Browse Business Software Categories

A
B
C
D
E
F
H
I
M
N
P
R
S
W
Close  

Accounting

eProcurement

ERP

Financial Management

Procure-to-Pay Process: Steps, Controls and Software

Sherman Hsieh
Share This Post!
Published
Procure-to-Pay Process: Steps, Controls and Software

Last updated: October 8, 2026 · Independent guide · We do not sell rankings or coverage.

The procure-to-pay process is the sequence of steps a company follows from the moment an employee asks to buy something to the moment the supplier is paid and the cost is recorded: requisition, purchase order, receipt, invoice, match, payment and period-end accounting. Each step creates a record that the next step checks, so the process is also a chain of internal controls. For a controller, the useful questions are who owns each step, which control stops a bad payment there, and what evidence an auditor will ask to see.

The procure-to-pay process in seven steps

  1. Requisition and approval. An employee requests goods or services, and a budget owner approves the spend.
  2. Purchase order. Purchasing selects an approved vendor and issues a PO with price, quantity and terms.
  3. Receipt. The warehouse or requester records what actually arrived or what service was delivered.
  4. Invoice capture. Accounts payable records the supplier invoice and links it to the PO.
  5. Match and exception handling. The system compares invoice, PO and receipt, and routes differences to the right owner.
  6. Payment. Approved invoices are paid in a scheduled run through ACH, check, wire or card.
  7. Accrual, close and reporting. Accounting accrues goods received but not invoiced, posts variances and prepares year-end 1099 reporting.

Who owns each stage: control summary

This RACI-style table shows who does the work, who is accountable, the key control and the evidence your auditors will ask for. Adjust the job titles to your organization.

Stage Responsible / Accountable Key control Evidence to keep
1. Requisition Requester / budget owner Approval within delegated authority limits; budget check Approval history with names and timestamps
2. Purchase order Buyer / purchasing manager PO only to an active, approved vendor; PO before goods ship PO approval log; vendor master change log
3. Receipt Receiving clerk or requester / warehouse manager Receipt posted same day by someone who did not raise the PO Receipt records, packing slips, service sign-off
4. Invoice capture AP specialist / AP manager Duplicate invoice check; “no PO, no pay” rule Invoice image linked to the PO
5. Match System and AP / controller (tolerance policy) Two-, three- or four-way match within approved tolerances Exception log with resolver and reason
6. Payment AP manager / controller or treasurer Dual approval of the payment run; bank detail callback; positive pay Payment register, bank approval log
7. Accrual and close GL accountant / controller Monthly review of received-not-invoiced balance; 1099 vendor review Accrual reconciliation, aging, signed review

Stage 1: Requisition and approval

The requester describes the need, cost estimate, date and GL account, and the budget owner approves it. In Dynamics 365 Supply Chain Management, a configured workflow moves the requisition from Draft to Approved, and budget reservations are recorded when budget control is set up (Microsoft Learn, July 27, 2026).

The control is a written delegation of authority with dollar limits by role, enforced in the system rather than by email. What goes wrong is split purchasing, where one purchase is broken into several requests that each fall under an approval limit. Review requests from the same requester to the same vendor within a few days of each other every quarter.

Stage 2: Purchase order

Purchasing converts the requisition into a PO, chooses the vendor and confirms price, quantity, unit of measure, freight and payment terms. NetSuite lets buyers turn approved requisitions into POs one at a time or in bulk, and several requisitions for the same item can be consolidated into one PO, with cross-references kept on both documents (Oracle NetSuite Help, no date shown). Trading partners that order by EDI send the same data as an EDI 850 purchase order.

Two controls belong here. The PO should carry the price the vendor will bill, including surcharges, or the invoice will fail the match later. And POs can only go to vendors in the approved vendor master, set up with a Form W-9 and a verified taxpayer identification number. The IRS TIN Matching program lets payers that file information returns check name and TIN combinations before filing (IRS, August 10, 2026). Buyers should not be able to create or edit vendors.

What goes wrong is the after-the-fact PO, raised once the invoice arrives so that AP will process it. Track POs dated after the invoice date by department.

Stage 3: Receipt

The receiving clerk records the quantity and condition of goods against the PO line, or the requester confirms that a service was delivered. In NetSuite, an item receipt debits inventory and credits Accrued Purchases, and the vendor bill later clears Accrued Purchases to accounts payable (Oracle NetSuite Help, no date shown).

