2-Way vs 3-Way PO Matching: Which One Does Your Business Actually Need?

If you are wondering how to set up your purchase order matching, keep in mind, most businesses don't need to pick one type of matching over the other. They need to know which spend gets which control. This post covers what each type of PO matching means, when to use which, and what the data says about why it matters.

The Definitions

Two-way PO matching: invoice vs. purchase order. If quantity and cost fall within tolerance, it clears. No receipt needed.

Three-way PO matching: invoice, PO, and goods receipt. The invoice has to match both the order and proof that delivery actually happened.

Three-way matching makes sense when there's a physical delivery to confirm. It gets harder to apply when there isn't one.

Where the Standard Advice Breaks Down

Three-way matching assumes something can be received: a warehouse checking off a quantity against an order.

That doesn't work well for:

• Consulting and professional services
• Software subscriptions
• Staffing and contract labor
• Retainers and ongoing service contracts

There's no dock, no item count, nothing to physically receive. When businesses force three-way matching here anyway, someone typically ends up "receiving" the service just to make the match clear. That adds a manual step, creates a bottleneck when that person is unavailable, and often isn't a real control at all, just a checkbox logged because the invoice needs to move.

When Two-Way Matching Is the Right Call

• The spend is tied to a defined contract or PO with agreed rates
• The vendor has payment history and predictable billing
• Volume is high, and attention should go to exceptions, not every transaction

When Three-Way Matching Still Applies

• Physical goods and equipment — inventory, hardware, supplies
• Unit-billed labor — staffing billed hourly against tracked utilization
• Milestone-based contracts — payment tied to a deliverable that requires formal acceptance
• High-value or first-time vendors — regardless of category

What the Data Says

This isn't just a process question. It's a risk question.

• The ACFE's 2024 Report to the Nations, based on nearly 2,000 fraud cases across 138 countries, found that organizations lose about 5% of revenue to fraud each year. Most cases involved asset misappropriation, the category that covers fraudulent billing and purchasing schemes. Over half traced back to missing or overridden internal controls, and organizations with anti-fraud controls in place saw lower losses and faster detection.
• The AFP's 2025 Payments Fraud and Control Survey found that 79% of organizations experienced attempted or actual payments fraud in 2024, a figure that's held near 80% for years.

Matching policy is one of the more direct levers a finance team has against that exposure. A receipt doesn't make fraud impossible, but it forces a second, independent check before money leaves the business, which is the kind of control the data above ties to lower losses.

The Takeaway

Most businesses don't need to pick one. They need to match the control to the spend: three-way where a receipt is real, two-way where the PO and vendor history already cover it, and tighter scrutiny wherever value, volume, or vendor risk is high. That's the mix that actually reduces risk instead of just shifting the paperwork.