How the three-way match became the standard AP control
The three-way match emerged as a formal AP control in the mid-twentieth century, driven by the same force that created purchase orders: the separation of the buying, receiving, and paying functions in large organizations. When one person ordered goods, a second received them, and a third paid the invoice, the natural question became: how does the payer know that what’s being billed matches what was ordered and delivered? The answer was to require agreement among three independent documents — the purchase order, the receiving report, and the invoice — before releasing payment.
The control has been the cornerstone of professional accounts payable practice ever since. AP automation platforms have digitized the matching process, but the underlying logic is unchanged: payment should not happen until three separate confirmations — authorized, received, and billed correctly — are aligned. When they aren’t, the exception must be resolved before money moves.
What is the three-way match?
The three-way match is the AP control that verifies a vendor invoice against the original purchase order and the goods-receipt (receiving) document before authorizing payment, ensuring the business pays only for what it ordered and received at the agreed price.
The three documents must agree on three dimensions: the item or service (what was ordered, received, and billed is the same thing), the quantity (the amount received matches what was billed), and the price (the invoice price matches the PO price). When all three agree within tolerance, the invoice is approved. When they don’t, the invoice is held and the discrepancy is investigated. The three-way match sits at the intersection of internal controls and AP efficiency — it’s the primary defense against overpayment, duplicate payment, and vendor fraud.
What does the three-way match mean in practice?
In a typical AP workflow: a purchase order is issued (leg one, the authorization). Goods or services are delivered, and the receiving team creates a receiving report or goods receipt note confirming what arrived (leg two, the evidence of delivery). The vendor sends an invoice (leg three, the request for payment). AP matches all three documents. If a vendor billed for 100 units but only 80 were received, the match fails on quantity. If the invoice price is $12 but the PO says $10, the match fails on price. In either case, the invoice is held until the discrepancy is resolved — not paid at the invoiced amount.
A two-way match — PO against invoice only — catches price and quantity discrepancies but misses the critical question of whether goods were actually received. A service that was billed but never performed, or goods that were invoiced but never delivered, would pass a two-way match. The three-way match closes that gap.
Where the three-way match sits in accounting and audit standards
Internal control (COSO). The three-way match is a control activity under COSO’s Internal Control — Integrated Framework. It addresses the authorization and verification of expenditures, and is one of the most cited preventive controls in AP. External auditors examine three-way match procedures when assessing the completeness and validity of accounts payable.
SOX compliance. For public companies, the three-way match (or its documented equivalent) is typically a key control tested under Section 404. Process documentation — who performs the match, what tolerance thresholds apply, how exceptions are escalated — must be maintained for testing.
Matching tolerances. In practice, organizations set tolerance thresholds — typically 1–3% or a small dollar amount — within which an invoice/PO discrepancy is automatically approved rather than held. This prevents trivial price rounding from blocking payment on otherwise-correct invoices. Anything outside tolerance goes to exception review.
Which industries rely most on the three-way match?
| Industry | Why the three-way match matters | Specific application |
|---|---|---|
| Manufacturing | High-volume materials purchasing with many vendors | Automated three-way match on every material invoice; goods receipt in ERP triggers match |
| Retail & wholesale | Continuous inventory replenishment from large vendor base | PO-to-receipt-to-invoice matching prevents payment for undelivered stock |
| Construction | Subcontractor billing tied to progress and materials delivered | Match against contract, delivery documentation, and invoice prevents overbilling |
| Healthcare | Medical supply purchasing with accountability requirements | Match controls both spend accuracy and audit trail for regulated purchases |
| Professional services | Vendor services billed against statements of work | Two-way or modified three-way match against engagement letters and delivery confirmations |
How the three-way match works in QuickBooks, Xero, Sage, and Zoho Books
- QuickBooks Online. Supports a manual three-way match: the PO and receiving activity are linked to the bill, and QBO will flag if the bill amount exceeds the PO. Full automated matching with tolerance rules is not built in — add-ons like Bill.com or Stampli provide this for higher volume.
- Xero. Links bills to purchase orders and tracks receipt status. The match is user-confirmed rather than automated; Xero flags open POs not yet billed.
- Sage Intacct. Full automated three-way match with tolerance thresholds, exception routing, and audit trails — built for mid-market AP volume. Sage 50 handles it more manually.
- Zoho Books. Bills can be linked to purchase orders, with status tracking. The match confirmation is manual; exception handling requires user action.
The gap in entry-level tools: the match exists but isn’t automated. Someone must actively check each invoice against the PO and receiving record. At low volume this is workable; at high volume it becomes the point where errors and duplicate payments slip through. This is exactly where a disciplined offshore AP team adds value — running the match consistently, catching exceptions, and not paying past a discrepancy.
How CPA firms handle the three-way match
CPA firms encounter the three-way match in two contexts. In bookkeeping and AP services, the firm’s team runs the match as part of bill processing — either manually in QBO or Xero, or through an AP platform. In audit and review work, the firm tests whether the three-way match process exists and is actually being performed: are invoices being matched to POs and receiving reports before payment? Are exceptions documented and resolved? The three-way match is typically on the list of key controls the firm evaluates when assessing AP internal controls.
