Testing a client's three-way match
How an auditor can test whether a client's three-way match between orders, deliveries and supplier invoices works, including overrides and duplicates.
By Achekam · · 4 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
"All supplier invoices are three-way matched before payment." Almost every client with a purchasing department says it, and many believe it. The walkthrough often tells a more complicated story: a match that only compares the order with the invoice, a tolerance nobody remembers setting, a category of spend that bypasses matching entirely, and a manager who can release a held invoice without explaining why.
The three-way match is one of the most useful preventive controls in the purchases cycle, which is exactly why it deserves proper testing before the audit relies on it. This article covers what the match proves, where it leaks, and how to test it.
What a three-way match proves
AccountingTools describes three-way matching as a payment verification technique for making sure a supplier invoice is valid and can therefore be paid. It explains that the match compares three documents, the supplier invoice, the purchase order and the receiving report, to confirm that a payment should be made, and that matching the invoice to the receiving documentation checks that the goods were received, in the correct quantity and in good condition. Its guide to three-way matching sets out the mechanics and the reasons behind them.
Put in audit terms, a working match gives evidence that recorded purchases were ordered by someone with authority, were actually received, and were billed at the agreed price. That supports occurrence and accuracy of purchases and payables. It says nothing about completeness: an invoice that never reached the system was never matched.
Two-way matching and its gap
AccountingTools warns that a two-way match, which compares only the purchase order with the supplier invoice, does not check receiving documents and so risks paying for an incorrectly billed quantity. It notes that the advantage of a two-way match is somewhat faster processing.
In a walkthrough, establish which kind of match the client actually runs, for which categories of spend. Many clients use three-way matching for stock and two-way for services, where there is no goods received note. That can be a sensible design, but the auditor should know where the receiving step is missing and what replaces it, such as a manager confirming that the service was delivered.
Tolerances and exclusions clients use
Most matching processes allow some leeway. Common examples are a small price tolerance for rounding or freight, a quantity tolerance for goods sold by weight, and whole categories excluded from matching, such as utilities, rent or petty purchases. None of these is wrong in itself. What matters is:
- whether the tolerances are documented, approved and reasonable for the client's business;
- who can change them, and whether changes are logged;
- whether excluded categories have their own control, such as review against a contract or budget;
- whether invoices are being split or priced to fall just inside a tolerance.
How Achekam's procurement holds mismatches and blocks duplicates
Where the client runs its purchasing on Achekam, the controls in its own books work like this. A purchase order is raised from the selected quotation of an approved requisition, the person who raised the order cannot approve it, and an approved order can be cancelled with a reason. A supplier invoice recorded against an order is matched with what was ordered and what arrived, and if price or quantity differ, the invoice is held until someone writes a resolution note. Posting a matched invoice puts it in the ledger as expense, input VAT and trade payables, and the supplier's invoice number stops the same invoice being posted twice.
For the auditor, that design points to where to test. The held invoices and their resolution notes are the override path, so read them: who resolved each mismatch, what they wrote, and whether the explanation is supported. Check whether the same person both raised orders and resolved mismatches on them. And test the duplicate block with the auditor's own analytics rather than assuming it: an invoice number keyed differently can look like a new invoice.
Sampling matched and resolved invoices
ACCA's examples of procedures performed with data analytics include matching purchase orders to invoices and payments. With the client's order, receipt, invoice and payment data, the auditor can test the whole population for invoices with no order, receipts with no invoice, payments that differ from the matched amount and possible duplicates under slightly different numbers.
For detailed testing, staff can load populations into Achekam's Audit Intelligence, which risk-scores a loaded population and proposes a sample; a reviewer who did not prepare the plan approves it before it is drawn, and each draw can be reproduced from its stored seed. Load two populations separately:
- Matched invoices: for each selected item, agree the order, the receiving record and the invoice, and confirm the payment matches.
- Held and resolved invoices: for each, examine the mismatch, the resolution note, who resolved it and the evidence behind the decision.
The second population is usually smaller and far more informative.
Reporting weaknesses
Findings to raise with management typically include:
- categories of spend outside matching with no compensating control;
- tolerances set without approval or wider than the business needs;
- mismatches released without a meaningful explanation, or by the person who raised the order;
- receiving records created after the invoice arrived, to make the match work;
- duplicate invoices paid, or nearly paid, under altered numbers.
The match also matters at year end. Goods received before year end but invoiced after it are exactly the liabilities a search for unrecorded liabilities is designed to find; see searching for unrecorded liabilities. For the walkthrough that comes before any of this testing, see walkthroughs and controls.
A client that says every invoice is three-way matched is describing a design. The audit's job is to find out whether that design still holds once it meets busy buyers, urgent suppliers and a month-end deadline.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
