Write it down — pressure beats memory
Copy this into your company letterhead and make every accounts person sign it:
PISA Model Payment SOP
- New beneficiary or changed details = mandatory voice verification using a phone number from OUR records (never from the email/invoice). Document who verified, when, on what number.
- Dual approval: any payment above Rs [set your limit] requires two named approvers, at least one outside the email thread.
- No channel is trusted alone: WhatsApp/phone/email instructions all require verification on a second independent channel.
- Invoice sanity checks: does the amount match the PO? Is the domain one character off? Was the sender's email seen before in our history?
- Urgency = red flag, not a reason to skip steps. Any "must go out today or contract dies" gets escalated to the owner, not fast-tracked.
- Quarterly drill: IT/management send a simulated invoice-fraud email to accounts staff. Measure click/report rates. (Our platform can run this for your team.)
Companies with written SOPs catch what tired humans miss. This one page has saved more money than any antivirus.