Who it's for: anyone who processes, approves or reviews supplier invoices in a SaaS or tech finance team, from finance assistant to financial controller.
What you'll get: what three-way matching is, a step-by-step process with a checklist, how to set tolerances, how it works for SaaS spend that has no goods to receive, two worked examples with journals, and the key risks and controls.
Reading time: about 10 minutes. Worth reading before you next set up or review your purchase-to-pay process.
Why three-way matching matters
Paying a supplier is easy. Paying the right supplier, the right amount, for something you actually ordered and received is harder. Three-way matching is the simple check that stops duplicate invoices, overbilling and invented suppliers getting paid, and it gives auditors clear evidence that your purchase ledger is real.
In SaaS it is also slightly awkward, because much of the spend is software, cloud hosting and contractors rather than boxes on a loading bay. This guide covers both: the classic version and the practical version for teams that rarely receive anything physical.
Key terms
- Purchase order (PO): the buyer's approved record of what it is ordering, from whom, at what price and quantity.
- Goods received note (GRN) or receipt: confirmation that the goods or services arrived. For services, this is often a "receipt" or "confirmation of service" in the purchasing system.
- Supplier invoice: the supplier's request for payment.
- Three-way match: checking that the PO, the receipt and the invoice agree on supplier, item, quantity and price before the invoice is approved for payment.
- Two-way match: checking the invoice against the PO only, with no separate receipt. Common for subscriptions and low-risk services.
- Tolerance: the small difference (an amount or a percentage) allowed between documents before the invoice is held for review.
- GRNI (goods received not invoiced): an accrual for things you have received but not yet been invoiced for.
How the match works
| Document | Who creates it | What it proves | What gets compared |
|---|---|---|---|
| Purchase order | Budget holder, approved per authority limits | The spend was approved before it happened | Supplier, item, quantity, unit price |
| Receipt (GRN) | The person who received the goods or service | You actually got it | Quantity received, date received |
| Supplier invoice | The supplier | What you are being asked to pay | Quantity billed, unit price, total, VAT |
If all three agree (within tolerance), the invoice is approved for payment. If they don't, it goes on hold and someone finds out why. That is the whole idea. The value comes from doing it consistently.
Step by step: setting up and running three-way matching
| Step | What "done" looks like | |
|---|---|---|
| ☐ | Decide which spend needs a PO. A common approach is a value threshold plus categories (hardware, contractors, agencies, one-off projects) | A written PO policy that budget holders have seen |
| ☐ | Decide which spend uses two-way matching or no PO (for example rent, payroll-related, utilities, small recurring subscriptions) | An exceptions list, approved by the financial controller |
| ☐ | Set tolerances for price and quantity differences | Tolerances documented and set up in the system, not just in someone's head |
| ☐ | Agree who confirms receipt for each type of spend | Named receivers: IT for laptops, budget holders for services, engineering for contractor time |
| ☐ | Raise and approve the PO before the order is placed | PO date is earlier than the invoice date |
| ☐ | Record the receipt when goods or services arrive | Receipt logged with quantity and date, against the PO line |
| ☐ | Match the invoice to PO and receipt when it arrives | Matched invoices flow to approval; mismatches sit on a hold list |
| ☐ | Work the hold list at least weekly | Each held invoice has an owner and a next step |
| ☐ | At month-end, accrue for receipts with no invoice (GRNI) | GRNI report agreed to the accruals balance |
| ☐ | Review open POs and old receipts quarterly | Stale POs closed so they can't be billed against later |
AI shortcut: export a month of supplier invoices with PO numbers and amounts, plus your open PO report, and ask an approved AI assistant to list invoices with no PO, invoices that exceed their PO, and suppliers billing the same amount twice in 30 days. Review the list yourself before acting on it.
Setting tolerances
A tolerance is there to stop pennies of rounding holding up payment, not to let real overbilling through. Many teams use something like "the lower of 2% or £50" for price differences and zero tolerance on quantity for physical goods. Whatever you pick, write it down, set it in the system and review the invoices that pass on tolerance now and then. Small, regular overcharges just under the tolerance are a known pattern.
Three-way matching when nothing arrives in a box
Most SaaS spend is services. The receipt step still works; it just looks different:
- Contractors and agencies: the receipt is the budget holder confirming hours or deliverables, ideally against a timesheet or statement of work.
- Cloud hosting and usage-based tools: a PO for the annual commitment, then a two-way match of each invoice to the usage dashboard.
- Annual software subscriptions: a PO for the contract value, with the receipt confirmed when the licences are live.
- Laptops and hardware: the classic three-way match, with IT confirming serial numbers received.
AI shortcut: for contractor invoices, give an approved AI tool the statement of work, the timesheet and the invoice, and ask it to list differences in days, rates or deliverables. The budget holder still confirms the receipt; AI just makes the comparison quicker.
Worked example 1: a clean match
MonthEndClub Co Ltd orders 10 laptops at £1,200 each for new starters. PO 4417 is approved for £12,000 plus VAT. IT confirms all 10 arrived on 14 October. The supplier invoices on 15 October.
| Check | PO 4417 | Receipt | Invoice | Result |
|---|---|---|---|---|
| Supplier | Laptop supplier | Laptop supplier | Laptop supplier | Match |
| Quantity | 10 | 10 | 10 | Match |
| Unit price | £1,200 | n/a | £1,200 | Match |
| Net total | £12,000 | n/a | £12,000 | Match |
The invoice is approved and posted. The laptops are above the company's capitalisation threshold, so they go to fixed assets.
| Account | Dr | Cr |
|---|---|---|
| Fixed assets: computer equipment | £12,000 | |
| VAT input tax | £2,400 | |
| Trade creditors | £14,400 |
Worked example 2: a mismatch and a month-end accrual
MonthEndClub Co Ltd hires a design agency on PO 4430: 20 days at £500 per day, £10,000 plus VAT. In October, the budget holder confirms 12 days delivered. The agency's October invoice arrives on 3 November for 14 days at £525 per day: £7,350 plus VAT.
| Check | PO 4430 | Receipt | Invoice | Result |
|---|---|---|---|---|
| Days | 20 (total) | 12 | 14 | Quantity mismatch: 2 days |
| Day rate | £500 | n/a | £525 | Price mismatch: £25 per day (5%) |
| Net amount | n/a | £6,000 (12 × £500) | £7,350 (14 × £525) | Difference £1,350 |
The difference is well above the tolerance, so the invoice goes on hold. The budget holder confirms 12 days is right, and the PO rate stands. The agency issues a credit note and a corrected invoice for £6,000 plus VAT.
