The South Australian Police Credit Union at a Glance

Police Credit Union began in 1970 as a group of officers pooling funds on pay day. It is now a full-service institution serving members across two jurisdictions, and it carries the supplier base that comes with modern banking: core platform vendors, brokers, insurers, facilities, marketing, professional services and IT.

Accounts payable had not grown with it.

Invoices arrived at a shared mailbox and were worked by hand. A team member opened each PDF, read the line items, decided the general ledger coding, checked whether GST had been treated correctly, chased an approver by email, then re-keyed the payment details into banking and the ledger.

Every step in that chain was accurate only as long as attention held.

‍

Cost of handling. Skilled finance staff spent their days transcribing rather than analysing. Month-end close waited on a queue of unprocessed invoices.

Payment fraud exposure. Invoice redirection, where an attacker compromises or spoofs a supplier's email and substitutes their own bank account, is one of the highest-value attack patterns in Australian business. A manual process that trusts the bank details printed on an emailed PDF has no structural defence against it.

Control evidence. Under APRA's operational risk and information security expectations, PCU needs to demonstrate that payment controls exist, operate consistently and are recorded. Email threads and spreadsheet trackers are difficult evidence to put in front of an auditor.

PCU set out to automate the process without loosening a single control.

Invoices are now collected automatically from the existing AP mailbox on arrival. Attachments and embedded documents are separated, classified and queued. Non-invoice correspondence, including statements, remittance queries and marketing, is routed away, so the processing queue holds only work that needs doing.

Suppliers changed nothing about how they invoice.

‍

Descriptions, quantities, unit prices, tax amounts, ABNs, purchase order references and payment terms are extracted and validated against master data. This is not template-based OCR: invoices are interpreted in context, so a supplier can change layout, switch billing systems or send a document format nobody has seen before, and it is still read correctly.

Coding is applied at line level, which is where cost allocation actually happens. A single facilities invoice covering three branches is split to the correct cost centres rather than posted to one and adjusted later. Coding suggestions learn from PCU's own posting history, so accuracy improves with volume.

‍

The system validates ABN registration status, checks that documents meet the ATO's tax invoice requirements, distinguishes taxable, GST-free and out-of-scope items, and flags rounding and inclusive/exclusive mismatches.

Exceptions surface before posting, not during BAS preparation.

‍

Duplicate detection runs on fuzzy matching across supplier identity, invoice number, amount, date and line composition. It catches the resubmitted invoice, the same invoice arriving via two mailboxes, and the near-identical invoice with a transposed reference.

Supplier bank detail verification is enforced as a controlled event. Bank details are held in verified master data and are never read from the incoming document. When an invoice presents details that differ from the verified record, payment stops. Changes require independent verification through a known channel and dual authorisation, with the evidence retained.

The most common invoice fraud in the Australian market is now blocked by design rather than caught by vigilance.

‍

Beyond document-level checks, submission behaviour is modelled per vendor: invoicing frequency and value distribution, sudden volume changes, values clustering just below approval thresholds, round-dollar patterns, new suppliers with immediate high-value activity, unusual submission timing, and divergence from a vendor's own established pattern.

This gives PCU's finance and risk functions something a manual process never produced: a view of anomalies across every supplier, reviewable before money moves.

‍

Approved invoices generate the files PCU's banking and ledger environment actually consumes:

• ABA direct entry files for bulk electronic supplier payments, correctly formatted and balanced with matching control totals

• BPAY payment files for biller-code obligations, with CRN validation ahead of file generation

• GL flat file (CSV) export for posting to the general ledger, reconciled to the payment run

No re-keying between AP, banking and the ledger. The payment run, the ledger entry and the source invoice reconcile to each other by construction.

‍

Approval follows PCU's delegation of authority automatically, routed on value, cost centre, category and vendor. Where an invoice requires sign-off from more than one owner, approvals run in parallel rather than in sequence, removing the serial waiting that stretched cycle times.

Disputes are handled inside the workflow. A queried invoice is held, annotated and returned to the supplier or internal owner with the reason recorded, then resumes its approval path on resolution. Nothing sits unresolved in an individual's inbox, and every decision carries a timestamped, attributable audit trail.

‍

Continuous validation was applied to the parts of accounts payable that were mechanical. The controls that matter, including bank detail verification, delegated authority, segregation of duties, were strengthened rather than streamlined away.

For a member-owned institution, that distinction is the whole point. Efficiency that weakens payment controls is not efficiency.

Police Credit Union now processes supplier invoices faster than it ever has, with more evidence of control than the manual process could produce, and returns the benefit where it belongs: to members.

‍