Policy says what should happen. Controls make it hard for anything else to.
Where the two get confused, an organization ends up with a thick policy document and an accounts payable team reconciling exceptions. That is the most expensive form of compliance there is.
The checklist is thirty controls across the six stages of procure-to-pay. None of them are exotic. Each is there because its absence costs money, and most cost nothing to put in place beyond the decision to do it.
The three that matter most
If you run this and most boxes are empty, resist the urge to fix everything. Three controls stop the largest share of value leaking, and none of them require new software:
Contracted prices loaded into the system, with the load date recorded. A price you negotiated but never loaded is a price you are not paying. This is the single most common failure we find, and it is usually recoverable retroactively.
No PO, no pay, enforced by the system. Enforced by reminders is not enforced.
Service receipting. Goods receipting is usually in place because there is a physical thing to receive. Services get approved on trust, which is where indirect spend quietly overruns.
Then measure PO coverage, the share of spend on a purchase order. It is the number that tells you how much of your spend the rest of your controls can even see.
Friction is the real constraint
Every control adds friction, and friction is what sends people around the process. If a control cannot be justified by the money or risk it protects, remove it. An unenforced control is worse than no control, because it teaches people the rules are optional.
Pairs naturally with the value leakage checklist, which covers the contract side of the same problem, and the background is in the procure-to-pay guide.