The control is that receipts record only what physically arrived, on the day it arrived, entered by someone other than the buyer. The most common failure is the late or missing receipt, which makes a correct invoice fail the match and tempts AP to override it.

Stage 4: Invoice capture

AP records the invoice by manual entry, OCR capture, supplier portal or EDI, and links it to the PO number. Capture line-level detail so the system can tell which line caused a difference. Apply a duplicate check on vendor, invoice number, date and amount, and return invoices without a valid PO under a “no PO, no pay” policy, with documented exceptions such as rent and utilities.

What goes wrong is invoices sent to individual employees instead of a central AP inbox, which hides liabilities at month end and costs early-payment discounts.

Stage 5: Match and exception handling

The system compares the invoice to the PO and, for goods, to the receipt. Two-way matching checks invoice against PO, three-way adds quantity received, and four-way adds quantity accepted after inspection (Oracle Payables Help, no date shown). Use two-way for services and three-way for goods. Tolerances decide how much difference passes without review; Dynamics 365 Finance, for example, sets net unit price tolerance percentages by item, vendor or legal entity (Microsoft Learn, May 15, 2025).

The control is clear ownership of exceptions. Purchasing resolves price differences, receiving resolves quantity differences, AP coordinates without changing PO prices, and the controller owns the tolerance policy. Our guide to three-way match in accounts payable covers tolerances by ERP, partial receipts and a worked exception example.

Stage 6: Payment

Approved invoices are selected for a payment run by due date and discount terms. The AP manager prepares the run, and the controller or treasurer approves it in the bank portal. Whoever maintains vendor bank details should not be able to release payments.

Payment fraud is common at this stage. In the 2026 AFP Payments Fraud and Control Survey, 76% of US organizations reported attempted or actual payments fraud in 2025, 74% were affected by business email compromise, and checks were the most targeted method at 58% (AFP, April 14, 2026). The FBI’s Internet Crime Complaint Center recorded 24,768 business email compromise complaints and $3.05 billion in reported losses for 2025 (FBI IC3 2025 Internet Crime Report, no date shown).

Three controls address this directly:

  • Bank detail change verification. Confirm any change request by calling a number already on file, never one in the request, and require a second person to approve the change in the vendor master.
  • Positive pay. You send your bank a file of issued checks, and the bank flags presented checks whose number, amount or payee name do not match, for you to pay or return before a daily cutoff. ACH positive pay filters ACH items against a list of approved vendors in the same way (Prosperity Bank Positive Pay guide, August 2025).
  • ACH fraud monitoring. Nacha’s rules require non-consumer originators to have risk-based processes to identify entries suspected of being unauthorized or authorized under false pretenses, reviewed at least annually. The requirement took effect on March 20, 2026 for originators with 2023 ACH volume of 6 million or more, and on June 19, 2026 (in practice June 22) for all others (Nacha, no date shown).

Stage 7: Accrual, close and reporting

At month end, the GL accountant reviews goods received but not invoiced. In NetSuite, any difference between receipt and bill values stays in Accrued Purchases until the Post Vendor Bill Variances page moves it to quantity, price or exchange rate variance accounts (Oracle NetSuite Help, no date shown). Age that balance monthly and investigate old items, which are usually receipts posted to the wrong PO or invoices sitting unrecorded.

Services received without a PO receipt need a separate accrual, usually built from open commitments and invoices received after period end. Document this cutoff review, because auditors test for unrecorded liabilities.

Year-end 1099 reporting also depends on this cycle. For payments made in 2026, the Form 1099-NEC threshold for nonemployee compensation increased to $2,000, and the IRS says it may be adjusted for inflation beginning in 2027 (IRS Instructions for Forms 1099-MISC and 1099-NEC, Revised December 2026). If a vendor does not provide a correct TIN, you may have to apply backup withholding at 24% (IRS, June 28, 2026). Flag 1099 vendors in the vendor master at setup, not in January.

Segregation of duties across the cycle

The US Government Accountability Office’s internal control standards state that “segregation of duties helps prevent fraud, waste, and abuse in the entity” (GAO Green Book, May 2025). The Green Book is written for government, but the principle applies equally to private companies. Prevent these combinations in system roles:

  • Creating or editing vendors and entering or approving invoices for them.
  • Issuing POs and posting receipts against the same POs.
  • Entering invoices and releasing payments.
  • Changing vendor bank details and approving payment runs.

