The correct answer is D. Performing a bank reconciliation.

A duplicate payment is a transaction-processing error that affects financial completeness and accuracy. A bank reconciliation is the best compensating control among the options because it compares the organization’s payment records with actual bank activity and helps identify duplicate or incorrect payments after processing.

Option A is not the best answer because manually receipting payments is inefficient and does not reliably detect duplicate outgoing payments. Option B is not correct because hash totals are usually nonfinancial totals used to check processing completeness, such as account number totals, and would not effectively identify duplicate payments. Option C may help detect differences in batch totals, but duplicate online payments can still occur unless the reconciliation identifies the actual duplicate disbursement or settlement.

ISACA has discussed duplicate payment detection as an internal control concern and notes that automated controls can detect duplicate and fraudulent transactions across complete data sets. That supports the control principle that duplicate payments require detective/reconciliation controls, not merely basic totals.