Purchase-to-Pay and Operational Procurement

Introduction and context

Purchase-to-pay (P2P) is the integrated business process through which an organisation identifies a need, obtains approval, selects or uses an appropriate supplier, places an order, receives goods or services, validates the supplier’s invoice and makes payment. It is the operational expression of procurement policy. Whereas strategic sourcing determines supply markets, category strategies and commercial arrangements, P2P converts those arrangements into controlled transactions.

Effective P2P is not merely an administrative sequence. It connects demand management, budgeting, inventory control, supplier performance, accounts payable, internal control and working-capital management. Poorly designed processes produce unauthorised purchases, duplicate orders, late deliveries, excess inventory, invoice disputes and fraud exposure. Well-designed processes provide visibility, speed, compliance and reliable data for management decisions.

The process normally begins with a purchase requisition and ends with payment and record retention. In practice, however, it is a feedback loop: receiving data affects inventory records; invoice discrepancies trigger operational investigation; supplier performance affects future sourcing decisions; and spend analysis informs policy and catalogue design.

Learning objectives

By the end of this chapter, the learner should be able to:

1. Explain the stages, documents and control points in a P2P process.
2. Prepare and evaluate requisitions, purchase orders, receipts and invoice records.
3. Distinguish two-way, three-way and service-entry matching.
4. Diagnose maverick spend and propose proportionate controls.
5. Relate purchasing lead time to inventory and operational continuity.
6. Manage service procurement, including deliverables, acceptance and change control.
7. Select meaningful process-efficiency and supplier-performance measures.
8. Evaluate the role of ERP, e-procurement, automation and artificial intelligence.

1. The P2P operating model

A controlled P2P process contains five broad stages:

The process should establish a clear audit trail from the business requirement to the payment. A purchase order is generally a commitment document, not proof that goods were delivered. A goods receipt confirms physical receipt or acceptance, not necessarily invoice correctness. An invoice requests payment, but does not by itself prove that the purchase was authorised or satisfactorily delivered.

Demand management and the purchase requisition

A purchase requisition is an internal request to acquire goods, services or works. It should identify:

• requester and department;
• item or service description and technical specification;
• quantity, unit of measure and required date;
• delivery location and end use;
• estimated price and currency;
• budget, cost centre, project or asset code;
• suggested supplier or contract reference, where justified;
• health, safety, quality, sustainability or regulatory requirements;
• whether the requirement is standard, urgent, recurring or strategic.

A strong specification states the required outcome and measurable acceptance criteria without unnecessarily naming a brand. Brand references may be justified for compatibility, safety, warranty or standardisation, but a buyer should document the rationale and consider equivalent alternatives.

Requisitions should be screened before approval. The buyer or system may check whether the item is already stocked, available through a catalogue, covered by an existing contract, or suitable for consolidation with other demand. This prevents unnecessary purchases and improves leverage.

Approval design

Approval is a governance activity, not a ceremonial signature. Delegated authority matrices commonly consider value, category risk, budget ownership, contract status and urgency. A low-value routine catalogue purchase may require automated approval, while a high-value professional service, sole-source purchase or security-sensitive technology may require legal, technical, finance and executive review.

Good approval design follows three principles:

1. Proportionality: control effort should reflect financial and operational risk.
2. Segregation: one person should not request, approve, receive and pay for the same transaction without compensating controls.
3. Traceability: approvals should be attributable, dated and retained.

An approval after the purchase has occurred is normally a control failure, even if the manager would have approved the purchase beforehand.

Sourcing routes

Operational procurement uses several routes:

• Catalogue or framework purchase: the supplier, terms and prices are pre-established.
• Competitive quotation: suitable for routine, clearly specified requirements below formal tender thresholds.
• Formal tender or request for proposal: appropriate where value, complexity or risk justifies structured competition.
• Direct purchase or sole source: permissible only where policy and evidence support it, such as compatibility, intellectual property, emergency or absence of reasonable alternatives.
• Call-off order: an order placed against an existing contract, often with agreed prices and service levels.

The route should be selected before commitment. Splitting one requirement into several smaller orders to avoid a quotation or approval threshold is an evasion of control and may constitute procurement misconduct.

