What SOX controls should AP automation support?
Updated October 2026 · By Scott Thompson, Founder
The short answer
For SOX, AP automation should enforce separation of duties (the person who enters or changes an invoice cannot approve or post it), approval by amount, matching to the purchase order and receipt, duplicate prevention, a complete audit trail, and controlled access. DynamoDocs does all of these, with separation of duties as a setting smaller companies can leave off. It does not hold a SOC 1 report, which auditors relying on a service provider often ask for.
Separation of duties
With the setting on, whoever entered or changed a document, by uploading it, editing a field, or confirming a reading, cannot approve it, approve its review, or post it to the ERP. It is read from the document's own history, not from a flag someone could forget to set. An invoice that arrived by email and that nobody changed was entered by the system, so a single approver can approve and post it. Small teams where one person does both leave it off.
Application controls on every invoice
Approval routing by amount, vendor, GL account, or type, with delegation. Two- and three-way matching against the purchase order and what arrived. Duplicate and reissued-invoice detection. A document cannot post while review issues are open, and cannot post to the same ERP twice without a deliberate, recorded confirmation. Optionally, every release is electronically signed.
Access and evidence
Four server-enforced roles, Microsoft 365 or Google sign-in, session and password rules to your policy (inactivity sign-out, account lockout), and a recorded trail of every sign-in and refusal. A built-in user access review lists every account, role and last sign-in, and an audit-trail review flags changes made after release; marking either complete is recorded as evidence. Every action on a document is in an append-only, hash-chained history with names and before/after values, and any record prints as an inspection copy for a sample request.
What auditors will also ask
When automatic posting is on, the rules are the control. Only administrators can change them, and every change to settings, rules, mappings and user access is kept in a tamper-evident change log with who made it and each value before and after, which is what change-management testing samples. And if DynamoDocs runs as a managed service in your financial reporting process, your auditor may ask for a SOC 1 report; DynamoDocs does not hold one today, so plan for walkthroughs and direct testing instead.
Related questions
Is anyone entering invoices when processing is automatic?
No. An invoice read from email or EDI and not changed by anyone has no human preparer. Separation of duties applies where a person's hand is on the data: a manual upload, an edit, or a confirmed reading.
Can we turn separation of duties off?
Yes, and it is off by default. It is one setting, applied to approving, approving a review, and posting, each of which can be included or left out.
Go deeper
See it on your documents
Bring a real invoice, PO, or RFQ and watch DynamoDocs take it from inbox to posted in your ERP in about 30 minutes.
More answers