Three way matching means a supplier invoice is approved for payment only when it agrees with an authorised purchase order and with a goods received note confirming what actually arrived. HMRC’s VAT compliance guidance describes the match between purchase order and invoice, or a three way match that also includes the goods received note, as a key accounts payable control. It stops a business paying for goods it did not order or did not receive, paying the same invoice twice, or paying a fraudster.

What are the three documents, and what does each one prove?

Document Created by What it proves
Purchase order (PO) The buyer, after an approved requisition Someone with authority agreed to buy this item, in this quantity, at this price, from this supplier
Goods received note (GRN) or delivery note The person receiving the goods The goods physically arrived, in the stated quantity and condition
Supplier invoice The supplier What the supplier is asking to be paid, and the VAT charged

Each document comes from a different person. That is the point: no single person can create a liability, confirm it and approve payment of it alone. HMRC’s Guidelines for Compliance on VAT controls (GfC8) say that purchase orders should be raised only for approved requisitions and created before the supplies are received and the invoice is processed, and that a GRN is an internal document verifying the goods are in order or recording discrepancies.

How does the match work, step by step?

  1. Raise the PO. An approved requisition becomes a PO with item, quantity, price and supplier.
  2. Receive the goods. Stores or the requester records a GRN against the PO, noting shortages or damage.
  3. Receive the invoice. Accounts payable registers it once, checks it is a valid VAT invoice and checks it is not a duplicate.
  4. Match. Compare supplier, item, quantity and unit price across all three. Quantity invoiced should not exceed quantity received; price should not exceed the PO price.
  5. Resolve differences. Small differences inside a set tolerance can pass; anything else goes back to the buyer or supplier, usually for a credit note or corrected invoice.
  6. Approve and pay. Only matched invoices are released to the payment run.

GfC8 says that in larger businesses using integrated systems, manual overrides of system determined values should be subject to tolerance limits and approval controls, and that changes to POs or GRNs after receipt or invoicing should be blocked or tracked. Allowing staff to edit a PO to fit the invoice defeats the control.

What does the match catch?

  • Overcharging. A unit price above the agreed PO price.
  • Short delivery. Billing for 200 units when 180 arrived.
  • Duplicates. GfC8 lists, as a control point, that an invoice is recorded only once. Matching consumes the GRN, so a second invoice for the same delivery has nothing to match against.
  • Fake invoices. An ICAEW article on invoice fraud lists mismatches between invoices, purchase orders, delivery notes or contract terms, including price, quantity or VAT treatment, as warning signs, and describes three way matching, duplicate checks and limits on manual overrides as standard preventive checks.
  • VAT errors. HMRC expects input tax to be supported by the required evidence and invoices to meet the invoicing rules in Part 3 of the VAT Regulations 1995. VAT Notice 700 says a VAT invoice is the evidence for claiming input tax, and an invoice marked pro forma cannot be used.

What about services, utilities and purchases without a PO?

Not everything fits the model. GfC8 notes that businesses often set a spending limit below which no PO is needed, and that recurring items such as professional fees, utilities and building leases are often processed without one. For these, HMRC describes matching the invoice to the contract terms instead. Services have no delivery note, so the equivalent of the GRN is a confirmation from the budget holder that the work was done, recorded before the invoice is approved. Where only the PO and invoice can be compared, the result is a two way match, which still checks price and supplier but not receipt.

Who should approve what?

The strength of the process comes from separating duties. The ICAEW article recommends clear separation between who sets up suppliers, who approves invoices and who makes payments. GOV.UK fraud awareness guidance makes the same point: no individual should have sole responsibility for something they could personally benefit from, and transactions needing only one approver are a risk indicator.

The supplier master file needs as much protection as the invoices. Invoice and mandate fraud usually involves someone posing as a genuine supplier and announcing new bank details, often with pressure to pay urgently. GOV.UK guidance is to check any change with the supplier using contact details you have reliably used before, never those in the message announcing the change, and to cross check supplier bank details regularly.

What does a worked example look like?

Illustration only. A business orders 200 cartons at £5.00 each, a PO value of £1,000 plus VAT. The GRN records 180 cartons received. The supplier’s invoice is for 200 cartons at £5.25, so £1,050 plus VAT of £210, a total of £1,260.

Check PO GRN Invoice Result
Quantity 200 180 200 20 cartons not received
Unit price £5.00 n/a £5.25 £0.25 above agreed price
Payable 180 × £5.00 = £900 plus VAT £180 £1,080

The invoice is put on hold and the supplier asked for a credit note for £150 plus £30 VAT, or a replacement invoice for £1,080. Without the match the business would have paid £180 more than it owed and reclaimed £30 of VAT it was not entitled to.

How does matching connect to the ledgers and the year end?

A matched invoice is posted to the purchase ledger, and the purchase ledger control account should agree to the list of supplier balances, as explained in sales and purchase ledger control accounts. GfC8 also suggests reconciling supplier statements. At the year end, GRNs with no matched invoice are the starting point for the goods received not invoiced accrual, and old unmatched GRNs often reveal goods that were returned or never billed.

The documents also form part of the company’s accounting records. Section 386 of the Companies Act 2006 requires records sufficient to show and explain the company’s transactions, and section 388 requires a private company to keep them for three years from the date they are made (six years for a public company). For VAT, Notice 700/21 says business records should generally be kept for at least six years.

What happens if approval is slow?

Holding invoices in a queue has costs beyond supplier goodwill. Under VAT Notice 700/18, a business must repay input tax it has claimed if it does not pay the supplier within six months of the relevant date, and suppliers are not required to tell you, so you have to monitor this yourself. Large companies also now report payment performance publicly: for financial years beginning on or after 1 January 2026, their directors’ report must show average days to pay and the share of payments made late against agreed terms, as set out in what goes in a directors’ report.

What mistakes come up most often?

  • Raising the PO after the invoice arrives, so the PO simply copies the invoice.
  • Letting the same person raise POs, record GRNs and approve invoices.
  • Setting tolerances so wide that overcharges pass automatically.
  • Accepting a bank detail change by email without calling the supplier on a known number.
  • Reclaiming VAT on a pro forma or on a statement instead of a valid VAT invoice.
  • Never clearing old unmatched GRNs and invoices, which hides duplicates and errors.

Solar Protect provides tax investigation insurance for businesses and fee protection schemes for accountancy practices. Read how our cover works or get a quote.

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.