2. Purchase orders and commercial commitment

A purchase order (PO) communicates the organisation’s authorised commitment and the supplier’s expected obligations. A complete PO normally includes:

• unique PO number and date;
• buyer and supplier legal identities;
• delivery and invoicing addresses;
• item or service description;
• quantity, unit price, tax treatment and total value;
• currency and payment terms;
• required delivery date and location;
• contract, framework or quotation reference;
• quality, packaging, inspection and documentation requirements;
• service levels, milestones and acceptance criteria where applicable;
• change, cancellation, warranty and dispute provisions;
• authorised terms and conditions.

A PO should be issued before the supplier begins work or dispatches goods, except where a documented emergency procedure applies. “No PO, no pay” policies can reduce unauthorised spend, but they must be supported by realistic buying channels and exception handling. If employees cannot easily obtain approved items, they may bypass the system.

Purchase order types

A standard PO covers a defined quantity and price. A blanket or framework order supports repeated purchases over a defined period, subject to controls on maximum value, validity and call-off authority. A planned PO may represent forecast demand, but should not be confused with a legally binding commitment unless issued under applicable terms. A service PO may specify time, deliverables, milestones or rates rather than physical quantities.

PO amendments should be controlled. Changes to price, quantity, scope, delivery date or supplier bank details require authorised revision and a record of who approved it. A buyer should not simply alter a PO to make an invoice match; the underlying commercial event must be investigated.

3. Receiving, inspection and inventory interfaces

Receiving is the point at which the organisation records what has actually arrived or been accepted. For physical goods, the receiving record should state date, PO number, quantities received, condition, packaging damage, batch or serial numbers where relevant, inspection status and the identity of the receiver.

The receiver should count and inspect independently against the PO and delivery documentation. Signing a carrier’s document may acknowledge delivery to a location, but it may not constitute technical acceptance. Defective, short or excess deliveries should be quarantined, rejected or recorded as exceptions according to policy.

Inventory consequences

A goods receipt can increase available inventory, create an inspection balance, trigger quality review and establish an obligation for the supplier invoice. The exact accounting treatment depends on the organisation’s system and accounting policy. A receipt should not automatically make defective goods available for production.

For stock items, procurement must coordinate with inventory management. Excessive safety stock can hide unreliable suppliers; insufficient stock can create production stoppages. The reorder point is commonly represented as:

where ROP is the reorder point in units, d is average demand per unit of time, L is replenishment lead time in the same time unit, and SS is safety stock in units. The expression assumes that demand and lead time are represented consistently and that replenishment is triggered when inventory position reaches the calculated point. Inventory position normally includes on-hand stock plus valid scheduled receipts minus outstanding demand; it is not always the same as physical stock.

If average daily demand is 40 units, lead time is 6 days and safety stock is 80 units, then:

This is a planning approximation. When demand or lead time is highly variable, safety stock should be based on an approved service-level method using demand and lead-time variability. The simple formula should not be presented as a guarantee against stockout.

Lead time and operational performance

Procurement lead time may include requisition preparation, approval, sourcing, PO transmission, supplier processing, transport, customs, receiving and inspection. A useful process measure is:

where t_need_identified is the timestamp at which the requirement is formally identified and t_submission is the timestamp at which the accepted goods or service is available for use. Organisations should define start and end points consistently; otherwise comparisons are misleading.

A buyer can reduce lead time by using catalogues, standard specifications, framework agreements, electronic approvals, supplier scheduling and early visibility of demand. Expediting individual orders is not a substitute for eliminating repeated process delays.

4. Invoice processing and matching

Accounts payable should verify that the invoice is authentic, addressed to the correct legal entity, mathematically accurate, tax-compliant and associated with an authorised transaction. It should also check duplicate invoices, supplier status, bank-account controls and payment terms.

Two-way and three-way matching

Two-way matching compares the PO with the invoice, usually for price, quantity and terms. It may be suitable for low-risk services or situations where receipt is not separately recorded.

Three-way matching compares:

1. the PO, which states what was ordered;
2. the receipt or service entry, which states what was received or accepted; and
3. the invoice, which states what the supplier is charging.

Three-way matching is particularly valuable for physical goods and measurable services. A match does not mean that every field is identical. Organisations normally define tolerances for quantity, price, tax, freight and rounding. Tolerances must not be so broad that they defeat control.

