How to Run AP, AR and Payroll at $3M Without a Finance Team

The invoice was for $14,200 and it got paid twice. Once by you on a Thursday night from the bank app, once by your office manager on Monday from the bill-pay queue, because nobody marked it. You found it six weeks later because the vendor was honest enough to mention the credit. That is the good version. The bad version is where the remittance details were changed by someone who is not your vendor, and there is no credit to find.

You are somewhere between $3M and $15M and the accounting software is fine. The software was never the problem. What you are missing is a finance function: four written processes (AP, AR, payroll, expenses), one split of duties so no single person can both cause a payment and hide it, and one month-end close with a date on it. That is the whole design, you can run it with a bookkeeper, an admin and yourself, and you do not need a CFO to build it. Here is how it goes together without a finance team, what breaks first, and the order in which to buy help.

What actually breaks between $3M and $15M

Under about $2M, one careful person holds it all in their head and it mostly works. Past that, volume beats memory, and each process fails in its own way.

AP breaks at approval, not entry. Bills get entered. What goes missing is evidence that someone with authority agreed to the amount before the money left, and that the invoice was not already paid. Duplicates come from three habits: paying from a PDF in email instead of the bill record, paying one invoice under two near-identical vendor names (“Northline Supply” and “Northline Supply Co”), and paying off a statement containing invoices already settled. Three rules kill most of it. One vendor record per vendor, with duplicate-invoice-number blocking on. No payment above a threshold you set without a named approver. And every payment released from one queue on one or two set days a week, never ad hoc from the banking app at 11pm.

AR breaks at follow-up, not invoicing. Almost nobody at this revenue fails to send invoices. They fail to chase them on a schedule, by a named person, with a consequence at the end.

Payroll breaks at deposits and classification. Not at the calculation, which your provider does. At whether deposits landed on the schedule the IRS assigned you, and whether the four people you pay on 1099s would survive a look at how you direct their work.

Expenses break at substantiation and card sprawl. You handed out cards because chasing reimbursements was worse, and now nine people hold cards and a quarter of the receipts never arrive. The IRS standard for a supporting document works as policy exactly as written: records should “identify the payee, the amount paid, proof of payment, the date incurred, and include a description of the item purchased or service received.” A card statement line proves payment, not business purpose, and business purpose is the part that fails under examination. Travel, gift and vehicle costs carry extra substantiation rules under Publication 463. So: a monthly limit and merchant-category restrictions on every card, receipts captured within seven days, and unsubstantiated spend above a threshold deducted from the cardholder’s next pay. Write that last rule down before you need it.

Segregation of duties, with only three people

Segregation of duties means no one person controls more than one of these three things: creating who gets paid, approving that they get paid, and reconciling the account the money left. It is the highest-value control available to a small business and it costs nothing but sequence.

Why those three? Nearly every real loss at this size follows one shape: someone creates a vendor or employee who should not exist, or changes the bank details of one who should, approves the payment, then reconciles the statement so the entry looks ordinary. Break any link and the scheme needs a second person to cooperate. That moves you from “a trusted employee could take money for years” to “two people would have to conspire.”

The minimum viable split with two or three people in the loop:

Vendor and employee master data. One person requests a new vendor or a bank-detail change, a different person activates it. With only two of you, the owner activates. Highest-risk field in your system.
Approval. Whoever enters bills does not approve them, and approval happens inside the software where it leaves a record, not as a verbal “yeah, pay it.”
Payment release. Realistically the owner, releasing a batch they can see. Your bank offers dual authorization on ACH and wires at no cost. Turn it on.
Reconciliation. Whoever reconciles bank and card accounts cannot create vendors or release payments.
Statements. The owner holds read-only bank statement access on a login nobody else has, and opens it. If you split nothing else, split this.

Where you genuinely cannot separate duties, substitute owner review and make it specific. Monthly: the list of new and changed vendors, every payment over your threshold with the approver’s name beside it, and the payroll register against last period with variances explained. Fifteen minutes.

The fraud this is protecting you against

The FBI’s Internet Crime Complaint Center describes business email compromise as “a sophisticated scam targeting both businesses and individuals performing a transfer of funds,” usually run through a compromised or spoofed business email account. The version aimed at a company your size is boring and effective. A supplier’s mailbox is compromised, the attacker reads the thread, waits for a real invoice and sends a near-identical one with new remittance details, sometimes from the supplier’s genuine account. It works because the request references real work.

IC3’s guidance is to use “secondary channels or two-factor authentication to verify requests for changes in account information,” to check sender addresses really match the person they claim to be from, and to watch accounts for irregularities such as missing deposits. SBA says it plainly: if something seems suspicious from a known source, ask the source directly. Make that a control with no discretion in it.

Any change to bank details, remittance address or payment method triggers a callback. No exception for urgency, and urgency is itself a flag.
The callback goes to a number already in your vendor record from before the request arrived. Never a number in the email, the new invoice or the signature block.
You speak to a named person and have them read you the last four digits of the new account. You do not send digits to them.
Whoever called logs the date, the number dialled and who answered in the vendor record. That note is what your bank and insurer will ask for.
The first payment after any change is small, or held one cycle.

