How to Set Up a 3-Way Matching Process Without Procurement Software

If your company is paying vendor invoices based on an email and a gut feeling, you are not alone. A lot of mid-market finance teams are operating this way, and it works fine until it doesn't. One duplicate payment, one fraudulent invoice, one vendor who billed for 120 units when you received 100, and suddenly you're spending three days untangling it.

Three-way matching is the process that prevents all of that. It sounds complicated but the concept is straightforward: before you pay any invoice, you verify that it matches three documents. What you ordered, what you received, and what the vendor is billing you for. When all three agree, you pay. When they don't, you investigate before money goes out.

This guide walks through how to set it up manually if you don't have procurement software yet.

The purchase order is the authorization document. It records what you agreed to buy, from whom, at what price, and in what quantity. A PO doesn't have to be complicated. For a lot of mid-market companies it can be a simple numbered document in a spreadsheet or Google Doc. What matters is that it exists before the purchase happens, not after.

The receiving report, sometimes called a goods receipt, confirms that what was ordered actually arrived. For physical goods this is a document your receiving team creates when shipments come in. For services it might be a confirmation email that a milestone was reached or a project was completed. The key is that someone independent from AP is confirming receipt.

The vendor invoice is what the supplier sends requesting payment. It should reference the PO number, list the same quantities and prices that were on the PO, and match what was confirmed received.

Three-way matching is the act of comparing all three before releasing payment.

Organizations lose an estimated 5% of annual revenue to payment fraud, and small to mid-size businesses experience billing fraud twice as often as large enterprises. Beyond fraud, the more common problem is simple errors. A vendor bills for 10 units when you received 8. A price on an invoice doesn't match what was negotiated on the PO. A subscription auto-renews at a higher rate than the previous year. Without a matching process, these errors often get paid because nobody checked.

There's also the audit side. When auditors ask for documentation on a payment from two years ago, a three-way matching process means you can pull the PO, the receipt, and the invoice immediately. Without it, that question becomes a days-long project.

You don't need software to do this. Here is a straightforward system that works for companies processing up to 100 to 150 invoices per month.

Build a simple spreadsheet with these columns: PO number, date issued, vendor name, item or service description, quantity ordered, unit price, total amount, and requestor name. Every purchase that goes through your AP process should start with a PO entry. Give each PO a unique number. A simple format like PO-2026-0001 works fine.

Require that every vendor invoice include the PO number. This sounds obvious but enforcing it is the single most important step. If a vendor sends an invoice without a PO number, send it back before doing anything else.

This is a separate spreadsheet or tab where your receiving team or department heads log what actually came in. Columns: PO number, date received, vendor name, quantity received, condition notes, and name of person confirming receipt. For services, this is where a project manager or department head notes that the work was completed.

The receiving log should be filled out by someone who is not in AP. This separation of duties is what gives the control its value. If the same person who approves payment is also confirming receipt, the control doesn't work.

When an invoice arrives, your AP team should work through a simple checklist before processing:

Does this invoice have a PO number? If not, return it to the vendor.

Does the PO number match an approved PO in the log? If not, flag it for the requestor to verify.

Does the quantity on the invoice match the quantity on the PO? If there's a discrepancy of more than your tolerance threshold, put it on hold and contact the vendor.

Does the price per unit match the PO? Same rule applies.

Has receipt been confirmed in the receiving log? If no receiving entry exists yet, do not pay until it does.

When all three match within your tolerance, approve for payment. When they don't, document the exception and resolve it before releasing funds.

Not every discrepancy is worth holding up a payment. Most finance teams set a tolerance of 1 to 3 percent on price variances for smaller purchases. Anything over that threshold requires investigation. Decide on your thresholds in advance and document them in your AP policy so they're applied consistently.

You don't need to run every purchase through this process. A practical approach used by many mid-market finance teams is to use different levels based on risk and value. Two-way matching, which only compares the PO and invoice without a separate receiving confirmation, works fine for low-risk recurring purchases like software subscriptions where delivery is automatic. Three-way matching is appropriate for vendor purchases above a set dollar threshold, new vendors, and any physical goods. Four-way matching, which adds an inspection report, is worth considering for high-value equipment or regulated industries.

Define these tiers, write them down, and train anyone who touches AP on the rules.

The most frequent issue is invoices arriving without PO numbers. The fix is simple: require PO numbers in your vendor onboarding process and make it clear that invoices without them will be returned before processing begins. Most vendors will comply once they understand the policy because it actually speeds up their payment cycle.

The second most common problem is receiving confirmation that lags behind invoices. Your receiving team or department heads need to log receipts promptly. If invoices are sitting in AP waiting for a receiving confirmation that never comes, that's a process breakdown you need to address with the teams responsible.

The third problem is exceptions that never get resolved. Build a simple exceptions log where any held invoice is tracked with a note on why it was held, who owns the resolution, and a target resolution date. Review it weekly. Invoices that sit in exceptions for more than two weeks are almost always a vendor relationship problem or an internal communication breakdown that needs active attention.

This spreadsheet-based system works well up to a point. As your vendor count grows and invoice volume increases, the manual process becomes the bottleneck. When your AP team is spending more time matching documents than doing anything else, or when exceptions are falling through the cracks because the volume is too high to track manually, that's the signal that you need a system.

The threshold most finance teams hit is somewhere around 100 to 150 invoices per month or 30 or more active vendors. Before that point the spreadsheet approach is completely workable if the process is followed consistently.

Three-way matching is not a complicated concept. What makes it fail at most companies is not the process itself but the lack of enforcement. Purchase orders that get created after the fact. Receiving confirmations that never get logged. Invoices that bypass the process when someone is in a hurry. The discipline matters more than the tool.

If you're a controller or finance lead at a growing company and you're still managing this in email threads and spreadsheets, implementing even a basic version of this process will reduce payment errors, give you a cleaner audit trail, and remove the risk of paying for things that weren't delivered or weren't approved.