Is Three-Way Match Still Effective for Modern Spend?
Based on internal process analysis across AP recovery engagements
In high-volume accounts payable, three-way match has long been the standard control for spend management. The premise is straightforward: an agreement is negotiated, procurement raises a purchase order, receiving logs the goods, and accounts payable checks the incoming invoice against both. As long as the three documents agree on quantities, unit prices, and terms, payment clears.
It is a sensible workflow, and on paper it leaves very little room for error.
Yet in recovery audits across large, well-run enterprises, payment leakage, overbilling, and duplicate payments consistently turn up inside workflows governed by three-way match. These are not organisations that skipped the investment. They run mature ERP platforms, employ disciplined finance teams, and have clear approval policies in place.
When we analyse the underlying payment data, the issue is rarely that the matching engine made a calculation error. In more than 65% of the transactions flagged for review, the purchase order was created after the supplier’s invoice had already arrived.
That reversal matters more than it first appears. When a PO is raised after the bill is in hand, it is no longer setting the standard against which the invoice is verified. It is created to mirror the invoice so the system will release the hold. The ERP reports a clean match, and what has actually happened is that the invoice validated itself.
A model designed for physical supply chains
To understand why three-way match struggles in modern finance environments, it helps to look at where it came from. The process was established during the mid-20th century, when corporate buying primarily involved raw materials, manufactured parts, and physical inventory.
In that context, the control was tied directly to physical handling:
• Procurement agreed the order details with the vendor.
• A receiving team counted the delivery at the warehouse dock and signed a goods receipt note (GRN).
• AP verified that the vendor’s bill matched what was ordered and what was physically received.
Because three separate people verified the transaction from different angles, discrepancies were straightforward to pinpoint. If fifty crates were billed but only forty arrived, the mismatch stopped the payment before funds left the bank.
For physical goods arriving at a warehouse, this control remains practical and effective. It prevents overpayment for short shipments, flags unit-price changes, and stops duplicate billing for the same delivery.
The challenge is that modern corporate spend looks very different. A large and growing share of enterprise expenditure now goes toward professional services, software subscriptions, marketing retainers, IT consulting, and legal counsel. None of that passes through a warehouse dock. Nobody signs a receiving slip for forty hours of strategic advice or a cloud software renewal.
Because standard ERP matching rules still require a receipt to complete the workflow, organisations end up building workarounds. The goods receipt leg becomes an administrative formality: an automated script, or a routine confirmation an approver clicks through to keep the invoice from stalling. Once that verification step loses its substance, the match clears on the presence of a record rather than on any operational check.
Where the workflow breaks down
In large accounts payable operations, the friction between rigid matching logic and day-to-day business demands tends to surface in five specific areas.
Confirming purchase orders raised after the fact. When a department engages a supplier without involving procurement upfront, the invoice reaches AP with no purchase order on file. Returning it can disrupt operations or strain the vendor relationship, so AP routinely asks the stakeholder to raise a confirming PO. The stakeholder creates it using the exact line items, amounts, and descriptions from the vendor’s bill. The ERP registers a match with zero variance, but the PO is functioning as a routing slip rather than a spending boundary.
Service entries and bulk sign-offs. For services, ERPs generally require a Service Entry Sheet (SES) in place of a physical goods receipt. In high-volume environments, department managers can receive dozens of notifications a week asking them to confirm service delivery. Approvers rarely have the time or the granular data to verify whether contractor hours or milestone criteria were genuinely met, so these requests are frequently cleared in bulk. The system records an official approval; no independent review took place.
Tolerance creep. To stop payment runs halting over shipping variances or rounding differences, ERPs rely on tolerance limits that clear invoices automatically when the variance falls within a defined percentage, typically 2% to 5%, or a modest currency amount. Tolerances reduce administrative friction, and they also create a permanent blind spot. If an ongoing supplier consistently bills slightly above agreed contract rates, those charges pass undetected month after month. Across thousands of invoices, small variances quietly erode operating margins.