For a line item, an invoice may be accepted when:

and

where Q denotes quantity, P denotes the relevant unit or line price, and τ represents an approved tolerance. The quantities and prices must use compatible units and currency. These are control tests, not universal accounting rules; each organisation must define its policy, tax treatment and rounding method.

Worked matching example

A PO authorises 100 units at $25 each. The receipt confirms 96 acceptable units. The invoice charges 96 units at $25 each plus $40 freight. The goods value is:

If the PO permits freight of up to $50 and the invoice is otherwise valid, the invoice may pass matching. If the invoice instead charged 100 units, the system should place the excess four units into an exception because the accepted quantity is 96. The buyer must investigate whether the goods are missing, rejected, in transit or incorrectly recorded; payment should not be released merely because the original PO was for 100 units.

Exception management

Common exceptions include price variance, quantity variance, missing receipt, duplicate invoice, wrong tax, expired PO, incorrect supplier identity and invoice submitted to the wrong entity. Efficient organisations assign ownership and ageing targets to exceptions. A buyer should not be the sole resolver of every issue: the receiver handles physical discrepancies, the requester confirms service acceptance, finance handles tax and payment controls, and the supplier corrects inaccurate invoices.

Payment terms should be managed ethically and contractually. Delaying a valid undisputed payment beyond agreed terms may damage supplier liquidity and violate law. Conversely, paying an invoice without adequate evidence of receipt exposes the organisation to loss.

5. Maverick spend and compliance

Maverick spend is expenditure made outside approved contracts, suppliers, channels or procedures. It may be deliberate, accidental or caused by process design. Examples include buying from an unapproved supplier, bypassing a catalogue, placing an order without a PO, splitting spend to avoid thresholds, or using a contract after its expiry.

Maverick spend creates several risks:

• loss of negotiated price and volume leverage;
• inconsistent specifications and quality;
• weak supplier due diligence;
• duplicate or fraudulent payments;
• missed rebates and poor spend visibility;
• legal, tax, safety or data-protection exposure;
• reputational damage.

A useful descriptive measure is:

The denominator should exclude genuinely non-addressable expenditure, such as regulated utilities or unavoidable statutory payments, if the organisation’s policy defines it that way. The rate is meaningful only when spend data is classified consistently.

Controls should combine prevention, detection and correction. Prevention includes catalogues, preferred suppliers, budget checks, guided buying, delegated authority and clear specifications. Detection includes data analytics, supplier and invoice reviews, threshold monitoring and exception reports. Correction includes root-cause analysis, user training, contract redesign and disciplinary action where misconduct is established.

Punitive controls alone are ineffective when approved routes are slow or unavailable. Procurement should examine whether users bypass the system because of poor item descriptions, unrealistic lead times, excessive approvals, unavailable suppliers or difficult technology.

6. Service procurement

Services are more difficult to procure and pay for than standard goods because the output may be intangible, variable or dependent on professional judgement. A service PO should therefore define the outcome rather than merely stating “consulting services.” It should include:

• scope and exclusions;
• deliverables and acceptance criteria;
• milestones and dates;
• roles and responsibilities;
• rates, ceilings or fixed fees;
• time-recording requirements where relevant;
• intellectual-property ownership;
• confidentiality, information security and data handling;
• health, safety and insurance requirements;
• performance measures and remedies;
• change-control and termination provisions.

A service entry sheet or equivalent acceptance record confirms that the organisation has received the agreed service. The requester or contract manager should assess quality and completion, while procurement monitors commercial compliance. Payment for time and materials should be supported by approved timesheets and evidence that rates match the contract. Payment for milestones should depend on documented acceptance, not merely the passage of time.

Scope creep is a major risk. Any change should state the revised deliverable, price, schedule, risk and approval. Informal instructions by email can create an unauthorised commitment and later dispute.

7. Measuring process efficiency and control

Procurement performance should balance speed, cost, compliance, service quality and risk. Useful measures include:

A first-pass match rate may be calculated as:

The measure should distinguish genuine errors from system failures. A high rate achieved by broad tolerances may conceal overpayment, while a low rate may reflect poor master data rather than supplier failure. Metrics should therefore be segmented by category, supplier, business unit and transaction type.

