The expenditure cycle

The expenditure cycle covers acquiring and paying for the goods and services an organization needs: identifying the need, choosing a supplier, ordering, receiving, approving the supplier's invoice and paying it. Practitioners call it procure-to-pay (P2P) or purchase-to-pay. For a distributor like Ridgeback, the largest part of the cycle is buying inventory from manufacturers, but the same process handles freight, rent, software subscriptions, professional services and office supplies. The expenditure cycle is where most cash leaves an organization, which makes it the main target for both errors, such as duplicate payments, and fraud, such as fictitious suppliers and payment diversion.

CON-330 looked at procurement from a construction contractor's point of view, with subcontracts, long-lead items and buyout. This lesson takes the accounting systems view: what records the AIS keeps, how the ERP enforces the process, and which controls stop the organization paying for things it did not order, did not receive or does not owe.

Activities and documents

The cycle has four main activities. Requisitioning identifies a need: the inventory system flags items below their reorder point, or an employee submits a purchase requisition. Purchasing selects a supplier and issues a purchase order (PO), a legally significant document stating the items, quantities, prices and terms. Receiving accepts the goods, counts and inspects them and records a receiving report (or goods receipt) in the ERP. Accounts payable receives the supplier's invoice, matches it to the PO and the receipt, records the liability and schedules payment. Treasury or the payments team then releases payment by electronic funds transfer, card or check.

The approved supplier master

Every payment goes to a supplier record, so control over the supplier master file is the foundation of the cycle. Creating a supplier should require documentation: legal name, address, tax registration number, banking details and the business reason. A person in a role separate from purchasing and accounts payable creates and changes supplier records, and every change is logged. The most dangerous change is to bank details, because a fraudster who changes them can redirect payments without creating any fake invoice. Lesson 11 covers the call-back verification procedure that defends against that scheme.

Fictitious supplier fraud works the other way: an employee creates a supplier record for a company they control, then submits invoices for goods or services that were never provided. Red flags include suppliers with no tax number, a post office box or the same address or bank account as an employee, invoices just below approval thresholds, and suppliers that appear suddenly and receive round-sum payments. Matching the supplier master against the employee master on address and bank account is a simple, effective data test.

The three-way match

The central control in accounts payable is the three-way match: before an invoice is approved for payment, the ERP compares it with the purchase order (what was ordered and at what price) and the goods receipt (what actually arrived). Quantities invoiced should not exceed quantities received, and prices should agree with the PO within a small tolerance. Invoices that match post automatically; exceptions go to a buyer or AP clerk to resolve with the supplier. For services, where nothing is physically received, a two-way match between invoice and PO plus an approval by the budget owner replaces the receipt.

# Ridgeback: three-way match with tolerances (illustrative)
PRICE_TOL = 0.02     # 2% price tolerance
po = {"PO-7731": {"supplier": "Northwind Textiles", "lines": {"SB-20": (400, 52.00), "SB-35": (200, 61.50)}},
      "PO-7735": {"supplier": "Alpine Buckle Co", "lines": {"BK-01": (5000, 0.84)}}}
received = {"PO-7731": {"SB-20": 400, "SB-35": 180}, "PO-7735": {"BK-01": 5000}}
invoices = [("NW-90412", "PO-7731", "Northwind Textiles", {"SB-20": (400, 52.00), "SB-35": (200, 61.50)}),
            ("AB-3310", "PO-7735", "Alpine Buckle Co", {"BK-01": (5000, 0.87)}),
            ("AB-3311", "PO-7735", "Alpine Buckle Co", {"BK-01": (5000, 0.85)})]

for inv_no, po_no, supplier, lines in invoices:
    issues = []
    order = po[po_no]
    if supplier != order["supplier"]:
        issues.append("supplier differs from PO")
    for item, (qty, price) in lines.items():
        ordered_qty, po_price = order["lines"][item]
        got = received[po_no].get(item, 0)
        if qty > got:
            issues.append(f"{item}: invoiced {qty}, received {got}")
        if abs(price - po_price) / po_price > PRICE_TOL:
            issues.append(f"{item}: price {price:.2f} vs PO {po_price:.2f}")
        received[po_no][item] = got - min(qty, got)   # consume matched quantity
    total = sum(q * p for q, p in lines.values())
    print(f"{inv_no} {total:>10,.2f}  " + ("MATCHED - schedule payment" if not issues else "EXCEPTION: " + "; ".join(issues)))

NW-90412  33,100.00  EXCEPTION: SB-35: invoiced 200, received 180
AB-3310   4,350.00  EXCEPTION: BK-01: price 0.87 vs PO 0.84
AB-3311   4,250.00  EXCEPTION: BK-01: invoiced 5000, received 0

The output shows three typical results. The Northwind invoice bills 200 units of SB-35 but only 180 were received, so it is held until the remaining 20 arrive or the supplier issues a credit. The first Alpine invoice is about 3.6 percent above the PO price, outside the 2 percent tolerance, so the buyer must approve the higher price or ask for a correction. The second Alpine invoice is a second bill for the same 5,000 buckles; because the matched quantity was consumed by the first invoice, the receipt no longer supports it. That consumption logic is what makes the match an effective duplicate-payment control, and it is worth testing whenever the match is configured.

Payments

Payment runs group approved invoices due for payment, generate a bank file and produce remittance advices for suppliers. Controls at this stage include approval of the payment run by someone other than the AP clerk who processed the invoices, a review of the payment register for unusual suppliers, amounts or bank accounts, and secure transmission of the bank file so that it cannot be altered between the ERP and the bank. Many banks offer positive pay: the company sends the bank a list of checks or payments issued, and the bank pays only items that match. Payment runs should be compared with the bank's confirmations, and the bank account reconciled daily or at least monthly.

Organizations also look for early-payment discounts. Terms of 2/10, net 30 mean the supplier allows a 2 percent discount if the invoice is paid within 10 days rather than 30. Skipping the discount is equivalent to borrowing for 20 days at an annual rate of about 2/98 × 365/20 ≈ 37 percent, which is far more expensive than most credit lines. AP systems can flag discount invoices and schedule them to pay on day 10, and a monthly report of discounts lost is a useful measure of AP performance.

Automating accounts payable

Many organizations now automate large parts of accounts payable. Invoices arrive as electronic documents through a supplier portal or e-invoicing network, or as PDFs read by optical character recognition (OCR) and machine-learning extraction tools. The extracted data is validated against the supplier master and the PO, matched automatically, and routed for approval only when an exception occurs. Some organizations go further with evaluated receipt settlement (ERS), in which there is no supplier invoice at all: the buyer pays based on the PO price and the quantity received, and sends the supplier a self-billed statement. ERS removes invoice processing but makes the accuracy of PO prices and goods receipts even more important, so it is used mainly with trusted, high-volume suppliers.

Automation changes the control focus rather than removing it. When thousands of invoices post without human review, the controls that matter most are the configuration of the matching rules and tolerances, the accuracy of the supplier and price master data, the security of the supplier portal, and the monitoring of exceptions and overrides. An AP clerk who can override a failed match without approval undoes the benefit of the control. Lesson 9 explains how auditors test automated controls of this kind, and lesson 12 returns to OCR and AI tools.

Accounts payable analytics

Data analytics complements the preventive controls. Useful AP tests include duplicate payments (lesson 4), invoices just below approval limits, invoices dated on weekends or holidays, suppliers created and paid within a few days, payments to suppliers with no purchase orders, round-sum invoices, sequential invoice numbers from one supplier (which may mean the organization is that supplier's only customer), and Benford's law on invoice amounts. None of these proves an error or fraud, but together they direct attention to a small number of transactions worth examining. Running them every month, rather than once a year, turns them into a continuous monitoring control.

Corporate cards and expense reports

Low-value purchases are often handled with purchasing cards (p-cards) and employee expense reports rather than full POs, because the cost of processing a PO for a $40 item exceeds its value. The control focus shifts to card limits, merchant category blocks (for example, no casinos or cash advances), monthly review of card statements by the cardholder's manager, receipts for every transaction and data analytics on card spending, such as split transactions just under the single-purchase limit or purchases on weekends. Expense report systems apply policy rules automatically, such as per diem limits and receipt requirements above a set amount.

In the United States, businesses must collect a Form W-9 with the taxpayer identification number of each domestic supplier they may need to report, and issue Forms 1099-NEC or 1099-MISC for reportable payments. The supplier master should capture W-9 status, and missing taxpayer identification numbers both create backup withholding obligations and can signal a fictitious supplier.