Where a small team cannot separate all four, add a compensating control, such as a monthly controller review of the vendor master change log. Our guide to accounting software for internal controls covers role-based permissions in more detail.

Metrics to track

  • PO compliance: the share of spend covered by a PO issued before the invoice.
  • First-pass match rate: invoices that match without manual intervention.
  • Exception rate by cause: price, quantity, missing receipt or no PO.
  • Invoice cycle time: days from invoice receipt to payment. APQC reports a median of 15.0 days from receipt of invoice until payment is transmitted, across 2,226 organizations (APQC, no date shown). Ardent Partners’ State of ePayables 2025, summarized by AP software vendor Medius, reports average invoice processing of 8.2 days against 2.9 days with advanced automation (Medius, no date shown).
  • Received-not-invoiced aging at 30, 60 and 90 days.
  • Early-payment discounts captured versus available.

The two benchmarks measure different spans, so track your own trend rather than chase one external number. Our AP and AR KPI guide covers how to put these on a dashboard.

How software supports each stage

ERP purchasing and payables modules cover all seven stages in one ledger. NetSuite and Dynamics 365 handle requisitions, POs, receipts, matching and the receipt accrual natively, as cited above. Their usual gaps are invoice capture and the requester experience.

Enterprise P2P suites such as Coupa and SAP Ariba sit in front of the ERP. Coupa covers guided requisition intake, mobile approvals, three-way matching and a supplier portal, and does not publish pricing (Coupa, no date shown). They suit companies with many requesters and large indirect spend, at the cost of an integration to maintain.

Mid-market procurement tools cover stages 1 to 5. Precoro’s Core plan starts at $499 per month billed yearly and includes requisitions, POs, receipts and three-way matching (Precoro, no date shown, checked October 8, 2026). Ramp sells procurement as an add-on to its Plus or Enterprise plans and does not list a separate price for it (Ramp, no date shown, checked October 8, 2026).

AP automation platforms such as Tipalti cover stages 4 to 6, with two- and three-way matching and tolerances by amount or percentage (Tipalti, July 22, 2026). They rely on accurate POs and receipts, so they do not fix weak receiving. Banks supply the final stage 6 control through positive pay, fed by an issued-check file your system should export after each run.

How we researched this

We read the top-ranking pages for this term, mostly procurement software vendor blogs. They describe the steps but say little about accruals, 1099 and vendor master controls, payment fraud rules or control ownership, so we drew on IRS, Nacha, GAO, FBI and AFP sources and vendor documentation. Each claim links to its source with the date shown. No vendor paid for inclusion.

Related guides

Frequently asked questions

What are the main steps in the procure-to-pay process?

The core steps are requisition, purchase order, receipt, invoice, match and payment. Most finance teams add a seventh step for period-end accruals of goods received but not invoiced and for 1099 reporting. Each step creates a record the next step checks.

What is the difference between procure-to-pay and accounts payable?

Accounts payable covers invoice capture, matching and payment. Procure-to-pay starts earlier, with the requisition and purchase order, so it controls spending before the company is committed.

Does every purchase need a purchase order?

No. Most companies exempt recurring items such as rent, utilities and some subscriptions, and use cards for small purchases. Write the exemptions down and keep the list short, because every exemption is spend that skips the approval and match controls.

What are the key internal controls in procure-to-pay?

The main controls are approval limits on requisitions and POs, an approved vendor master with verified TINs and bank details, independent receiving, duplicate invoice checks, matching within set tolerances, dual approval of payment runs and positive pay. Segregation of duties between vendor setup, purchasing, receiving and payment ties them together.

Sources

Sherman Hsieh

CEO & Editor-in-Chief, Business-Software.com
Independent analysis of enterprise software — ERP, CRM and more
Sherman Hsieh is the founder, CEO, and editor-in-chief of Business-Software.com. He leads the site's independent, buyer-focused coverage of ERP, CRM, and other business systems, including vendor-neutral comparisons, pricing analysis, and implementation guidance. Before founding Business-Software.com, Sherman was an executive at Siebel ...

Users Who Read This Article Also Read