The three documents in a three-way match are the purchase order (PO), the goods receipt note (GRN), and the supplier invoice. The purchase order is created by the buyer when they place an order with a supplier — it specifies the items ordered, quantities, agreed unit prices, and delivery terms. The goods receipt note is created by the buyer's receiving department when the goods arrive — it records what was actually received, in what quantities, and in what condition. The supplier invoice is the billing document submitted by the supplier requesting payment for the goods or services delivered.

A successful three-way match requires that all three documents agree on the key fields: vendor identity, item descriptions, quantities, and unit prices. In practice, minor discrepancies are common — a supplier may invoice for slightly different quantities than were received, or at a price that differs from the PO by a small amount. Tolerance rules (discussed in section 05) define how large a discrepancy can be before it requires manual investigation.

Phantom invoice fraud occurs when a fraudster submits an invoice for goods or services that were never ordered or delivered. The invoice may come from a fictitious vendor, from a real vendor submitting a duplicate invoice, or from an internal employee creating fraudulent invoices for personal gain. In each case, the fraud succeeds because the AP team pays the invoice without verifying that the underlying transaction actually occurred.

Three-way matching stops phantom invoice fraud because a phantom invoice, by definition, has no corresponding purchase order or goods receipt note. If your AP process requires all three documents to match before a payment can be approved, phantom invoices are caught automatically — they fail the match at the first step. This is why three-way matching is considered the most cost-effective fraud prevention control available to AP departments: it requires no special technology, no forensic expertise, and no ongoing monitoring — just a consistent process.

A manual three-way match involves pulling the purchase order, goods receipt note, and supplier invoice for each invoice received, then comparing them field by field. The comparison should cover: vendor name and address (does the invoice come from the same vendor as the PO?), item descriptions (do the items on the invoice match the items on the PO and GRN?), quantities (does the invoiced quantity match the received quantity?), and unit prices (does the invoiced price match the agreed price on the PO?).

Any discrepancy should be documented and investigated before the invoice is approved for payment. Common discrepancies include: invoiced quantity greater than received quantity (possible over-billing or receiving error), invoiced price higher than PO price (possible pricing error or unauthorised price change), and invoice from a vendor not in the approved vendor master file (possible fraud or new vendor not yet set up). The investigation process should be documented, and the resolution — whether to approve, reject, or partially approve the invoice — should be recorded with the approver's name and date.

Two-way matching compares only the purchase order and the supplier invoice, without reference to the goods receipt note. It is faster than three-way matching but less effective at catching fraud and over-billing, because it does not verify that the goods were actually received. Two-way matching is appropriate for service invoices where there is no physical goods receipt, or for low-value purchases where the fraud risk does not justify the additional effort of three-way matching.

Four-way matching adds a fourth document — the inspection report — to the three-way match. The inspection report confirms not just that the goods were received, but that they were received in the correct condition and met the agreed quality standards. Four-way matching is used in industries where quality inspection is critical, such as pharmaceuticals, aerospace, and food manufacturing. For most businesses, three-way matching provides the right balance of control and efficiency.

Tolerance rules define how large a discrepancy between the PO, GRN, and invoice can be before it requires manual investigation. Without tolerance rules, every minor rounding difference or small quantity variance triggers an exception, overwhelming the AP team with low-risk discrepancies. With well-designed tolerance rules, only genuinely significant discrepancies require human attention.

Typical tolerance rules include: a price tolerance of 1–2% (invoiced price may differ from PO price by up to 1–2% without triggering an exception), a quantity tolerance of 0–5% (invoiced quantity may differ from received quantity by up to 5% for bulk goods), and an absolute amount tolerance (discrepancies below a fixed dollar amount, such as $50, are automatically approved). Tolerance rules should be documented, approved by senior management, and reviewed annually to ensure they remain appropriate for your business's risk profile.

Partial deliveries — where a supplier delivers part of an order and invoices for the delivered portion — are one of the most common sources of three-way matching complexity. If your PO is for 100 units and the supplier delivers 60 units in the first shipment, the invoice for 60 units should match the GRN for 60 units, not the PO for 100 units. Your matching process needs to track the cumulative quantity received and invoiced against the PO to ensure that the total invoiced amount never exceeds the total ordered amount.

Split invoices — where a supplier submits multiple invoices for different portions of a single PO — require similar tracking. Your AP system should maintain a running total of amounts invoiced against each PO, flagging any invoice that would cause the cumulative invoiced amount to exceed the PO value. This prevents suppliers from inadvertently (or deliberately) billing more than the agreed total by submitting multiple smaller invoices.

Manual three-way matching is time-consuming — each match can take 5–15 minutes when done by hand, and the process is prone to human error, especially at high invoice volumes. Automating the matching process with AI extraction tools that can read invoice PDFs and compare them against PO and GRN data in your accounting system reduces matching time to seconds and eliminates the most common manual errors.

An automated matching workflow typically works as follows: the supplier invoice arrives as a PDF, the AI extraction tool reads the invoice and extracts the key fields (vendor, invoice number, date, line items, quantities, prices, totals), the extracted data is compared against the PO and GRN data in the accounting system, invoices that match within tolerance are automatically approved, and invoices with discrepancies are routed to an exception queue for manual review. This approach allows AP teams to process high invoice volumes without proportionally increasing headcount.

The effectiveness of your three-way matching process can be measured using three key metrics: straight-through processing rate (percentage of invoices that match automatically without human intervention — a well-designed process should achieve 70–85%), exception rate (percentage of invoices that require manual investigation — should be below 15–30%), and exception resolution time (average time from exception identification to resolution — should be below 2 business days).

Track these metrics monthly and investigate any deterioration. A rising exception rate may indicate that suppliers are changing their invoicing practices, that your PO data quality is declining, or that fraudsters are probing your controls. A falling straight-through processing rate may indicate that your tolerance rules are too tight or that your AI extraction accuracy has declined. Regular measurement and investigation of these metrics ensures that your matching process remains effective over time.