Process improvement often uses the Plan–Do–Check–Act cycle. The organisation identifies a bottleneck, tests a controlled change, examines results and standardises or revises the change. Lean techniques can remove duplicate data entry and unnecessary approval steps; Six Sigma methods can analyse recurring variation. However, removing a step is not improvement if it removes a necessary control.

8. Technology, data and artificial intelligence

ERP and e-procurement systems can integrate requisitions, catalogues, contracts, approvals, POs, receipts, invoices, inventory and payments. Electronic data interchange and supplier portals can reduce re-keying and improve status visibility. Optical character recognition and intelligent document processing can extract invoice fields, but extracted data still requires validation.

Robotic process automation may route standard invoices, check fields and generate reports. Artificial intelligence can assist with spend classification, anomaly detection, demand signals, supplier-risk monitoring and recommended buying channels. These applications should be treated as decision support unless the organisation has established reliable controls for autonomous action.

Key governance requirements include:

• accurate supplier and item master data;
• role-based access and segregation of duties;
• audit logs that cannot be silently altered;
• human review of high-risk or unusual transactions;
• protection of commercial, personal and confidential data;
• testing for bias and classification errors;
• documented model limitations and escalation rules;
• retention and deletion consistent with law and policy.

AI-generated supplier recommendations can reproduce historical bias or favour suppliers that are well represented in past data. Anomaly detection may flag legitimate emergency purchases. Procurement professionals remain accountable for judgement, fairness, confidentiality and compliance.

9. Governance, ethics and regulatory considerations

Operational procurement must comply with applicable contract, commercial, tax, public procurement, competition, anti-bribery, labour, environmental, sanctions, data-protection and record-retention requirements. The exact legal framework varies by jurisdiction and sector; organisational policy cannot authorise conduct prohibited by law.

Ethical procurement requires impartial treatment of suppliers, transparent evaluation, avoidance of conflicts of interest and protection of confidential bid information. Gifts, hospitality and personal relationships should be declared and managed under policy. A buyer should not favour a supplier because of personal benefit, nor disclose one supplier’s confidential quotation to another.

Emergency procurement may justify speed, but it does not eliminate the need to document the emergency, scope, price reasonableness, approval, supplier suitability and post-event review. Sustainability requirements should be proportionate and evidence-based, including consideration of lifecycle cost, labour conditions, environmental impact and disposal obligations.

10. Illustrative case: Meridian Components

Background

Meridian Components, a fictional manufacturer, experienced frequent production delays despite holding substantial inventory. Its accounts-payable team reported that only 58% of invoices matched without manual intervention. A spend review found that engineers regularly purchased urgent maintenance parts from local suppliers outside framework agreements.

Problem analysis

Process mapping showed that requisitions required four sequential approvals, even for low-value catalogue items. The catalogue contained obsolete descriptions and incorrect units of measure. Maintenance staff could not see supplier stock or expected delivery dates. Receivers often signed delivery notes without recording partial quantities in the ERP system. Accounts payable then paid invoices against the original PO quantity. The organisation’s reported stock level therefore exceeded usable stock.

The maverick spend rate was calculated at 22% of addressable maintenance spend. The figure did not prove that every off-contract purchase was unreasonable; some were emergency purchases. It did show that the approved channel was not meeting operational needs.

Approach and solution

Meridian introduced a risk-based workflow. Low-value standard catalogue items received automated budget approval, while high-value and non-standard purchases retained technical and commercial review. The catalogue was cleansed, units of measure were standardised and critical spares were linked to approved supplier lead times. Framework suppliers were required to provide electronic order confirmation and delivery status.

Receivers were trained to record accepted, rejected and outstanding quantities separately. Three-way matching was enabled for stock items, with narrow approved tolerances. Service purchases used service-entry records with named technical approvers. Emergency purchases required a short justification and post-event review rather than retrospective approval of all transactions.

A dashboard tracked PO-backed spend, first-pass match rate, receipt timeliness, emergency purchasing, supplier on-time delivery and stockouts. Procurement reviewed results monthly with maintenance, finance and operations.

