How purchase orders became a control
Trade credit is older than accounting — merchants have extended goods-now-pay-later terms for centuries. But the purchase order as a formal control document emerged with the rise of large organizations in the late nineteenth and early twentieth centuries, when the person who decided to buy something was no longer the same person who paid for it. When those functions split, a written authorization became necessary: something that said “yes, we agreed to buy this, at this price, in this quantity, from this vendor.”
The PO formalized that authorization and created the anchor document for the accounts payable process. By the mid-twentieth century, the three-way match — PO against receiving report against invoice — had become standard practice in corporate procurement. Today the document itself may be electronic, but the control logic is unchanged: commit the spend in writing before it happens, so there is always something to match an invoice against.
What is a purchase order?
A purchase order (PO) is a formal document a buyer sends to a vendor authorizing a specific purchase, establishing the item, quantity, agreed price, and delivery terms before the vendor ships goods or performs services.
Once accepted by the vendor, a purchase order becomes a legally binding contract. It is the first leg of the three-way match that governs accounts payable: the PO (what was authorized), the receiving report (what actually arrived), and the vendor invoice (what is being billed) must all agree before payment is released. Purchase orders do not have their own FASB codification topic — they are a procurement control that feeds into AP, which sits within current liabilities under ASC 210-10.
What does a purchase order actually mean?
A purchase order answers a specific question before money moves: has this spend been authorized? When a department wants to buy something, the PO process requires someone with authority to approve that spend before the vendor is engaged. This creates a pre-commitment record that accounts payable can later match against when the invoice arrives.
In practice, a PO typically includes: the PO number (the matching key), vendor name and address, item descriptions and quantities, agreed unit prices, total amount, delivery date, and payment terms. When the vendor ships the goods, a receiving report documents what actually arrived. When the vendor’s invoice comes in, AP matches all three documents. If the invoice price or quantity differs from the PO, that discrepancy is flagged and resolved — not paid past. This is how the PO eliminates the most common AP fraud: an invoice arriving for goods never ordered.
Where purchase orders appear in accounting and controls
Procurement and AP control. Purchase orders are a control activity under COSO’s internal control framework — specifically, they are an authorization control over expenditures. The three-way match they enable is one of the most cited AP controls in both audit standards (AICPA AU-C Section 315, understanding internal controls) and SOX compliance work.
Commitment accounting. Some businesses and most government entities record purchase orders as encumbrances — budget commitments that reduce available budget immediately on PO issuance, before the expense is actually incurred. This prevents over-commitment of budgets. Under GAAP for private businesses, POs are not recognized as liabilities until goods or services are received; the liability (accounts payable) arises on receipt, not on PO issuance.
Open PO tracking. Finance teams monitor open (unfulfilled) purchase orders as a forward-looking cash commitment. Outstanding POs represent authorized but not yet received spending — relevant for cash flow forecasting and budget management.
Which industries use purchase orders most heavily?
| Industry | Why POs are essential | Specific application |
|---|---|---|
| Manufacturing | High-volume raw material and component purchasing | POs govern every material purchase; three-way match is central to AP |
| Construction | Subcontractors, materials, and equipment across multiple projects | POs tie spend to specific jobs for job costing and billing |
| Retail & wholesale | Constant inventory replenishment from many vendors | POs manage inventory orders; receiving against PO controls stock accuracy |
| Healthcare | Medical supplies and equipment purchasing with strict accountability | POs provide audit trail for regulated purchasing |
| Government & nonprofits | Public accountability and budget control requirements | Encumbrance accounting; POs are often legally required |
How purchase orders work in QuickBooks, Xero, Sage, and Zoho Books
All four platforms support purchase orders, though the sophistication of the workflow varies.
- QuickBooks Online. POs are created under Expenses → Purchase Orders. When the vendor invoice arrives, QBO links it to the open PO and marks it received. The match is manual rather than automated — the user confirms the match — but QBO tracks open vs. closed POs and flags when an invoice exceeds the PO amount.
- Xero. Purchase orders under Business → Purchase Orders. Xero lets you convert a PO to a bill on receipt, linking the documents. It also tracks outstanding POs and supports approval workflows on the higher plan.
- Sage. Robust PO functionality across the Sage range, with Sage Intacct offering full three-way match automation, approval routing, and receipt matching for mid-market organizations.
- Zoho Books. Purchase orders under Purchases → Purchase Orders, with conversion to bills and status tracking (open, partially billed, billed).
The common gap: entry-level software creates and tracks POs but doesn’t automatically flag invoice-to-PO discrepancies — someone must still review the match. The discipline of actually checking is the control; the software is the record-keeping layer.
