Start with a “minimum dataset” master data cleanup, a documented policy for cancellations vs credit notes, and named owners for rejection resolution with a clear SLA. Then build a lightweight monthly control pack (rejection reasons, cancelled invoices approvals, credit note register, reconciliation vs GL) so you can explain the full trail during audits.