Then tell your bookkeeper in writing that they will never be criticised for delaying a payment to make a callback, including when the email appears to come from you. Most losses at this size are enabled by a junior person not wanting to look obstructive.

Collections is a process, and it beats your pricing debate

Do the arithmetic before arguing about anything else. At $6M you bill roughly $16,400 a day, so pulling your average collection period in by seven days releases about $115,000 of cash currently sitting in other people’s accounts, at no cost in margin or nerve. A 1% price increase on the same revenue is worth $60,000 a year and it recurs, which is better long term, but it takes months of argument and carries volume risk. The collections week is available now.

A working AR process has five parts, and the one people skip is the last.

Terms on the document. The due date as an actual date, not “Net 30.” Late-payment interest stated. ACH details that never change by email. The customer’s PO number where they require one, because a missing PO is the most common legitimate reason a large customer has not paid you.
A dunning schedule that runs itself. Day minus 5: confirm the invoice is approved and scheduled. Day 1 past due: automated reminder. Day 7: personal email on the thread asking a question rather than restating the balance. Day 14: call accounts payable and copy whoever ordered the work. Day 30: call from the owner. Day 45: stop-work notice. Day 60: collections or legal.
A named caller. Not “sales will chase it,” because sales will not: they have a relationship to protect and no incentive. Routine chasing goes to your bookkeeper or admin, and the owner’s call is reserved for over-60 balances, where it works precisely because it is rare.
A weekly fifteen-minute AR meeting. Aged receivables on screen, oldest first, one sentence per line: next action, and when. Nothing else. This is why the schedule actually happens.
A stop-shipping rule you will honour. Decide now, in writing, when you stop delivering: a dollar exposure limit or an age, whichever hits first, with credit exceptions requiring the owner and logged. The business that fails here is not the one whose customers pay slowly. It is the one that kept shipping to a customer already 90 days down and lost the whole balance at once.

Payroll is the one where mistakes compound

Most errors you can fix in the close. Payroll errors replicate on a cycle and carry personal exposure.

Deposits first. The IRS runs two deposit schedules, monthly and semi-weekly, and which applies to you is fixed before the calendar year begins from your lookback period, per Publication 15. Deposits must be made electronically. The failure-to-deposit penalty is tiered by lateness: 2% at 1 to 5 days late, 5% at 6 to 15 days, 10% beyond 15 days, and 15% where it is still unpaid more than 10 days after the first IRS notice. The tiers do not stack, and interest is charged on penalties. Small percentages, multiplied by twenty-six pay periods of an error nobody noticed. Check the IRS penalty pages for the rates in your year rather than trusting any article, including this one.

Then the part that should make you careful. Withheld income tax and the employee share of FICA are trust fund taxes, and the Trust Fund Recovery Penalty can make an individual personally liable for “the full amount of the unpaid trust fund tax, plus interest.” The IRS says it can reach an officer, a partner, a sole proprietor or an employee, and any agent with authority over the funds. The failure must be willful, defined as acting “voluntarily, consciously, and intentionally,” and the IRS’s own example is direct: you are acting willfully if you pay other expenses of the business instead of the withholding taxes. Read that twice if you have ever been tempted to make payroll and delay the deposit.

Classification is the other compounding error. The IRS applies common-law tests across three categories, behavioral control, financial control and the type of relationship, and states plainly that there is “no ‘magic’ or set number of factors” that decides it and that no single factor stands alone. Two questions get there faster than a checklist. Do you set when and how the work is done, or only what the outcome must be? Is this person’s work a key aspect of your business, done continuously, with no other clients? Form SS-8 gets an official determination, but the IRS says it may take at least six months, so it is no fix for next Friday’s payroll. Section 530 relief exists where you had a reasonable basis and filed information returns consistently, on condition that you have not treated any worker in a substantially similar position as an employee. State tests are often stricter than the federal one.

Controls: the owner approves every run against a register, comparing headcount and gross to last period; whoever can add an employee cannot approve the run; deposit confirmations are filed monthly; the provider’s filing status is verified quarterly rather than assumed. “Our provider handles it” is a hope, not a defence.

The role stack, and the order to buy it

Bookkeeper first. Not a data-entry service, someone who owns accuracy: every bank, card, loan and processor account reconciled monthly, AP entered and scheduled, AR aged and chased, payroll journals posted, documents attached, books closed by a date. Typically 40 to 100 hours a month at this size. Everything downstream is worthless without it.

Controller-level review second. Four to ten hours a month, often fractional. A controller does not perform the close, they review it: they own the chart of accounts and coding policy, check the balance sheet rather than skim the P&L, confirm accruals, deferred revenue, prepaid items and loan balances, and sign off the reconciliations. They are also your compensating control when the bookkeeper cannot be separated from reconciliation. This is the layer that makes statements good enough for a bank or a buyer, and the layer most companies your size are missing, which is why the numbers exist but nobody trusts them.

