Two-Way & Three-Way Matching

Domain Overview

Invoice matching is the core internal control within the procure-to-pay (P2P) cycle that prevents organizations from paying for goods or services that were never ordered, never received, or billed at incorrect prices. Two-way matching compares the supplier invoice against the purchase order (PO). Three-way matching adds a third document—the goods receipt note (GRN)—to confirm physical receipt before payment authorization. Four-way matching extends further by requiring an inspection or quality acceptance report. The matching level selected for a given transaction directly determines the organization's exposure to overpayment, fraud, and audit findings.

According to Ardent Partners' AP Metrics That Matter 2024 report, the average PO-based invoice rate across enterprises has reached 59.3%, and the average invoice exception rate stands at 23.2%—a 26% increase from 2017. Best-in-class AP operations achieve exception rates below 5%. The Association for Financial Professionals reports that duplicate payments alone average between 0.1% and 0.5% of annual disbursements; on $150M in spend, that translates to up to $750,000 annually. These numbers confirm that matching is not an administrative formality—it is a financial control with direct P&L impact.

Three-way matching is now the dominant standard for goods-based procurement in enterprises subject to SOX compliance, COSO internal control frameworks, or external audit. SOX Section 404 requires management to assess the effectiveness of internal controls over financial reporting (ICFR), and three-way matching is explicitly cited as an application control in most SOX control matrices. The COSO Framework's Principle 10 requires organizations to "select and develop control activities that contribute to the mitigation of risks," with segregation of duties and automated verification as core focus areas. Matching serves both.

Modern ERP systems—SAP S/4HANA (via the Materials Management module and transaction MIRO/MRBR), Oracle Fusion (via AP Invoice Tolerances), Microsoft Dynamics 365 Finance (via Matching Policy configuration), and NetSuite (via 3-Way Match Vendor Bill Approval workflow)—all provide native matching engines with configurable tolerance keys and exception routing. AP automation platforms like Tipalti, Stampli, Rillion, Coupa, and SoftCo layer AI-driven exception detection on top of ERP matching. Despite this, over 60% of invoices still require some human interaction (Ardent Partners 2024), indicating that technology adoption remains uneven and that matching logic design matters as much as the tooling.

Core Decision Framework

Selecting the Matching Level

The matching level must be driven by transaction risk profile, not blanket policy. Practitioners evaluate five factors:

1. Transaction value: High-value purchases (>$10,000) warrant 3-way or 4-way matching. Low-value, high-frequency transactions (<$500) may use 2-way to preserve cycle time.