Blanket PO burn rates. For recurring engagements, organisations often set up blanket purchase orders with a broad financial cap, say €250,000 across a fiscal year, rather than individual line-item orders. When an invoice arrives, the ERP checks only whether sufficient funds remain under the overall cap. It does not verify hourly rates, scope changes, or whether a specific milestone was completed. Duplicate invoices, out-of-scope work, and rate increases can draw down the balance unnoticed until the funds run out earlier than planned.
Decentralised and cross-entity blind spots. In organisations running multiple business units, divisions, or separate ERP instances, matching controls operate inside isolated data silos. A supplier can invoice Entity A for a shared project and subsequently send the same invoice, or a slightly modified copy, to Entity B. Each system executes a three-way match against its local PO and approves payment. Because standard matching checks only the vertical link between documents in a single ledger, it cannot detect when the same obligation is settled twice across parallel systems.
The pressure for processing speed
These gaps are often widened by internal performance goals. Finance teams are under steady pressure to lower processing costs and shorten cycle times, usually tracked through straight-through processing (STP) or touchless-processing metrics.
An invoice that clears touchless, moving from intake to payment scheduling without manual intervention, is efficient and inexpensive to process. But when speed becomes the primary measure, controls tend to get adjusted to minimise exceptions:
• Tolerance limits are widened so minor variances do not pause the workflow.
• Auto-receipting rules are introduced for recurring charges under set thresholds.
• Confirming POs become standard practice for clearing backlog queues.
Each of those decisions is reasonable in isolation. Together, they change what the matching engine is doing. It continues to run, but its function shifts from spend control to automated payment clearing. Turnaround times look strong on the internal dashboard while payment leakage continues behind them.
Making controls fit how spend works
Addressing these vulnerabilities does not mean abandoning three-way match. For direct materials and physical inventory it remains reliable. The practical objective is narrower: stop applying a warehouse-based verification model to spend categories it was never designed to manage.
Organisations that manage this risk well tend to focus on four structural improvements.
Align validation to spend type. Separate physical goods from intangible services at the start of the workflow. Keep three-way match for physical inventory, and manage services through milestone validation, contract terms, or direct integration with operational data, such as active user seats for a software subscription.
Address after-the-fact POs at the source. When an invoice arrives without an existing PO, treating it as a routine AP handling exception hides the root problem. Requiring department-level sign-off, or logging confirming POs as procurement policy exceptions, gives teams a reason to establish POs before commitments are made.
Review tolerances regularly. Analyse settled invoices to identify suppliers whose billing consistently sits just inside the configured tolerance band. Spotting systematic variance is what prevents small, recurring overcharges from compounding.
Look across systems and entities. Standard ERP checks work well for identical records inside a single system. Detecting the rest requires comparing data across entities, accounting for vendor master variations, and identifying duplicate billing patterns that exact-match logic will never flag.
Assessing your own control environment
Understanding the failure modes is the first step. The next is determining which of them are active in your own AP environment.
The questions below are designed for AP managers, controllers, and CFOs who want to evaluate whether their three-way match process is functioning as a genuine control or as an automated payment clearance mechanism.
- What percentage of your POs are raised after the corresponding invoice has already arrived?
- Are service entry sheets reviewed individually, or approved in bulk by department managers?
- Have your ERP tolerance limits been reviewed and adjusted in the past 12 months?
- Do your matching controls operate across all legal entities and ERP instances, or only within individual ledgers?
- Is your vendor master reviewed periodically for duplicate records or entries created outside the standard onboarding process?
- Are your straight-through processing metrics tracked alongside payment accuracy metrics, or independently?
- When a confirming PO is raised, is it logged as a policy exception or treated as standard practice?
- Can your current controls detect when the same invoice is submitted to two separate business units?
A pattern of risk-side answers across these questions is a reliable indicator that the matching process is functioning as a payment clearance mechanism rather than a spend control.
Where this leaves the control
Three-way match provides clear structure and an orderly audit trail, and it does the job it was built for. What it cannot do is tell you whether the documents it compared were independent of each other.
An automated match against a retroactive PO, or against a rubber-stamped receipt, confirms that the documents exist and agree. It does not confirm that the expense was valid. Reliable financial protection means recognising where mechanical matching ends, and making sure the review that follows reflects the actual nature of the transaction.
