Company context — and why three-way matching is the AP control that matters
The client distributes industrial supplies through 8 distribution centers serving ~12,000 active customer accounts. Annual spend breaks down roughly: ~$140M direct spend (inventory purchases) and ~$60M indirect spend (logistics, facilities, IT, professional services). The AP team — 12 people across HQ and centers — was processing ~9,500 invoices per month: ~6,500 PO-backed, ~3,000 non-PO. Match rate on PO-backed invoices was ~62% manual, with the remaining 38% routed to exception handling that consumed an estimated 40% of the team's time.
The audit committee asked two questions in the prior cycle that triggered the project. First: "How do you know the inventory you paid for actually arrived?" The answer required a multi-day reconciliation. Second: "How do you know you're capturing available payment-term discounts?" The team estimated $400K in missed discounts annually but couldn't show it precisely. Both questions had clean answers in a three-way-matched environment.
- $250M revenue distributor with 8 distribution centers
- ~3,200 active vendors
- ~$200M annual spend (~$140M direct, ~$60M indirect)
- ~9,500 invoices / month (~6,500 PO-backed, ~3,000 non-PO)
- NetSuite OneWorld with Advanced Inventory Management
- 12-person AP team across HQ and DCs
- Audit committee questioning AP control posture
Three-way matching mechanics — what gets compared and how
Three-way matching compares three documents: the purchase order (commitment), the receiving report (what physically arrived), and the vendor invoice (what's being charged). When all three agree within tolerance, payment can be released. When they don't agree, the discrepancy is routed for resolution.
| Match dimension | What's compared | Default tolerance |
|---|
| Item / SKU | PO line item = receiving line item = invoice line item | Exact match required |
| Quantity | PO qty ≥ received qty; received qty = invoice qty | ±2% or ±$50, whichever lower |
| Unit price | PO unit price = invoice unit price | ±3% or ±$0.50/unit, whichever lower |
| Extended price | Quantity × unit price = line subtotal | ±$1.00 rounding tolerance |
| Freight terms | PO freight terms applied to invoice freight | Exact match on FOB; ±5% on freight charge |
| Tax | Avalara-calculated tax = invoice tax | ±$5.00 absolute |
| Total | Sum of lines + freight + tax = invoice total | ±$10.00 absolute |
| Vendor | PO vendor master = invoice vendor master | Exact match required |
| Currency | PO currency = invoice currency | Exact; FX'd if cross-currency |
| Receipt timing | Receipt date ≤ invoice date + 30 days | 30-day rolling window |
Exception types — and how each is routed
The remaining ~12% that don't auto-match fall into recognizable categories. Each has a routing rule, an SLA, and an evidence requirement.
| Exception type | Frequency | Routing | Resolution SLA |
|---|
| Price variance > tolerance | ~3% | Procurement (PO owner) for amendment or vendor follow-up | 2 business days |
| Quantity variance — over-ship | ~2% | Receiving + procurement; possible PO amendment | 2 business days |
| Quantity variance — under-ship | ~2% | Vendor follow-up; partial-payment authorization | 1 business day |
| Missing receipt | ~2% | Receiving for receipt entry; AP for follow-up | 3 business days |
| No PO (PO required) | ~1% | Procurement for retroactive PO or non-PO approval | 2 business days |
| Item / SKU mismatch | ~1% | Receiving for verification; procurement if substitute item | 2 business days |
| Vendor mismatch (e.g., subcontractor invoicing under different name) | ~0.5% | Vendor master review; consolidation if same legal entity | 3 business days |
| Duplicate invoice flagged | ~0.3% | AP senior review; reject duplicate or release if false-positive | 1 business day |
| Tax variance | ~0.2% | Tax team review; Avalara recalculation if applicable | 3 business days |
Vendor master discipline — the foundation
Three-way matching only works if the vendor master is clean. ~22% of records turned out to be duplicates, name variants, or stale entries. Cleanup is its own workstream and a recurring discipline going forward.
- Deduplication — fuzzy match on name + tax ID + address; merge with reviewer sign-off
- W-9 validation — every active vendor has current W-9 on file; validation cycle annually
- 1099 mapping — default 1099 reportable / non-reportable per vendor; reviewed by tax team
- Banking validation — ACH details validated against W-9; change requires multi-factor confirmation
- Vendor risk tier — strategic, preferred, standard, restricted; informs approval routing and tolerance
- Diversity / minority-owned tracking — where required for spend reporting
- Insurance and compliance docs — for vendors requiring proof of insurance, COIs tracked with expiration alerts
- Inactive sweep — vendors with no activity in 24 months reviewed for inactivation