Thanks to all of you for the responses. It seems from these responses that there isn't role security or setup options related to this issue. They will need to rely either on humans to make a decision, or a script to reduce the chance of an error.
It is weak internal control to allow an invoice to be entered prior to the goods being received.