Three-way match exceptions that auditors should not wave through
Exception queues exist for a reason. These patterns deserve extra attention in a financial audit of invoice processing applications.
Three-way match — purchase order, goods receipt, and invoice — looks robust until the exception queue becomes a parking lot. In financial audits of invoice processing applications, we watch for patterns that management has normalized:
- Repeated price variances with the same vendor and no updated PO
- Quantity mismatches cleared by the same user who created the receipt
- “Match override” rights held by staff who also prepare payment runs
- Aging exceptions that clear in bulk on the last day of the period
None of these patterns prove misstatement by themselves. Together, they show where the application’s control story and the financial reporting story diverge. A remediation follow-up after fixing override rights is often where clients see whether the queue truly shrank — or merely moved.