How CPA firms use purchase orders
For a CPA firm, purchase orders are both an accounts payable control and an audit evidence point. In bookkeeping and AP work, the firm expects vendors to reference PO numbers on invoices and ensures AP processes include a match before payment approval. In audit and review work, the PO is a key piece of evidence for the completeness and existence of payables — auditors test whether invoices have corresponding POs (to verify the purchase was authorized) and whether open POs represent commitments that should be disclosed.
In advisory work, a firm that finds a client paying invoices without POs will flag the control gap. Unapproved spend is both a fraud risk and a budget management failure — and the remedy is implementing a PO policy with appropriate dollar thresholds.
How purchase orders work in offshore accounting
The purchase order is where the offshore AP team’s authority begins and ends — and understanding that boundary is the whole of this section. When an offshore team processes accounts payable, the PO is the document that defines what they are authorized to pay against. An invoice that matches an approved PO, at the approved price and quantity, is a payment the offshore team can prepare. An invoice without a PO — or an invoice that doesn’t match the PO — is not.
This matters because the most common AP fraud the offshore context is vulnerable to doesn’t involve fake vendors or fictitious invoices. It involves real vendors sending real invoices that simply exceed what was ordered, or invoices for goods that were never received, or invoices with changed bank details. The PO is the offshore team’s only protection against all of these. Without a PO to match against, the offshore team has no reference point — it is processing invoices against nothing, which means it cannot catch a price that’s been inflated, a quantity that’s overstated, or a purchase that was never authorized.
The operating discipline is therefore non-negotiable: the offshore team processes invoices against POs only. When an invoice arrives without a PO reference, the response is to flag it and hold it — not to pay it on the assumption that the purchase was authorized. When an invoice doesn’t match the PO (different price, different quantity, different vendor), the response is to escalate the discrepancy to the client or the CPA firm for resolution — not to pay the invoice amount and move on. The offshore team never resolves a PO discrepancy by paying the invoice; it resolves it by surfacing the discrepancy to whoever holds the vendor relationship.
For clients that don’t use POs — common in small businesses — the offshore team should communicate the control gap clearly and encourage a threshold-based PO policy. Processing AP without POs is workable for very small, simple vendor bases, but as volume grows, the absence of POs is the single biggest invitation to error and fraud in the AP function.
What are the common misconceptions about purchase orders?
- “POs are only for large companies.” Any business that pays invoices benefits from PO discipline. The threshold can be set appropriately for size — perhaps only purchases over $500 need a PO — but the principle of authorizing spend before it happens applies regardless of company size.
- “A verbal agreement is enough.” Verbal agreements aren’t matchable against an invoice. The value of the PO is the written record that exists before the invoice arrives — without it, there’s no anchor for the match.
- “A PO is the same as a contract.” A PO is an offer to purchase. It becomes a binding contract when the vendor accepts it (usually by shipping the goods or beginning the services). Larger or more complex purchases may still need a separate formal contract alongside the PO.
- “If the vendor invoiced us, we ordered it.” Vendors can and do invoice for goods not ordered, at prices not agreed, for quantities not delivered. The PO is precisely what allows you to verify all three before paying.
What terms are commonly confused with purchase orders?
| Confused with | The key difference |
|---|---|
| Invoice | The PO comes from the buyer before the purchase; the invoice comes from the vendor after delivery requesting payment |
| Receipt | A receipt confirms payment has been made; a PO authorizes a purchase that hasn’t happened yet |
| Receiving report | The receiving report documents what arrived; the PO documents what was authorized — together they form two legs of the three-way match |
| Contract | A contract may be broader and more complex; a PO is a specific transactional authorization for a defined purchase |
Common client questions about purchase orders
Does every purchase need a purchase order?
No — POs make the most sense for recurring or significant purchases where you want a documented authorization before the spend happens. Most businesses set a dollar threshold: anything above it requires a PO, anything below can use a simpler approval. Petty cash and small one-off purchases rarely need a formal PO.
What’s the difference between a purchase order and an invoice?
A purchase order comes from the buyer and authorizes the purchase before it happens. An invoice comes from the vendor after the goods or services are delivered, requesting payment. The PO is the commitment; the invoice is the bill. Matching them against each other — along with the receiving report — is the three-way match.
Can a vendor change the price after a PO is issued?
Not without the buyer’s agreement. A PO is a legal offer to purchase at specified terms; once a vendor accepts it, both parties are bound. If the vendor invoices at a different price, the discrepancy should be flagged and resolved before payment — not quietly paid at the invoice price.
What happens if we pay an invoice without a PO?
You lose a key control. Without a PO, there’s no pre-authorized price or quantity to match against, so there’s nothing to catch an inflated invoice or a delivery that didn’t arrive. Many AP fraud schemes exploit exactly this gap — creating invoices for goods or services that were never ordered.
How does a PO number help in practice?
It ties the invoice to the original authorization. When the vendor includes the PO number on their invoice, anyone processing it can instantly pull up what was ordered, at what price, and from which budget. Without it, matching is manual and error-prone — especially at volume.
