Requiring the matching of a purchase order (PO), receiving report, and invoice before payment is a robust control designed to prevent overpayment and other types of fraudulent activities related to vendor payments.
This control ensures that:
* The goods or services invoiced were actually ordered (verified by the purchase order).
* The goods or services were received (verified by the receiving report).
* The invoice amount matches the agreed-upon terms and quantities (verified by the invoice).
This three-way match process helps prevent discrepancies such as overpayments, duplicate payments, or payments for goods/services not received. By ensuring all three documents align, it mitigates the risk of fraud and errors in vendor payments.
References:
* The Institute of Internal Auditors (IIA) Standards and Practice Advisories.
* COSO Internal Control - Integrated Framework, specifically on control activities.
* "Internal Auditing: Assurance & Advisory Services" by IIA, Chapter on Procurement and Accounts Payable Controls.