# AP Controls, Audit Trail and Human Review | InvoiceIQ AP by Analytos

> AP automation should never be a black box that posts money. InvoiceIQ AP by Analytos keeps a person approving every posting, refuses any bill that does not…

Canonical URL: https://invoiceiq.analytos.ai/ap/controls-governance

Controls and governance

# AP automation controls  
and a full audit trail

A person approves every posting, every bill must equal its invoice, and every action is on record.

[Book a walkthrough](https://invoiceiq.analytos.ai/contact)[InvoiceIQ AP by Analytos](https://invoiceiq.analytos.ai/ap)

The question: What controls should AP automation have?

## The short answer

AP automation should never be a black box that posts money. InvoiceIQ AP by Analytos keeps a person approving every posting, refuses any bill that does not equal its invoice, runs rules in a restricted sandbox rather than calling a model at posting time, versions every rule with rollback, and records every posting attempt, including refusals, with who clicked it and why.

## The controls

| Control | What it guarantees |
| --- | --- |
| Human approval | Every posting has a named approver |
| Golden rule | The composed bill equals the invoice, or the post is refused; cannot be switched off |
| Sandboxed rules | No imports, network, filesystem, clock or randomness at posting time |
| Backtesting | Rules must reproduce past documents before they activate |
| Versioning | Every rule and policy change is versioned with one-click rollback |
| Posting Log | Every attempt, posted or refused, with approver, policy and ERP link |
| Match report on the bill | The ERP record carries the same exceptions InvoiceIQ AP raised |

## Is this a fit?

### A good fit when

-   Auditors ask why a line was coded a certain way
-   Controllers need to show their working

## Evidence

-   CapabilityAll controls listed above ship in the product today.

How we label claims: [evidence and claims policy](https://invoiceiq.analytos.ai/resources/evidence).

## Frequently asked  
questions

-   ### 
    
    No. AI reads documents and helps write rules at authoring time. At posting time, approved rules run deterministically and a person approves.
    
-   ### 
    
    Yes. Each coded line records which rule and which lookup answered.
    
-   ### 
    
    In your environment and your database. You own the code.
    

## Related questions

[InvoiceIQ AP by AnalytosAI Accounts Payable Automation](https://invoiceiq.analytos.ai/ap)[Invoice approvalsHow can AP route invoices for approval automatically?](https://invoiceiq.analytos.ai/ap/approval-workflows)[Duplicate invoice detectionHow can AP detect duplicate invoices before payment?](https://invoiceiq.analytos.ai/ap/duplicate-detection)[AP on top of your ERPHow can I automate AP without replacing my ERP?](https://invoiceiq.analytos.ai/ap/erp-integration)[Security](https://invoiceiq.analytos.ai/resources/security)

## See InvoiceIQ AP on your own documents

InvoiceIQ AP by Analytos: ai accounts payable automation. A walkthrough starts with your real supplier invoices, purchase orders and receipts.

[Book a walkthrough](https://invoiceiq.analytos.ai/contact)