For clients that don’t have a PO process (common in small businesses), the firm may advise implementing one as a precondition for a functioning three-way match — and note that without POs, the AP process is operating without its primary preventive control.
How the three-way match works in offshore accounting
The three-way match is the single most important process the offshore AP team runs, and the discipline with which it is executed is the clearest differentiator between a professional offshore AP operation and a data-entry service. When an offshore team receives an invoice for processing, its first job is not to enter it — it’s to match it. The invoice must be confirmed against the purchase order (does this purchase have authorization?) and the receiving record (did the goods or services actually arrive?) before anything is queued for payment.
This matters more in the offshore context than in an onshore one, for a specific reason: the offshore team is the last line of review before payment is recommended to the client. An onshore AP clerk who lets a mismatched invoice through can be corrected in the same office before the check is written. An offshore team that sends an unmatched invoice to the client’s payment queue has introduced an error across a time zone, and the correction — if it happens at all — comes after the fact. The match must happen on the offshore team’s end, not be left to the client to catch.
The specific discipline: every invoice is matched on all three dimensions — item, quantity, price — before it enters the payment queue. When a match fails, the exception is documented and escalated to the client or CPA firm with a clear description of the discrepancy (example: “Invoice #1247 from ABC Supplies bills 120 units at $11.50 each; PO #882 authorized 100 units at $10.00 — quantity and price discrepancy, held pending client resolution”). The offshore team never resolves a match exception by paying the invoice amount and noting the difference later. Exceptions go to whoever holds the vendor relationship; the offshore team provides the analysis, not the resolution.
The other failure mode specific to the offshore context is the exception that falls through the gap — the invoice that doesn’t have a PO and gets processed anyway because the team defaults to entering what it receives. A functioning offshore AP process rejects or holds invoices without PO references as a policy, not as a judgment call. This is the boundary that keeps the offshore team from being the mechanism by which an unauthorized spend gets paid.
What are the common misconceptions about the three-way match?
- “If the vendor sent the invoice, the goods must have arrived.” Not necessarily. Vendors can invoice in advance of delivery, for goods not yet shipped, or for quantities exceeding delivery. The receiving report is the independent confirmation that delivery happened.
- “A two-way match is good enough for most businesses.” A two-way match doesn’t catch payment for goods not received — which is one of the most common AP fraud vectors. The receiving step adds a critical independent confirmation.
- “Exceptions mean something is wrong with the vendor.” Exceptions often reflect process issues: a PO that wasn’t updated when a price changed, a receiving report that recorded a partial shipment, or a vendor who invoiced before full delivery. Most exceptions are workable — the key is that they’re caught and resolved before payment.
- “The three-way match is only for large companies.” Any business that buys goods from vendors can benefit. The threshold for requiring POs (and therefore enabling a match) can be set appropriately for size. Small businesses processing five vendor invoices a month can match manually; the discipline matters regardless of volume.
What terms are commonly confused with the three-way match?
| Confused with | The key difference |
|---|---|
| Two-way match | Matches only PO and invoice; misses confirmation that goods were received — the weaker control |
| Purchase order | The PO is one of the three documents in the match, not the match itself |
| Invoice approval | Invoice approval is one outcome of the match; the match is the verification process that enables or blocks that approval |
| Duplicate payment check | A separate control that checks whether an invoice has already been paid; the three-way match verifies the legitimacy of the invoice, not whether it’s been paid before |
Common client questions about the three-way match
What are the three documents in a three-way match?
The purchase order (what was authorized and at what price), the receiving report or goods receipt (what actually arrived), and the vendor invoice (what the vendor is billing). All three must agree on item, quantity, and price before the invoice is approved for payment.
What happens when the three documents don’t match?
The invoice goes on hold — it is not paid until the discrepancy is resolved. The AP team flags the exception to whoever holds the vendor relationship (the buyer or purchasing manager), who resolves it directly with the vendor. Common discrepancies include price differences, quantity differences, or items billed but not received.
Is a three-way match required for every invoice?
Not necessarily. Many businesses apply the full three-way match only to goods purchases above a threshold. Services invoices (where there’s no physical receiving report) may use a two-way match — PO against invoice only — or a manager approval in place of the receiving document. The control should be applied where the risk of overpayment or fraud is highest.
Can software automate the three-way match?
Yes, and most mid-market AP platforms do. The software compares the three documents and flags exceptions automatically. However, resolving exceptions — deciding whether a price discrepancy is a vendor error, a contract issue, or a process failure — still requires human judgment. Automation handles the match; humans handle the exceptions.
What’s the difference between a two-way match and a three-way match?
A two-way match checks only the invoice against the purchase order (price and quantity). A three-way match adds the receiving report, confirming the goods or services were actually delivered. The three-way match is the stronger control because it catches payment for goods that were never received.
