Three-Way Matching for Small Businesses: The Purchase Order, Receipt, and Invoice Control That Stops Duplicate Payments

An invoice can look perfectly ordinary and still be wrong. It may bill for 120 units when 100 arrived, repeat a bill that was already paid, or charge a price that nobody approved. If your accounts-payable process starts with “Does this invoice look reasonable?” you are asking one document to prove three separate facts: that someone authorized the purchase, that your business received it, and that the supplier billed the agreed amount.

A three-way match separates those questions. Before a payment leaves the bank, you compare the purchase order, the receiving record, and the supplier invoice. The process is simple enough for a small business to implement, but it is powerful because it catches mistakes before they become cash-flow problems, inventory discrepancies, or awkward conversations with a vendor.

What a three-way match actually checks​

Each document answers a different question:

The match is successful when the invoice describes goods that were ordered and received at an approved price. A minor difference does not necessarily mean the invoice is fraudulent or unpayable. Freight, tax, exchange rates, partial shipments, and approved price changes can all create legitimate exceptions. The important point is that an exception is investigated and documented instead of silently approved.

The control also creates a useful accounting trail. The purchase order documents the commitment, the receiving report supports the fact that the business obtained the goods, and the invoice establishes the payable. Together, they connect an operational event to a financial entry.

Why small businesses need the control​

Large organizations may have dedicated procurement, receiving, and accounts-payable teams. A small company may have one owner, one operations employee, and an outside bookkeeper. That difference in staffing does not remove the risk; it makes role design more important.

The Association of Certified Fraud Examiners’ 2026 global study covers 2,402 occupational-fraud cases across 143 countries and territories. Its findings continue to identify billing schemes, theft of noncash assets, and payment tampering as meaningful risks. A three-way match will not detect every scheme, but it makes it harder for an unsupported invoice to move directly from an inbox to a payment run.

Consider a small online retailer that orders 500 units of packaging. The PO approves 500 units at $2 each. The warehouse records 450 units because the supplier sent a partial shipment. The invoice requests payment for all 500. Without a receiving record, the invoice may be posted for $1,000 and paid. With a three-way match, the 50-unit difference becomes an exception: pay only for what the contract allows, wait for the remaining shipment, or request a corrected invoice.

That same discipline catches less obvious problems:

• A second copy of an invoice with a slightly different file name.
• A price increase that was never approved.
• An invoice sent to the wrong legal entity or department.
• Items accepted by a warehouse but never entered into inventory.
• A vendor bill for goods that were ordered but canceled before shipment.
• Freight or surcharges that do not match the agreement.

Build the process around clear ownership​

The best control is not “someone checks the invoice.” It is a short chain of responsibilities with an owner at each point.

1. Approve the purchase before ordering​

Use a PO or another written approval for purchases above a defined threshold. The document should identify the supplier, what is being purchased, the expected quantity, the agreed price, the cost center or project, and the person who approved it.

Do not treat a PO as a substitute for a budget. The approval should answer whether the purchase is necessary, affordable, and assigned to the right part of the business. For recurring purchases, a standing PO can work, but it should have an expiration date, a spending ceiling, and a named owner.

For a small company, the approval can be lightweight. A numbered form, shared intake sheet, or accounting-system transaction is enough if it is sequential, retained, and difficult to edit without leaving a history.

2. Record receipt independently​

The person who receives goods should record what arrived, not what the PO expected to arrive. Include the date, supplier, PO number, quantity, condition, and any back-order or damage notes. Photographing damaged cartons or recording a short delivery note can be useful evidence for a later credit request.

Receiving records should be created promptly. If the warehouse waits until the end of the month, accounts payable may see an invoice before anyone has documented the shipment. That creates pressure to pay from memory.

Services require a different version of the same control. There may be no box to count, so the receiving evidence could be a signed milestone acceptance, timesheet approval, project completion note, or manager confirmation that the contracted work was performed. The goal is still the same: document fulfillment before recording the payable.

3. Route invoices to accounts payable​

Ask vendors to put a unique PO number and invoice number on every bill and to send invoices to a controlled address. A shared inbox or upload location makes it easier to establish when the invoice arrived and prevents bills from disappearing in a personal mailbox.

Before matching, check for basic duplicates. Compare the vendor, invoice number, invoice date, amount, and purchase order. Do not rely only on the file name: “Invoice-1048.pdf” and “March statement.pdf” may describe the same charge.

4. Match at the line level​

Compare quantities and prices by line, then review freight, tax, discounts, and the total. A total-only check can hide an overbilled item offset by an unrelated underbilled item.

Set tolerances in advance. For example, a business might allow a one-unit quantity variance for bulk deliveries or a small price variance when a contract includes a published index adjustment. The tolerance should be approved, documented, and appropriate to the category. A tolerance is not a blanket permission to pay whatever appears on the invoice.