Month-end (31 October): accrue the received service. The invoice hasn't arrived when October is closed, but the receipt shows £6,000 of work was delivered. The GRNI report picks it up.
| Account | Dr | Cr |
|---|---|---|
| Marketing: agency costs | £6,000 | |
| Accruals (GRNI) | £6,000 |
November: reverse the accrual and post the corrected invoice.
| Account | Dr | Cr |
|---|---|---|
| Accruals (GRNI) | £6,000 | |
| Marketing: agency costs | £6,000 | |
| Marketing: agency costs | £6,000 | |
| VAT input tax | £1,200 | |
| Trade creditors | £7,200 |
The net cost in November is nil, and October carries the £6,000 it belongs to. Without the match, MonthEndClub Co Ltd would have paid £1,350 more than it owed, plus £270 of VAT it would then have to chase back.
Common mistakes and audit watch-outs
- Retrospective POs. A PO raised after the invoice arrives proves nothing about approval. Auditors check PO dates against invoice dates.
- The requester confirming their own receipt for high-value spend. For larger orders, a different person confirming receipt adds real protection.
- Tolerances that are too generous. A 10% tolerance on a £50,000 contract is £5,000 nobody looked at.
- A hold list nobody owns. Held invoices go stale, suppliers chase, and someone overrides the match to get them paid.
- Forgetting GRNI at month-end. Received-but-not-invoiced services are a real cost of the month. Leaving them out understates costs.
- Old open POs. A PO with £8,000 left on it from last year is an open door for a duplicate or inflated invoice.
- Treating an AI match as an approval. AI can propose a match or flag a mismatch, but a named person approves the invoice. Keep that approval in the system, not in a chat history.
- Uploading supplier and bank details to unapproved AI tools. Supplier invoices carry bank details and pricing. Only use AI tools your company has approved for this data.
Tools that can help
Many accounting and spend tools now support purchase orders and invoice matching. Xero and QuickBooks offer purchase orders that can be converted to bills. Sage and NetSuite have fuller matching with receipts and tolerances built in. Spend management tools such as Pleo help with smaller card spend that falls outside the PO process. Excel or Google Sheets can run a basic match for low volumes. Tools don't replace the process; they just make it harder to skip.
Key risks and controls
| Risk | Control | How to evidence it |
|---|---|---|
| Paying for something never ordered | PO required above the threshold, approved before ordering | PO approval date earlier than invoice date, in the system log |
| Paying for something never received | Receipt confirmed by a named receiver | Receipt record against the PO line |
| Overbilling on price or quantity | Automated match with documented tolerances | Tolerance settings screenshot; hold list history |
| Duplicate invoices | Duplicate check on supplier, invoice number and amount; AI flag as a second pass | Monthly duplicate report with review sign-off |
| Costs missing at month-end | GRNI accrual from the receipts report | GRNI report agreed to the accruals reconciliation |
| Stale POs billed later | Quarterly open PO review | Review log showing POs closed |
Key takeaways
- Three-way matching checks that what you ordered, what you received and what you're billed for agree before you pay.
- Write down which spend needs a PO, which uses a two-way match, and the tolerances.
- For services, the "receipt" is a named person confirming delivery against a timesheet or statement of work.
- Use the receipts report to accrue GRNI at month-end.
- Let AI flag mismatches and duplicates; keep approvals with people.
FAQs
Does every invoice need a three-way match?
No. Many teams use three-way matching for higher-value or higher-risk spend, two-way matching for subscriptions and recurring services, and no PO for things like rent or payroll-related costs. The key is that the exceptions are a written decision.
What is a sensible tolerance?
It varies by company. A common approach is a small percentage capped at a fixed amount, with zero tolerance on quantity for physical goods. Review what passes on tolerance from time to time.
What's the difference between three-way and four-way matching?
Four-way matching adds an inspection or quality check, usually for manufacturing or regulated goods. It is rare in SaaS.
Can AI do the matching for us?
AI and the matching engines in accounting tools are good at reading invoices, finding the PO and flagging differences. A person still investigates mismatches and approves payment, and you only use AI tools your company has approved for supplier data.
We're a small team with no purchasing system. Is this worth doing?
A light version usually is. Even a shared spreadsheet of approved POs, plus budget holder confirmation before you pay, catches most duplicate and overbilled invoices.
Related guides
- Accruals and Prepayments: A Practical Guide with Examples
- Balance Sheet Reconciliations: What Good Looks Like
- Journal Review and Approval: Simple Controls That Work
- Managing Prepaid Software Subscriptions
More in Reconciliations and Controls guides.
From the Club
Ordered, received and matched, every time. The Team Mug · The Professional Sceptic? Case
Join the Club. New guides, early access and members-only batches. Join here.
This guide is general information about common practice. It isn't tailored to any business, and standards, tax rules and figures change. Check your own circumstances, the latest rules and, where needed, a qualified professional before acting.
Last reviewed: October 2026.