Two-way match

Two-way match compares purchase order lines to invoice lines on price, quantity, unit of measure, and extended amount. Organizations use it for low-value purchases, services billed on milestones, utilities, and suppliers where receipt posting is impractical. It reduces cycle time because AP does not wait for warehouse confirmation.

Policy usually caps two-way match by category and dollar amount. Above the threshold, or for inventory items, the same invoice would require three-way match. The policy should be documented so auditors understand why certain spend bypasses receipt controls.

Without a receipt leg, you can pay for goods that never arrived or services not performed. Fraud scenarios include collusion on inflated PO lines and duplicate invoicing against an open PO. Mitigations include receiving audits, supplier scorecards, and random three-way samples even inside categories nominally on two-way match.

Partial deliveries create ambiguity: if the PO is for 100 units but only 60 arrived, a two-way match on the full PO quantity overpays unless the PO is updated or the invoice is partial. Buyers should close or reduce PO lines when deliveries complete.

PO-2201 authorizes 40 hours of network engineering at $175/hour ($7,000). The vendor invoices 40 hours on invoice SI-8891. Two-way match passes if the PO is still open for 40 hours and the rate matches.

If the vendor invoices 44 hours ($7,700), match fails on quantity unless the PO was increased. AP routes to the buyer to approve a change order or reject the extra four hours.

ERP and AP automation tools often default to three-way match; two-way is a configured exception per vendor, material group, or GL account. Workflow should still capture who approved any override.

When receipt data later becomes available, some teams run retroactive three-way analytics to find historical overbilling—useful during supplier reviews or contract renewals.

Publish a policy table that lists categories eligible for two-way match, maximum PO value, and required approver for overrides. Audit a quarterly sample of two-way payments against delivery evidence for high-risk vendors.

When services are involved, tie match to milestone acceptance records even if formal GRN is not used. Close PO lines promptly so partial invoices cannot be duplicated against open quantity.

Review metrics quarterly with procurement, finance, and business owners who feel process pain—adjust rules when data shows a control is cosmetic or a bottleneck is upstream.

Internal audit samples two-way match by tracing transactions from requisition or contract through payment, looking for missing evidence and override patterns. Findings are usually systemic—stale catalogs, receivers not trained, or tolerances set too wide—rather than one rogue approver. Remediation plans should name a process owner outside AP when the root cause is upstream.

Leading indicators for two-way match include open exceptions, unposted receipts, contracts past notice windows, and classification backlog; lagging indicators include paid-after-due volume, duplicate hits, and price variance dollars. Review the same dashboard weekly with procurement during a transformation, not only at quarter close, so fixes land before suppliers escalate.

Pilot changes to two-way match on one company code or region with documented before-and-after samples on the same supplier mix. Parallel-run old and new rules until match or classification variances fall below an agreed threshold, then cut over with a rollback plan. Executive sponsors should see cycle time and touch-per-document, not only license go-live dates.

Technology helps two-way match only when master data, contracts, and receiving discipline keep pace. Budget for content stewardship—catalog updates, clause playbooks, screening lists—alongside software. Tie savings claims to redirected spend, captured discounts, and avoided overbill with line-level examples auditors can reproduce.

Stakeholder alignment matters: publish a one-page RACI for two-way match that names who sets policy, who operates the process, and who approves exceptions. Exception approvals should expire automatically after 90 days unless renewed with business justification, preventing "temporary" tolerances from becoming permanent holes in control.

Training should use live examples from your ERP, not generic slides—walk receivers and buyers through one held document and show which fields they can change to clear two-way match issues. Reinforce that fixing upstream data beats overriding match or approval rules downstream, because overrides rarely scale across thousands of transactions per month.