Outcome

After six months, the first-pass match rate rose from 58% to 86%, and the maverick spend rate fell to 9%. Production stockouts declined, although emergency purchases did not disappear because some imported components still had volatile lead times. The improvement came not from enforcing “no PO, no pay” alone, but from making compliant purchasing faster and improving receiving data.

Learning points

1. Compliance problems may be symptoms of poor process design.
2. Accurate receiving is essential for both payment control and inventory accuracy.
3. Metrics should be reviewed together; a faster process is not successful if quality or risk worsens.
4. Emergency procedures should be controlled, documented and analysed for recurring causes.
5. Technology produces value only when master data, roles and operating discipline are reliable.

Challenges and limitations

P2P systems can become over-controlled, producing approval delays and user workarounds. Conversely, excessive automation may approve inaccurate transactions at scale. Spend classification is often imperfect because supplier names, descriptions and accounting codes are inconsistent. Lead-time measures can be distorted by unclear timestamps or by excluding waiting time between departments.

Three-way matching is not universally suitable. Some services are difficult to measure at receipt, and some legitimate purchases have no conventional PO. A proportionate alternative may use contract milestones, approved timesheets, acceptance certificates or recurring-payment controls. Similarly, a high PO-backed spend percentage does not prove value for money; an organisation may issue POs to a poor supplier at an inflated price.

Managers should therefore interpret P2P data in context, combine quantitative and qualitative evidence, and review whether controls achieve their intended purpose.

Best-practice checklist

• Define a clear end-to-end process owner.
• Make approved buying channels convenient and searchable.
• Use specifications that are precise, outcome-focused and non-discriminatory.
• Apply risk-based approval and segregation of duties.
• Issue POs before commitment wherever practicable.
• Record partial, rejected and accepted receipts accurately.
• Match invoices using documented tolerances and investigate exceptions.
• Control supplier master data and bank-account changes independently.
• Analyse maverick spend by root cause, not only by blame.
• Measure speed, compliance, quality, risk and user experience together.
• Review emergency purchases and recurring service changes.
• Govern automation and AI with human accountability and auditability.

Chapter Summary

Purchase-to-pay integrates demand, approval, ordering, receiving, invoice validation and payment. Its purpose is to ensure that the organisation obtains the right goods or services, from an appropriate supplier, at an authorised price and quantity, with evidence of satisfactory delivery. Requisitions establish need; purchase orders establish commitment; receipts and service entries establish acceptance; and matching provides a financial control before payment.

Operational procurement must coordinate with inventory, finance, contract management and users. Lead time, reorder points and safety stock connect purchasing decisions with continuity of operations. Maverick spend is both a compliance risk and an indicator of inaccessible or ineffective buying channels. Service procurement requires explicit deliverables, acceptance criteria and change control. Technology can improve visibility and automation, but only when master data, segregation of duties, exception management and governance are sound. Effective performance management combines cycle time, match rate, contract compliance, delivery reliability, quality, stockouts and risk rather than relying on a single metric.

Key Terms

Purchase-to-pay: The end-to-end process from internal demand through supplier payment.

Purchase requisition: An internal request to acquire goods, services or works.

Purchase order: An authorised document communicating a purchasing commitment and requirements.

Catalogue buying: Purchasing from pre-approved items, suppliers and prices in an electronic or structured catalogue.

Framework agreement: A pre-established arrangement setting terms for future orders or call-offs.

Delegated authority: Formal limits defining who may approve commitments.

Goods receipt: A record of goods delivered and accepted, wholly or partially.

Service entry: A record that contracted services or milestones have been performed and accepted.

Two-way match: Comparison of a purchase order and supplier invoice.

Three-way match: Comparison of purchase order, receipt or service entry, and invoice.

Tolerance: An approved difference that may be accepted during matching.

Maverick spend: Expenditure outside approved suppliers, contracts, channels or procedures.

Lead time: Time between defined process events, commonly order placement and usable receipt.

Reorder point: Inventory position at which replenishment should be initiated.

Safety stock: Inventory held to protect against demand or supply uncertainty.

Scope creep: Unauthorised or uncontrolled expansion of contracted work.

Segregation of duties: Division of incompatible responsibilities among different people or controls.

First-pass match rate: Percentage of invoices accepted without manual exception.

