. Confirm SSO is included in the plan you're buying.

How should AP platforms encrypt bank data?

AP platforms should encrypt bank data in transit with TLS and at rest with strong encryption, hold keys in a managed vault, mask account numbers on screen, and limit which vendor staff can view unmasked data. Card numbers should be tokenized.

How long should an IT review of AP software take?

An IT review of AP software usually takes two to four weeks. Most of that time goes to the ERP integration and data flow review, and to waiting on the vendor's reports under NDA, so request the documents on day one.

David Luther

Product Marketing Program Manager

David Luther, MBA is a product marketing program manager with years of experience in commercial banking, finance, and technology sectors, with research and writing appearing in financial publications.

AP Automation

Risk management