5. Approve or hold the payment​

If the match passes, an authorized person approves the invoice for payment according to the due date and cash plan. If it fails, place the invoice on hold and assign the exception to someone who can resolve it.

The person who receives goods should not be the only person who can approve the payment. In a very small business, complete separation may be impractical, so use compensating controls: owner review of the payment batch, read-only bank access for the bookkeeper, an approval threshold, and a monthly review of vendor changes and unusual payments.

A practical exception workflow​

Exceptions are where a control either becomes useful or gets bypassed. Give each mismatch a consistent status and reason:

1. Quantity mismatch: Compare the receiving record with packing slips and ask whether the delivery was partial. Pay only the amount supported by the agreement, or record the remaining quantity as open.
2. Price mismatch: Check the contract, quote, email approval, or change order. Do not overwrite the PO simply to make the invoice pass; preserve the original approval and record the authorized change.
3. Missing receipt: Ask the responsible manager to confirm service completion or have the receiver create a late receiving record. Never mark goods received merely because an invoice exists.
4. Duplicate suspicion: Search the vendor ledger and bank activity. If the invoice was already paid, record the vendor credit or receivable separately and request repayment or an offset.
5. Unknown vendor or bank-change request: Pause payment and verify the request using a known contact method. Do not use the phone number or reply address included in a suspicious message.

Every exception should have an owner, a next action, and a resolution date. A weekly exception report is often more valuable than a complicated approval matrix that nobody reviews.

Two-way matching is sometimes the right answer​

Not every purchase has a receiving report. Rent, utilities, insurance, subscriptions, professional services, and some recurring charges are usually validated against a contract, statement, service confirmation, or approved recurring schedule.

That is often called a two-way match: compare the invoice with the PO or agreement. For services, add evidence that the work was performed. For a monthly software subscription, for example, confirm that the contract is active, the billed seats or period are correct, and the charge has not already been recorded.

Use three-way matching for physical goods, inventory, equipment, and other purchases where actual receipt matters. Use two-way or contract matching for categories where quantity received is not the relevant evidence. The control should reflect the transaction rather than forcing every expense into a warehouse workflow.

Put the match into your bookkeeping​

A three-way match is an operational control, but its value is lost if the accounting records cannot show what happened. At minimum, your books should distinguish:

• Open purchase commitments that have been approved but not yet invoiced.
• Goods received but not yet invoiced, where your accounting method requires an accrual.
• Vendor bills approved and posted to accounts payable.
• Bills on hold because of a quantity, price, tax, duplicate, or authorization exception.
• Vendor credits, refunds, and overpayments awaiting resolution.

Attach the PO, receiving record, invoice, approval, and resolution note to one transaction or document package. Record inventory and fixed assets separately from ordinary operating expenses when appropriate. This gives you a cleaner gross-margin calculation and makes month-end review faster.

Plain-text accounting can make the audit trail especially understandable. A transaction can carry the vendor, PO, receipt, invoice, and approval references in a format that is searchable, reviewable, and version-controlled. The result is not just a paid bill; it is a record of why the bill was paid.

You can also use a dashboard such as Fava to review outstanding payables, vendor credits, and exception-related accounts without losing the underlying ledger detail. If you are building your own workflow, the documentation can help you think through a transparent structure for accounts, tags, and supporting records.

A small-business checklist​

Start with the purchases that could hurt most if they are wrong. Then expand the process as volume grows.

• Define when a PO is required and who may approve it.
• Give every PO and invoice a unique identifier.
• Name a receiver or service owner for each purchase.
• Record partial deliveries, damage, returns, and credits.
• Match invoices by vendor, number, PO, line, quantity, price, tax, and total.
• Define narrow, written tolerances before exceptions occur.
• Keep non-PO purchases on an approved contract or recurring-expense list.
• Separate invoice approval from payment release where practical.
• Verify vendor bank-detail changes through a known contact channel.
• Review unpaid, held, duplicate-suspect, and credit-balance reports monthly.
• Reconcile the accounts-payable subledger to the general ledger and bank activity.
• Retain the complete document package and the explanation for every override.

The process does not need to be expensive. A numbered PO template, a receiving log, a controlled invoice inbox, and a monthly exception review can provide meaningful protection before you invest in automation. The most important feature is consistency: every person should know what evidence is required before a payment is released.

Simplify Your Financial Management​

Once purchase approvals, receipts, bills, and credits are connected, accurate bookkeeping becomes much easier to maintain and review. Beancount.io offers plain-text accounting that is transparent, version-controlled, and AI-ready, so your financial records remain understandable instead of locked inside a black box.