Every finance team has a defined AP process. Invoices arrive, get processed, get approved, and get paid through the official workflow. That process is documented, controlled, and reported.
And then there is everything else.
Procurement cards used for purchases that were never logged as purchase commitments. Subscription charges hitting corporate credit cards directly. Personal expenses reimbursed through payroll without AP review. Direct vendor relationships established by department heads who needed to move fast and bypassed the procurement process. Intercompany settlement payments processed outside the AP workflow because the treasury team needed flexibility.
This is shadow AP. It is not one thing, it is a collection of payment and commitment activities that exist outside the official payables process. And unlike shadow IT, which finance leaders often treat as an IT problem, shadow AP creates financial reporting, compliance, and fraud risks that belong squarely in the CFO's risk register.
Where Shadow AP Comes From
Speed pressure on procurement
When the official procurement and AP process takes 3 weeks to onboard a new vendor and get an invoice processed, department heads find ways around it. They put the charge on a procurement card, pay personally and request reimbursement, or ask the vendor to invoice a personal email address. The intent is not to circumvent controls, it is to get work done. But the result is spend that is committed and paid outside any controlled process.
SaaS and subscription proliferation
Software subscriptions can be purchased with a corporate card in 60 seconds. Most organizations have dozens of software subscriptions that were set up by individual team members, charged to departmental cards or personal expenses, and are never reviewed by the AP team. The finance team has no visibility into what tools are being paid for, what they cost in aggregate, or whether the contracts auto renew.
Petty cash and imprest accounts
Physical petty cash and imprest bank accounts used for small operational expenses exist outside the standard AP workflow in many organizations. They are replenished periodically, but the transactions within them are often not reviewed against budget or policy until something goes wrong.
Legacy payment habits
In organizations that have implemented AP automation, the automation applies to the invoices that enter the new system. Longstanding vendor relationships where payments have always been made by a specific manager via wire transfer from a specific account may never have been migrated to the formal AP workflow. The transactions are visible in the bank feed but invisible in the AP system.
The Risks Shadow AP Creates
Financial reporting risk
Expenses incurred outside the AP workflow may not be accrued correctly at period end. A software subscription charged to a personal card and reimbursed via expense report in the following month may be expensed in the wrong period. A vendor commitment made outside the purchase order process creates an obligation that does not appear in the AP aging until the invoice arrives.
At small scale, these misstatements are immaterial. In organizations where shadow AP represents 10 to 20% of total operating spend which is common in fast-growing technology and professional services companies, the aggregate reporting impact can be material.
Fraud risk
Shadow AP is the path of least resistance for internal fraud. Petty cash misappropriation, fictitious vendor relationships established through personal card payments, and duplicate reimbursement requests that no one cross-references against the AP system, these are fraud patterns that are specifically enabled by the existence of payment channels outside the controlled AP workflow.
The ACFE 2024 Report to the Nations identifies expense reimbursement schemes and billing schemes involving payments outside normal channels as two of the most common fraud categories in organizations with $10M to $100M in annual revenue. Shadow AP is the infrastructure that makes both possible.
Contract and compliance risk
Vendor relationships established outside the formal procurement process typically lack contracts, terms documentation, or compliance screening. When a department head sets up a vendor relationship directly and pays via card, there is no sanctions screening, no vendor verification, no data processing agreement if the vendor handles personal data, and no defined payment terms.
The compliance risk materializes most visibly when a vendor in a shadow AP channel turns out to be on a watchlist, or when a GDPR audit reveals that personal data is being processed by a vendor the legal team has never reviewed.
Budget and cash flow visibility risk
Shadow AP spend is not visible in the AP aging report. It does not appear in the committed spend view. It is not included in the cash flow forecast. For a CFO trying to understand where cash is going and what is committed, shadow AP is a blind spot that grows proportionally with organizational complexity and the degree to which speed pressure pushes spend outside formal channels.
Mapping Shadow AP in Your Organization
The first step is quantifying the problem. Four data sources reveal shadow AP activity:
- Corporate and procurement card statements: review all card transactions against the AP vendor master. Transactions to vendors not in the approved vendor register are shadow AP candidates.
- Expense reimbursement reports: identify patterns in reimbursements: recurring vendor names, software subscription charges, high-frequency small transactions to the same payee.
- Bank statement reconciliation: identify outgoing payments from any entity bank account that do not trace to an AP invoice. Wire transfers initiated outside the AP workflow, direct debit charges for unregistered subscriptions, and account to account transfers without corresponding AP records.
- Department budget owners: direct conversations with department heads often reveal shadow vendor relationships that are not visible in any financial system. Many budget owners maintain vendor relationships that predate the current AP process.
Reducing Shadow AP Without Creating New Bottlenecks
Shadow AP exists because the official process is too slow or too complex for the spending patterns that created the workaround. Eliminating shadow AP without fixing the underlying process problem just moves the workaround to a different channel.
- Reduce vendor onboarding time: if the official process takes 2 to 3 days instead of 2 to 3 weeks, the speed motivation for shadow AP diminishes significantly
- Create a fast track process for low value vendors: a simplified onboarding path for one off or low value vendors with proportionate controls reduces the motivation to bypass the formal process
- Integrate procurement card management into the AP platform: corporate card transactions should feed the AP system automatically, making card spend visible in the same payables view as invoice based payments
- Bring software subscriptions under management: a defined SaaS management process with regular subscription audits captures the category that generates the most shadow AP activity in technology companies
Start Here
Start with the bank statement reconciliation. Pull three months of outgoing transactions from all entity bank accounts and identify every payment that does not correspond to an approved invoice in the AP system. The gap between total bank outflows and total AP processed payments is the minimum size of your shadow AP problem. It is almost always larger than finance leadership expects.