Fractional CFO third. Thirteen-week cash forecasting, margin analysis by job or product line, pricing and capital structure, budget versus actual with variances explained, the conversation with your lender or an acquirer. Genuinely valuable, and wholly dependent on the two layers beneath it.

Owners buy the third one first, because it is the interesting conversation and the easiest thing to find online. Then they pay several thousand a month for forecasts built on unreconciled books, get advice that is confidently wrong, and conclude that outsourced finance does not work. If your accounts are not reconciled and your close has no date, a CFO cannot help you yet. Spend the money one layer down.

What never leaves your desk

You can outsource all of the work and none of the authority. Approval authority: a written schedule of who can commit the company to what, by amount and category, with you above the threshold. Providers recommend payments; you approve them. Banking credentials and admin rights: bank logins, the accounting subscription and the payroll account sit in the business’s name with you as sole administrator, and providers get named, scoped accounts you can revoke in one click, never shared logins and never the master. Review that access quarterly. The signature: wire and ACH release, and the second authorization on dual-control payments. Delegate the second approver to a partner in the business if you must, never both.

A month-end close that a five-person company can finish

The close turns bookkeeping into information, and it needs a date rather than a frequency. Books closed by the 15th business day of the following month is realistic here, and the 10th is achievable once it settles. Put it in the engagement letter and treat a miss as a problem rather than a mood.

Every bank, card, credit line, loan and processor account reconciled, with any unexplained difference written down instead of plugged.
Aged AP and aged AR reviewed; anything past 60 days gets a name and a next action.
Payroll journals posted, tax liability accounts agreed to the provider’s reports, deposit confirmations filed.
Unsubstantiated card spend listed by cardholder and escalated.
Recurring accruals and prepaid items booked, revenue recognised in the period it was earned.
Balance sheet reviewed line by line against last month. A P&L can look fine while the balance sheet holds a suspense account nobody will explain.
New and changed vendors listed for owner review, with every above-threshold payment and its approver.

Then read three numbers, and only three, because an owner handed eleven reports reads none of them.

Cash, and the next thirteen weeks of it. Balance today, plus expected collections, minus payroll, tax deposits, debt service and committed AP, week by week. Profit is an opinion. This is not.
Gross margin by line of business, this month against the last three. Not revenue. Revenue at $8M with margin drifting down two points a quarter is a company heading for trouble, and the drift is invisible on a revenue chart.
Days sales outstanding, plus the over-60 balance in dollars. One measures the process, the other measures what you are about to lose.

Two of the three are cash, deliberately. Companies at this revenue rarely fail because nobody could state last month’s net income. They fail because a large receivable went bad while payroll, tax deposits and vendor terms all landed in the same fortnight.

Questions owners ask next

Can software replace segregation of duties?

It enforces it, which is not the same thing. Approval workflows, duplicate-invoice blocking, per-user permissions, audit trails and bank dual authorization make the split practical for a small team. What software will not do is decide who holds which role, or notice that the person approving bills also reconciles the bank because you granted both permission sets to save time. Turn the controls on, then audit the rights twice a year.

Should AP and AR sit with the same person?

Acceptable if that person cannot create vendors, release payments or reconcile the bank. The risky overlap is collections plus cash application, because one person can then apply a customer’s payment somewhere other than the customer’s account. If it must be combined, have someone else reconcile deposits to the AR ledger monthly.

Is remote or offshore finance support safe for this?

Yes, with the same architecture you would apply to anyone local: named individual logins, scoped permissions, no bank release rights, no shared credentials, approval authority retained by you, access reviewed quarterly. The risk in outsourced finance work is almost never geography. It is undocumented process and access nobody has audited.

This article is general information, not tax, legal or accounting advice. Penalty rates, deposit rules and classification tests change and depend on your facts. Use the IRS pages linked below and a licensed professional for your own situation.

If the design above is clear but you do not have the people to run it, that is the gap AB7 Solutions fills. We place trained remote finance professionals into exactly these processes: AP entry with approval routing and duplicate controls, AR aging with a dunning schedule somebody actually works, payroll coordination and deposit-calendar tracking, expense substantiation and card policy enforcement, and a month-end close delivered against the date you set. We also build the plumbing, automating invoice capture, approval routing and the handoffs between your accounting, payroll and banking systems so the controls run without anyone remembering to apply them, and our security practice hardens the email and authentication layer that business email compromise attacks in the first place. Two commitments: approval authority, banking credentials and the signature stay with you by design, and if what you need is a bookkeeper rather than a finance function, we will say so instead of selling you a stack. To walk through your volumes and where the process is breaking, call +1 321 341 7733, email ab@ab7solutions.com or director@ab7solutions.com, or visit www.ab7solutions.com.

Sources: IRS Depositing and Reporting Employment Taxes, Failure to Deposit Penalty, Trust Fund Recovery Penalty, Independent Contractor (Self-Employed) or Employee?, What kind of records should I keep?; FBI Internet Crime Complaint Center, Business Email Compromise; SBA, Strengthen your cybersecurity.