In a recent webinar we ran with Uncat, Brandon Bruce asked Helina Patience how she handles it when a client says they do not remember approving something. Before she answered, he named the distinction underneath the question: “there’s the getting of the approval, and then there’s the proving it in the future.”
Those are two different jobs. This post is about the second one.
An approval audit trail is the record of who authorised a transaction, what they authorised, and when. It is stored against the transaction itself rather than in a separate system. A complete trail shows the approver’s identity, the exact amount and supplier approved, a timestamp, and evidence the approver held authority at that value. Approvals captured by email satisfy none of this automatically, because the record sits in an inbox with no link to the ledger entry.
Helina runs Entreflow, a Canadian cloud accounting and fractional CFO firm. Her clients include a multi-site nonprofit with managers spread across several locations, and a lot of high growth businesses where an investor conversation or an acquisition is a realistic prospect. Both kinds of client get asked to produce approval records.
When approvals come through email, the record exists, but it sits in an inbox rather than with the transaction. Helina’s description: “If it’s gone through email, then we’ve got that as a backup. It’s obviously a lot more manual.” Someone has to find the right thread, save it out, and attach it to the right bill by hand. That only happens if somebody remembers, and it has to happen for every transaction anyone might later ask about.
There is a second problem with inbox approvals that only shows up later: a mailbox belongs to a person, not to the company record. When an approver leaves and their account is deprovisioned, the approvals they gave can leave with them.
Her nonprofit client used to run on paper. Managers brought in expense claims with the receipts attached, someone rekeyed all of it into Sage 50, and the approval sat in a folder with no connection to the entry in the accounts. Helina says it delayed both month end and year end.
An approval that exists is not the same as an approval you can produce. When an auditor, an investor’s diligence team, or a client’s own board asks about a payment, four things have to be evident from the record.
Who approved it. A named individual, not a shared mailbox or a department. If the approval came from finance@, nobody approved it.
What exactly they approved. The supplier, the amount, and the coding as they stood at the moment of sign-off. This is where email approvals quietly fail: a manager replies “fine by me” to a quote, the invoice arrives at a different figure, and the reply gets treated as cover for a number nobody actually saw.
When they approved it. A timestamp that sits before the payment date. An approval recorded after the money moved documents the payment. It does not control it.
That they had the authority. Evidence the approver was permitted to sign off at that value: a delegation-of-authority limit the system enforced, rather than a policy document somebody hopes was followed. This is the part that multi-step approval workflows handle structurally, by routing the transaction to the right approver in the first place.
An email thread can carry all four. It rarely does, and nothing checks.
Disputes come down to memory. Without a record attached to the transaction, an argument about whether a payment was authorised is an argument about what two people remember, held after the money has already gone.
Card fraud goes unchallenged. Helina’s team now asks for backup documentation on everything, partly because card fraud has become more common. They want managers acknowledging company card spend as it happens, “just in case we’ve got any funky business going on, that we can stop that right away”. On who is likely to spot it, she is blunt: “we are the ones that are gonna catch it if anybody’s gonna catch it.”
Audits and due diligence take longer. Helina’s firm works on the assumption that due diligence could be around the corner for any of their growth clients. If the sign-off history has to be assembled by hand when the request arrives, that work has to be done to a deadline set by somebody else. Our guide to the accounts payable audit covers what auditors typically ask for and in what order.
Closes slow down. Helina described a bookkeeper working through a few thousand transactions in a month. They reach one where the documentation is missing, or they cannot tell whether it is still sitting with an approver, and the work stops. “It just throws them off their flow,” she said.
Helina uses ApprovalMax with a number of her clients, and this is what she said about it: “when somebody approves the transaction in ApprovalMax, it’ll send that into QuickBooks, or Xero, and then at the transaction level, you can not only see the attachment, but also the approval audit, which is awesome.”
In plain terms, you open the bill in Xero or QuickBooks Online and two things are already attached to it. The supporting document, and the record of who approved it and when.
The mechanism matters more than the feature name. Because the approval is captured inside the workflow rather than in a mailbox, the record is created as a by-product of the approval itself. There is no separate step where someone has to remember to file it. ApprovalMax writes that history back to the accounting platform alongside the supporting document, so the approval audit trail is attached at the point where anyone would go looking for it. Nothing has to be reassembled later, because nothing was ever separated.
For audits, that removes her team from the middle of the exchange. “For our clients that have audits, the auditors love it,” she said. “We just give them access. And they can see what they need to see.”
If you want to know where your firm actually stands, do not audit the policy. Test the retrieval.
Pick a bill one of your clients paid three months ago (not a recent one, and not one you happen to remember). Then try to produce, inside five minutes, the name of the person who approved it, the amount they saw when they approved it, and the date they did so.
Three things usually happen:
The third outcome is the one worth acting on, and it is rarely a one-off. Whatever the process was for that bill was the process for every other bill that month. Run the test across two or three clients and you will know which of them would struggle if a diligence request landed next week.
Helina’s advice for introducing any new software to clients was to start with one you like, and to be open that you are both learning it: “Hey, I’m interested in trying out this application, I thought this might be really helpful for you. I’m still new to it, you’re going to be new to it, are you happy to just walk through this process with me?” She picks clients who will be forgiving if the first run is bumpy.
On cost, she pointed back to adopting HubDoc years ago. Her firm paid for it themselves at first, because the labour it saved was worth more than the monthly fee. Later clients were charged for it and none of them objected. “I can tell you, we did not lose money on that.”
If your approval records currently live in email, the thing to compare is how long it takes to answer an auditor’s question today against how long it takes when the sign-off history is already attached to the bill.
That is a measurable number, and the test above will give it to you in an afternoon. If the gap is large, more discipline from the people doing the approving will not close it. The record has to move to where the transaction already lives.
An audit trail in accounting is the chronological record of how a transaction came to be in the books: who created it, who changed it, who authorised it, and when each of those things happened. For a supplier bill, a complete trail links the invoice document, the approval, and the ledger entry so that each can be checked against the others.
To make a transaction verifiable by someone who was not there when it happened. An audit trail lets an auditor, an investor’s diligence team, or a colleague reconstruct a decision without relying on anyone’s memory. It is also what allows an unauthorised payment to be identified as unauthorised, rather than merely disputed.
Capture the approval in the same system that records the expense, rather than in a separate channel. Where approvals are collected by email or chat, the record has to be exported and attached to the transaction by hand for every item, which means the trail is only as complete as the busiest week allowed. Approval software that writes the sign-off history back to the accounting ledger removes that manual step.
Xero and QuickBooks Online both log changes to transactions, so you can see who edited what and when. Neither records an approval that happened outside the system. If a manager approved a bill by email, the accounting platform has no knowledge of it. Approval workflow tools that integrate with those platforms add the authorisation layer on top of the change log they already keep.
They can, provided you can produce the thread, tie it to the specific transaction, and show that the approver saw the figure that was eventually paid. Auditors generally accept email evidence. The cost is in retrieval, and in the gaps that appear when a thread approved something that later changed.