Xero’s approval workflow routes bills. It doesn’t control who’s allowed to approve what. Better to work that out while you’re configuring your AP setup than under pressure after something has gone wrong.
When a user submits a bill in Xero it moves to Awaiting Approval and a nominated approver gets a notification, and they can approve it or send it back to draft. What Xero won’t do is check that the person approving has authority up to that amount, stop a user with Adviser access skipping the queue entirely, compare the supplier’s bank details against previous payments, or catch a duplicate invoice before it lands in the queue. None of that is a Xero failing. It sits outside what an accounting system sets out to do, which is why the control layer belongs in a dedicated AP workflow upstream of it.
Configuring Xero user roles for basic segregation
The most important control Xero’s native structure can enforce is separating invoice entry from invoice approval - a basic form of segregation of duties. In Xero Settings → Users, assign roles deliberately. A user set to “Invoice Only” can create draft bills but cannot approve or pay them. A user set to “Standard” can approve but not pay. Payment access should be restricted to a separate Adviser account that the approver doesn’t hold.
This role structure is the minimum viable segregation of duties. If the person who approves invoices is also the person who processes payments, the control collapses - any fraudulent invoice that clears the approval step goes straight to payment with no second checkpoint. For the broader context on setting up AP in Xero and MYOB, our pillar guide covers how permissions fit alongside coding and validation.
What this doesn’t solve: a user with Adviser access can bypass the Awaiting Approval queue and approve directly. If anyone on the team holds Adviser access for legitimate reasons (accountants, senior staff who also do accounting tasks), the approval step is technically optional for those users unless addressed separately.
The threshold problem and the volume inflection point
Xero’s “Standard” user permissions don’t enforce dollar-value thresholds. A Standard user can approve a AU$1,000 stationery invoice and a AU$90,000 subcontractor payment with the same permissions. The threshold policy - invoices above AU$10,000 require CFO approval, above AU$50,000 require a director - exists in a document somewhere. Nothing in Xero enforces it.
Past a certain weekly volume, the manual version of that check falls apart. The AP officer is the one who has to know an invoice is above threshold and escalate it, and eventually people start approving from memory instead of checking the policy document. Invoices keep moving. The thresholds quietly stop being applied. The guide on how industrial finance teams structure approval hierarchies at scale covers how tiered, system-enforced hierarchies head that off.
What fixes it isn’t a better-written policy. It’s a system that won’t let anyone below the designated authority level approve an above-threshold invoice in the first place, and that means an AP layer outside Xero rather than a settings change inside it.
What does a defensible audit trail require?
Xero logs basic bill history: who created a bill, who approved it, when. It doesn’t capture what information the approver had at the time - what the supplier’s bank details were, whether the amount was within the approver’s authority, whether any exceptions were noted. For a routine internal review, the Xero bill history is useful. For an external audit that asks “what did the approver verify before signing off on this AU$45,000 invoice?”, the Xero record doesn’t answer the question.
A complete audit trail for AP purposes needs: the invoice data at point of intake, the coded amounts including GST treatment (our GST calculator is a quick way to confirm the tax component before an invoice is approved), any supplier detail changes flagged during processing, the approval decision with the approver’s stated authority, and resolution of any exceptions. This level of detail requires a dedicated workflow tool that captures it systematically, not a notes field filled in manually. Businesses rolling out new AP tools should also be aware of the common audit trail mistakes that create risk during automation rollouts, particularly around split trails between the AP platform and the accounting system.
When to extend beyond Xero native
For businesses processing under 20 invoices per week from a stable, familiar supplier list with a single approver, Xero’s native tools plus a documented manual process are often sufficient. The controls are procedural rather than system-enforced, but the volume makes that workable.
You’ve outgrown the native setup when a second person starts approving invoices, when threshold enforcement gets inconsistent, when there’s a near-miss with a duplicate or a changed bank detail, or when an auditor flags the approval process as a gap. At that point what you need is an AP layer that validates and routes invoices before they reach Xero. A more detailed policy document won’t do it, because the compliance is still manual. Our comparison of invoice approval software for Xero covers which platforms enforce these controls properly.
Xero’s job in that setup is to receive clean, coded, approved invoices and record them accurately. It was never built to make the upstream decisions. Ask it to do both and it does neither well.
Sources: ATO - Record-keeping requirements for business · ATO - E-invoicing and invoice processing in Australia
Further reading: Xero Bill Approval Workflow · AP Software: What Finance Teams Need That Xero Does Not Provide · Automated Line-Item Coding for Mixed GST Split Invoices · Best AP Automation Software Australia 2026