Keeping your company’s accounts payable efficient — and secure

Accounts payable (AP) and accounts receivable (AR) systems are becoming increasingly digitized to create faster, more accurate and reliable transactions and records while also enabling cloud-based and remote workflows. Digitization brings flexibility and convenience to many AP processes — but it also adds complexity, which makes those processes more vulnerable to cyber crime.

As companies of all sizes seek competitive advantage in AP automation, there is a greater need for them to understand the associated cyber security risks and address potential gaps in their defenses. This often means more investment in security controls, but technology is just the start. Employees are also critical to AP security.

No company can eradicate the cyber security risk to AP systems. But effective processes, controls and triggers that automatically alert employees to potential breaches can prevent or mitigate many attempted crimes. Human error and the evolving criminal tactics will continue to present challenges, but the combination of educated employees, strong processes and effective use of automation can provide extensive protection for AP systems and data.

Common threats to AP systems

AP cyber security begins with understanding how criminals exploit system vulnerabilities and which processes pose the most risk. Here are some of the most common areas of concern.

One of the most established cyber crime methods is business email compromise (BEC). It can involve a variety of tactics aimed at manipulating or rerouting invoices.

For example, a cyber criminal might compromise a vendor’s email account, gaining access to invoices, and then change important bank information. The AP department may then unwittingly direct payment to the criminals’ account. Or thieves might gain access to an executive’s email account, mimic that person’s communication style and use their account to submit fake invoices without setting off alerts.

Criminals often take time to study their targets to make their BEC attempts more convincing. Once they have compromised a company email account, they may study how the owner communicates and what topics arise often in their exchanges with vendors or customers. Such tactics, which are known as “social engineering,” can make fake communications seem more normal and unexceptional — and therefore easier for AP personnel to miss.

Many of the functions in a company’s purchasing and AP systems might be separate from each other. But to facilitate the transfer of data, at some point they need to be linked to communicate with other systems and provide complete workflows.

For instance, invoicing systems may be connected to accounting software and perhaps to payment processors, and enterprise resource planning (ERP) systems may be linked to treasury platforms. Each node in this digital network provides cyber criminals with opportunity to breach the security perimeter and hack into multiple systems.

The more connected a program is, the more data it will collect from other programs or vendors. Data, particularly personally identifiable information, is another attractive target for cyber crime, since it can be used to create false identities or harvested for use in other criminal activities.

Third parties in a company’s supply chain — or even fourth-parties, which are not directly linked to the AP system — compound threats to connection points. Even if an organization’s AP security is robust, criminals may exploit weaknesses in primary or secondary connections to gain access to the organization through a trusted channel.

AP functionality is becoming more reliant on distributed cloud systems. The security of cloud servers is generally robust, but not infallible. Moreover, companies need to take steps to make sure their AP systems are safely connecting to the cloud, and also make sure employees are not introducing vulnerabilities through improper configuration of cloud controls.

AP personnel, like other critical workers, can perform their tasks from almost anywhere. But many lack safety controls on their remote or personal devices — or even a secure internet connection. In many companies, decision-makers have no clear view of the security protocols in their employees’ homes.

How to protect the entire AP network

While every organization will have distinct needs based on its system specifics, company culture and work processes, here are some guidelines for maintaining security in these critical functions: