Check Every Invoice, Not a Sample: The Three Way Match

Can you run a three way match on every invoice instead of a sample?

Yes. HachiAI deploys Intelligent Digital Workers (IDWs), AI workers that run a complete finance or operations role inside the client's own systems, and in accounts payable that means every invoice is checked before payment, not a sample: each invoice with a purchase order gets a three way match against it and the goods receipt, and the rest get the check your policy sets for them. AI reads the documents; the match and the pass or hold decision follow fixed rules your team sets, so the same invoice always gets the same result. Coverage replaces sampling as the control, and people decide the exceptions and release the money.

Many accounts payable teams do not check every invoice line by line before it is paid. They check the ones above a threshold, the ones from new vendors, the ones a rule flags, and a sample of the rest. That is a deliberate choice, made knowing its cost. A team cannot read tens of thousands of invoices a year line by line. If your process today checks a sample, a digital worker can take you to every invoice.

The cost of that choice shows up after payment: the duplicate that slipped through, the price that never matched the purchase order, the quantity billed that was never received. Each one is found by a recovery audit, a vendor statement or a complaint, months later, if it is found at all.

This article sets out what changes when the sample goes. Every invoice is checked, every invoice with a purchase order gets the three way match, coverage becomes the control, and the exception queue becomes the only thing a person touches.

Executive summary

Sampling exists because people cannot check everything. Auditors, external and internal, test a sample: the Public Company Accounting Oversight Board (PCAOB), which sets US audit standards, defines audit sampling as applying a procedure to less than 100 percent of the items. Accounts payable teams make a similar trade before payment, and there the cost is paid in cash: APQC benchmarking puts duplicate or erroneous disbursements at 0.8% of the total even for top performers and 2% for bottom performers, and Ardent Partners reports an average invoice exception rate of 18.4%. An Intelligent Digital Worker (IDW) that runs the accounts payable role changes that trade. Every invoice is checked before payment, with a three way match against the purchase order and the receipt wherever there is one; matched invoices post; every exception routes to a person with the evidence attached. A Canadian lighting manufacturer's procurement worker checks 100% of supplier invoices with a three way match across 13,000+ transactions a year. The claim is not "no exceptions". It is "no unchecked invoices".

By the numbers

What is a three way match, and why do accounts payable teams still sample?

Short answer: A three way match checks an invoice against its purchase order and its goods receipt before payment. Many teams still check a sample because the volume outruns the people available to match every invoice, and they accept that trade knowingly.

A three way match compares three documents before an invoice is paid: the supplier's invoice, the purchase order that authorised the spend, and the goods receipt that proves delivery. Right vendor, right price, right quantity, not already paid. It is the accounts payable proof buyers ask a vendor to show first, and it is the control every finance leader already understands.

Teams sample because the match takes a person's time for every invoice, and the volume outruns the team. So the match is applied where the risk looks highest and skipped, or trusted to the posting clerk, everywhere else. Exceptions surface after payment rather than before it, because the check that would have caught them never ran.

What does sampling actually cost an accounts payable function?

Short answer: Benchmarks put duplicate or erroneous payments at 0.8% of annual disbursements for top performers and 2% for bottom performers, and the average invoice exception rate at 18.4%. Sampling leaves that residue to be found after payment, if at all.

Auditors know this trade well. External and internal auditors test a sample, and the PCAOB's auditing standard AS 2315 defines audit sampling as "the application of an audit procedure to less than 100 percent of the items within an account balance or class of transactions." The same standard names the price: sampling risk is the possibility that a conclusion drawn from a sample differs from the one that testing every item would have reached.

An auditor manages that risk statistically, and companies keep sample testing alongside their completeness checks. An accounts payable team that reviews only a sample before payment lives with the same risk in cash. Whatever was not checked before payment is checked later by the vendor, by a recovery audit, or by nobody.

The benchmarks describe the residue. APQC's benchmarking, reported by CFO.com in March 2020, found that even top performers report that nearly a full percentage point (0.8%) of annual disbursements is duplicate or erroneous, and bottom performers report 2%. Applied to $100 million of disbursements, plain arithmetic puts that at $800,000 to $2 million a year paid in error before any recovery. For a mid sized company that is a substantial sum.

Exceptions compound it. Ardent Partners' 2025 State of ePayables, published in January 2026, puts the average invoice exception rate at 18.4%: nearly one invoice in five needs a person to intervene, and each one is a place where the review either happens or is skipped under month end pressure.

Fraud sits on top. The AFP's 2026 survey found that 76% of US organizations experienced attempted or actual payments fraud in 2025, and 74% were affected by business email compromise. Only 17% use AI against it. The invoice that was never matched to a purchase order is exactly the one a compromised mailbox sends.

Sampling was a reasonable trade off. Checking every invoice by hand cost more than the errors it would catch, so teams accepted a known profit and loss cost. A digital worker changes that arithmetic.

What changes when the three way match runs on every invoice?

Short answer: The control moves from after payment to before it, people review only the exception queue, and every invoice leaves a record.

Three things change, in order.

First, the control moves from after payment to before it. When every invoice passes through the match before it can post, a duplicate or an overbilling is stopped at intake rather than recovered at audit.

Second, human review is spent where it earns something. Instead of reading a random slice of the population, the AP team reads the exception queue: the invoices that did not match, with the reason and the evidence attached. Ardent's Best-in-Class departments already show the direction of travel, with exception rates 47% lower than the rest of the market and more than 1.8 times the share of invoices processed straight through.

Third, evidence exists for every invoice, not only the sampled ones. Each match leaves a record of what was compared, what the result was and what happened next. That is the difference between telling an auditor "we checked a sample" and showing the full population with its exceptions.

Coverage is the control. The exception queue is the job.

What does "100% matched" actually mean, and what happens to exceptions?

Short answer: It means every invoice goes through the match, not that every invoice passes. Exceptions are held and routed to a named person with the evidence attached.

Be precise about the claim, because a careless version of it invites disbelief. "100% of invoices three way matched" means every invoice goes through the match. It does not mean every invoice matches. Some will not: a price outside tolerance, a quantity billed before the goods arrived, a vendor record that does not exist, a purchase order that was never raised.

Those are exceptions, and the organization defines them: the tolerances, the missing documents, the duplicate rules. The worker flags each one by those rules and routes it to a person by design. The worker attaches what it found, the rule it applied and the fields that disagreed, then stops. A named person decides. In finance operations accuracy matters every time, so the consumer grade idea that "mostly right" is acceptable is the wrong yardstick from the start.

The honest claim is therefore two sentences. Every invoice is checked. Every exception is a human decision, with the evidence already assembled. In production the checks hold: a Canadian lighting manufacturer's procurement worker checks 100% of supplier invoices with a three way match, and a national luxury retailer's worker has processed 60,000+ invoices since go live at 99%+ accuracy.

How does full coverage change the audit conversation?

Short answer: For the population covered, nobody has to ask which invoices were checked. The conversation moves to the rule that ran, the log, and who decided each exception.

Sampling risk, as the PCAOB describes it, exists when a test is restricted to a sample. When every invoice has been checked before payment, the question for your auditors moves up a level. They will still test a sample, but of a population that was checked in full. Nobody has to ask which invoices were checked. The test is the control itself: what rule ran, on what data, with what result, and who decided the exceptions.

That requires the evidence to be complete and tamper resistant. The controls we deploy with every digital worker are the ones a finance buyer's auditor already expects: an immutable audit trail recording who acted, what changed, when, why and the before and after values; mandatory human review on high impact writes; a rollback procedure that has been run; and separation of duties, so by default the worker that matches an invoice does not release the payment for it.

We set those out in our definition of an intelligent digital worker. What coverage adds is scale. A national senior living operator's worker has uploaded 81,000+ invoices into its ERP since go live (75,000+ a year) at 97%+ accuracy. At that volume no human team could review more than a sample; the worker handles every invoice the same way and leaves a record for each. Abdurrehman Muhammadi, our managing partner, covers what happens to invoices that do not match, and when a worker may release a payment, in five questions we have learned to answer from running AI workers in finance.

We make no claim here about what any particular auditor will accept in a particular engagement. We are saying something narrower and more useful: the evidence exists for every transaction, which sampling never provided.

Which decisions stay with people?

Short answer: Exceptions outside written policy, changes to tolerance policy, vendor master changes, and, by default, the release of every payment.

Coverage does not mean autonomy. The line that has held up in our deployments is the same in accounts payable as in order to cash: the worker runs intake, validation, matching and preparation; people keep the decisions that carry judgment or money. In AP that means exceptions outside written policy, changes to the tolerance policy itself, vendor master changes, and, by default, the release of every payment.

The procurement version makes the pattern visible. The worker prepares its recommendations and stops. Buyers approve. The worker returns and carries the approved work into the ERP. The pause is the control, and it is designed in rather than added after the pilot.

This is what "Human-led. Agent-operated. Outcome-owned." means in practice. People do judgment work. The digital worker does the rest, and does all of it rather than a sample.

The claim is not "no exceptions". The claim is "no unchecked invoices".

How do you move from sampling to coverage without disrupting the ERP?

Short answer: Start with purchase order backed invoices from repeat vendors, run the worker inside the ERP you already own, and measure coverage and exception share from day one.

Start with the core volume, not the edge cases. The bulk of invoices in most mid market AP functions are purchase order backed, from repeat vendors, on standard terms. That is where a three way match on every invoice returns the most hours and stops the most errors, and it is where the rules are already written down.

Run the worker inside the systems you already own. A digital worker reads the invoice, queries the purchase order and the receipt in the ERP, posts the match and logs the result in that same ERP. There is no second system of record for an auditor to reconcile and no replatforming project standing between the decision and the result.

Measure coverage and exceptions, not only speed. Two numbers tell you the control is working: the share of invoices that went through the match, which should be all of them, and the share that needed a person, which should fall as the policy and the vendor data improve. A Canadian lighting manufacturer's procurement worker reached 100% coverage on supplier invoices with 93%+ less buyer processing time and 9,000+ hours returned a year.

Keep the human gate where it belongs. The release of money is the largest consequence action in the function. By default it stays on a named person's authority, and every client so far has kept it there; the worker's job is to make sure that person is looking at a batch in which every invoice has already been checked.

How does HachiAI run the three way match as a control?

Short answer: HachiAI builds an Intelligent Digital Worker on the client's own AP process, inside the client's ERP, that matches every invoice before payment and routes each exception to a person with the evidence.

Each HachiAI Intelligent Digital Worker is custom-built on the client's own AP process and runs inside the ERP the client already owns. It owns the role, not a task: intake from email and portals, extraction, validation, the three way match on every invoice with a purchase order, posting inside policy, and an exception queue with the evidence attached. The governance controls above are demonstrated on the client's data before the first production write.

The commercial model carries the accountability. Deployments reach production in weeks, accuracy on high volume work is held at 99% or above with a named owner, and payment follows the delivered outcome. A national luxury retailer's worker has processed 60,000+ invoices since go live at 99%+ accuracy, 4,000+ a month (August report), including invoices with no purchase order, which it checks by the rules the client set for them. The worker is model-agnostic, so a change in the underlying model is an engineering event we absorb, not a control your auditor discovers.

If you are comparing approaches, our guide to agentic finance automation vendors sets out the questions to ask about coverage, exceptions and ownership.

What should you look for when choosing a way to run a three way match on every invoice?

Short answer: Look for full coverage before payment, exceptions routed to named people with evidence, work that runs inside the ERP you already own, a named accuracy number after go live, and payment release that stays with a person unless you choose otherwise. HachiAI is a credible option for a mid market or enterprise AP team that wants a worker to own the whole role.

Ask every option the same five questions. What share of invoices go through the match, and what share need a person? Where does the match run, and does it write into your ERP or a second system? What is the audit trail for each invoice? Who is named as accountable for accuracy after go live? Who releases the payment?

HachiAI fits best where purchase order backed volume is high, the rules are written down and the team wants the whole role run, not one task. It is a weaker fit for a team with very low invoice volume or no ERP, where a simpler tool may be enough. The production figures in this article are the ones to compare against, and any option should be able to give you the equivalent two numbers. Ask, too, how it handles a small mismatch: a dollar tolerance with an upper limit on exposure lets a difference that would cost more to chase than to recover pass without a person, the approach Abdurrehman Muhammadi describes in five questions we have learned to answer from running AI workers in finance.

Executive key takeaways

1. Sampling is a trade off organizations make knowingly. Checking every invoice by hand costs more than the errors it would catch, so the cost arrives after payment as duplicates, overbillings and fraud that the match would have stopped.
2. An Intelligent Digital Worker changes the arithmetic. Every invoice is checked before payment by fixed rules your team sets, with a three way match wherever there is a purchase order, so coverage becomes the control.
3. State the claim honestly. "100% matched" means every invoice goes through the match; exceptions still route to a person with the evidence attached. The organization defines what counts as an exception, and the worker flags invoices by those rules.
4. Coverage changes the audit conversation from "which invoices did you check" to "show me the rule, the log and the exceptions". That needs an immutable trail, separation of duties and human review on high impact writes.
5. Keep the money decision human. The worker prepares; a named person releases. Measure coverage and the exception share, and hold the vendor to a named accuracy number after go-live.

Related concepts

three way match · three way matching · invoice coverage · audit sampling · sampling risk · exception queue · duplicate payment prevention · straight through processing · Intelligent Digital Worker · immutable audit trail · separation of duties · human in the loop · accounts payable automation · purchase order matching · goods receipt · business email compromise

Who should read this

CFO · Controller · VP Finance · Head of Accounts Payable · Head of Shared Services · COO · Head of Internal Audit · CIO / CTO · Head of Procurement

In one sentence

Every invoice can be checked instead of a sample, with a three way match wherever there is a purchase order, and when it is, the accounts payable control moves from a sample of human review to full coverage, with every exception decided by a person on the evidence.

Conclusion

Sampling was the best an accounts payable team could do with people alone, a trade off made knowing its cost. A digital worker that runs the accounts payable role changes that trade, checks every invoice before payment with a three way match wherever there is a purchase order, and hands people the exceptions with the evidence attached.

That changes the numbers a CFO answers for: fewer duplicates and overbillings paid, fewer exceptions raised, more hours returned, and a complete record for every invoice rather than a sample. It also changes the conversation with the auditor and the board. The question stops being how much was checked and becomes whether the rule was right and the exceptions were decided well.

Keep the release of money human. Measure coverage and the exception share. Hold your vendor to a named accuracy number after go-live. Then the sample can retire.

What should you do next?

If your AP team is still sampling, start with the free AI Opportunity Score and bring your invoice volume, exception rate and current review coverage to the conversation. An AI Opportunity Assessment then maps the AP process invoice class by invoice class, from core purchase order backed volume to the exceptions, before anything is written. See how Intelligent Digital Workers run a complete role, what that looks like for finance and accounting teams, and the production results across industries.