Three-Way Match

Three-way match is a procurement control that compares the purchase order, invoice, and receipt before payment is approved. It helps prevent overpayment, fraud, and unauthorized spending by requiring all three records to align. In ERP systems, it is a standard control for purchase-to-pay governance and audit assurance.

Expanded Definition

Three-way match is a purchase-to-pay control that verifies the purchase order, invoice, and receipt all agree before payment is released. In NHI and agentic environments, the same control logic is often applied to NIST Cybersecurity Framework 2.0 governance over automated spend, where software agents can trigger procurement, consume cloud resources, or provision services with financial impact.

Definitions vary across vendors on how strictly the match must be enforced. Some ERP workflows allow small tolerance thresholds for price or quantity variance, while others require exact alignment and manual exception handling. The important distinction is that three-way match is not just an accounting check. It is a fraud and authorization control that confirms the order was approved, the goods or services were actually received, and the invoice reflects what was contracted. In agentic systems, this also helps ensure an AI agent is not acting outside procurement policy or paying for unreceived items. The most common misapplication is treating invoice approval as proof of receipt, which occurs when organisations bypass receiving evidence and allow payment based on a purchase order alone.

Examples and Use Cases

Implementing three-way match rigorously often introduces process latency, requiring organisations to weigh faster payment cycles against stronger spend assurance.

• A cloud operations team uses an AI purchasing agent to renew infrastructure licenses only after the purchase order, vendor invoice, and asset receipt all reconcile.
• A finance team blocks payment when an invoice lists 500 units but the receiving record shows 450, forcing review before overpayment occurs.
• A procurement workflow validates that a contractor service invoice matches the approved statement of work and the completion sign-off captured in the ERP.
• An internal audit team samples exceptions to verify that manual overrides are documented and that payment authority was not granted to an unapproved agent.

In NHI governance, three-way match becomes relevant when Ultimate Guide to NHIs shows that 79% of organisations have experienced secrets leaks and 97% of NHIs carry excessive privileges, both of which can magnify financial abuse when automated systems can spend or renew services without strong controls. The control also aligns operationally with the identity assurance mindset in NIST Cybersecurity Framework 2.0 because it creates evidence before commitment is finalized. In practice, the term is often used in ERP reconciliation, but its security value grows when machine identities and AI agents are allowed to initiate procurement actions.

Why It Matters in NHI Security

Three-way match matters because autonomous systems can create spend and supply-chain risk faster than human review can catch it. When an AI agent or service account can trigger purchase workflows, weak matching controls can lead to duplicate payments, phantom vendors, misdirected renewals, and policy bypass. That is a governance problem as much as a financial one, because the same identity that can access tools can also indirectly authorize money movement. The control therefore supports least privilege by making payment contingent on independent evidence rather than on a single actor’s assertion.

NHIMG research shows that 96% of organisations store secrets outside secrets managers in vulnerable locations, which underscores how easily automation can be abused when surrounding controls are weak. For NHI programs, the lesson is that procurement evidence should be treated as part of the trust boundary around agent actions, especially where secrets, API keys, or service accounts can initiate vendor transactions. Organisations typically encounter the real impact only after a disputed payment, unauthorized renewal, or audit finding exposes that automated purchasing had no effective evidence check, at which point three-way match becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• What are the three elements of a non-human identity?
• Why do non-human identities change the way IAM teams should think about risk?
• Why do NHIs change the way threat intelligence should be evaluated?
• Why do infostealers change the way IAM teams think about cloud security?