The Three-Way Match: Where Procurement Controls Actually Break

By CA Dhruv Seth, Seth & Associates, Chartered Accountants, Lucknow

Ask any promoter whether the company runs a three-way match on purchase invoices and the answer is almost always yes — the ERP does it. Then pull one month of purchase vouchers and check how many were passed with an override, and how many carried a purchase order raised after the invoice date. The control exists on paper far more often than it exists in fact.

What the three-way match is supposed to do

The three-way match compares three documents before a supplier is paid: the purchase order, being what you agreed to buy and at what rate; the goods receipt note or GRN, being what actually arrived; and the invoice, being what the vendor is charging. If all three agree, you are not paying for goods you never ordered, never received, or agreed to buy cheaper. It is the most important preventive control in procurement, and in owner-managed businesses scaling past Rs 100 crore it is also the most quietly diluted.

Where the three-way match actually breaks

• Tolerances set too wide. A five per cent value tolerance on Rs 200 crore of purchases means Rs 10 crore of invoicing can pass unchallenged. Few boards know what their tolerance is or who fixed it.

• Purchase orders raised after the invoice. When the PO is built from the invoice, the match is circular and will always succeed. This is the single most common failure.

• The buyer records the GRN. If the person placing the order also confirms receipt, two of the three documents sit under one hand.

• Open-ended or blanket POs carrying no rate and no quantity. There is nothing left to match against.

• Services with no GRN equivalent. Manpower, transport, AMC and security bills are usually passed on a departmental signature rather than evidence of what was delivered.

• Override rights. Force-post access is often granted to a dozen users during ERP implementation and never withdrawn.

Four reports an owner should ask for

• Match exception report for the full financial year — every invoice posted despite a mismatch, listed by user, vendor and value.

• PO date against invoice date — the count and value of purchase orders created on or after the invoice date.

• Non-PO spend as a percentage of total purchase value, split by department. Above ten per cent in a manufacturing business usually means the process has been abandoned rather than designed.

• Purchase price variance — the PO rate against the last three rates paid to that vendor, and against rates paid to others for the same item code.

None of these needs a consultant to produce; they are standard ERP outputs. The useful question is not whether exceptions exist, because they always do, but whether anyone reviews them and whether the same three names appear every month.

Why GST law now enforces your GRN discipline

Section 16(2) of the CGST Act allows input tax credit only where the buyer holds a tax invoice, has actually received the goods or services, the tax has reached the government and the supplier has filed the return. Since 1 January 2022, clause (aa) has tightened this further: credit is available only where the invoice appears in the buyer's GSTR-2B. A purchase booked without a goods receipt and without a matching entry in GSTR-2B is therefore two problems at once — an unverified cost and a credit that may have to be reversed with interest. Monthly reconciliation of the purchase register to GSTR-2B is a procurement control, not merely a tax chore.

The bottom line

• A three-way match that never throws exceptions is not working; it has been configured not to. The control lives in the exception report, not in the ERP module.

• Segregation between requisition, ordering and goods receipt matters more than how sophisticated the system is. Ask whether any single user can create a vendor, raise a PO and post a GRN.

• Services procurement needs its own evidence of delivery — a measurement sheet, attendance record or service report — because a GRN will simply not exist.

• Companies crossing Rs 200 crore of turnover must appoint an internal auditor under Section 138 of the Companies Act, 2013 read with Rule 13 of the Companies (Accounts) Rules, 2014. Procurement is where that mandate earns its keep.

This article is for general information and does not constitute audit, legal or tax advice. Regulations change; please verify the current position or speak to a qualified adviser before acting.