Exception management: Identification, ownership and resolution of transactions that fail a control test.

Spend visibility: The ability to identify, classify and analyse organisational expenditure.

Review Questions

Short Answer Questions

1. What are the principal records in a three-way match?
2. Why should a purchase order normally be issued before supplier performance begins?
3. Define maverick spend and state two risks it creates.
4. What information should a service purchase order contain?
5. Why is accurate receiving important to both inventory and accounts payable?

Long Answer Questions

1. Explain the complete purchase-to-pay process and the control purpose of each stage.
2. Compare two-way and three-way matching, including situations in which each may be appropriate.
3. Discuss how an organisation can reduce maverick spend without creating excessive bureaucracy.
4. Explain how procurement lead time affects inventory and operational continuity.
5. Evaluate the benefits and governance risks of ERP automation and artificial intelligence in P2P.

Analytical / Application Questions

1. An organisation has a high first-pass match rate but also rising overpayments and supplier complaints. Analyse how this situation could occur and recommend investigations and controls.
2. A factory reports frequent emergency purchases of maintenance parts despite holding high total inventory. Use P2P, receiving and inventory concepts to diagnose possible causes and design an improvement plan.
3. A service supplier submits an invoice for a milestone that the project manager has not formally accepted. Explain how the buyer, requester, contract manager and accounts-payable team should respond, and identify the governance risks of paying immediately.

Multiple Choice Questions with Answers

Question 1

Which document primarily records an internal request to acquire goods or services?

A. Purchase requisition

B. Goods receipt

C. Supplier invoice

D. Payment remittance

Correct Answer: A. Purchase requisition

Question 2

What is the principal purpose of a three-way match?

A. To compare supplier market shares

B. To compare the PO, receipt or service entry, and invoice

C. To calculate safety stock

D. To approve every supplier contract

Correct Answer: B. To compare the PO, receipt or service entry, and invoice

Question 3

Average daily demand is 40 units, lead time is 6 days, and safety stock is 80 units. Using ROP = d × L + SS, what is the reorder point?

A. 240 units

B. 280 units

C. 320 units

D. 480 units

Correct Answer: C. 320 units

Question 4

Which action is an example of maverick spend?

A. Buying through an approved catalogue

B. Calling off against an active framework agreement

C. Purchasing from an unapproved supplier outside the required process

D. Recording a partial goods receipt

Correct Answer: C. Purchasing from an unapproved supplier outside the required process

Question 5

What does a goods receipt primarily evidence?

A. That the supplier has been selected competitively

B. That goods were delivered and recorded as received or accepted

C. That an invoice has been paid

D. That a budget has been increased

Correct Answer: B. That goods were delivered and recorded as received or accepted

Question 6

Which control is most appropriate for a service milestone invoice?

A. Payment solely because the invoice is dated correctly

B. Payment after documented acceptance of the milestone

C. Payment without reference to the contract

D. Payment based only on the supplier’s verbal assurance

Correct Answer: B. Payment after documented acceptance of the milestone

Question 7

If a PO authorises 100 units but only 96 acceptable units are received, what should happen to an invoice for 100 units?

A. It should automatically be paid because the PO is for 100 units

B. The four-unit difference should be investigated as an exception

C. The PO should be deleted

D. The supplier should always be paid double freight

Correct Answer: B. The four-unit difference should be investigated as an exception

Question 8

Which measure indicates the percentage of invoices accepted without manual exception?

A. On-time delivery rate

B. Maverick spend rate

C. First-pass match rate

D. Supplier concentration ratio

Correct Answer: C. First-pass match rate

Question 9

Why is segregation of duties important in P2P?

A. It ensures every purchase has four suppliers

B. It reduces the risk that one person controls incompatible transaction stages

C. It eliminates the need for receiving records

D. It guarantees the lowest market price

Correct Answer: B. It reduces the risk that one person controls incompatible transaction stages

Question 10

Which is a significant governance requirement when using AI for procurement anomaly detection?

A. Allowing the system to bypass all human review

B. Removing audit logs to protect speed

C. Maintaining human accountability and reviewing high-risk alerts

D. Using only historical supplier preferences without testing

Correct Answer: C. Maintaining human accountability and reviewing high-risk alerts