A three-way match compares the purchase order, the goods receipt note and the supplier invoice. Where all three agree on quantity, price and party, the purchase is supported. Exceptions arise when one document is missing, when quantities or values disagree, or when the same invoice appears more than once. Most exceptions in a mid-market client are documentation gaps rather than misstatements.
Before you start: most clients have no GRN
Textbook purchase testing assumes purchase orders and goods receipt notes exist. In a large share of Indian mid-market clients they do not, or they exist only for inventory items and not for services and consumables. This is not a reason to abandon the procedure. It is a reason to decide, in advance and in writing, what evidence of receipt you will accept — a signed delivery challan, a gate entry register, a store record, or management confirmation — and to record that decision in the file.
The absence of a goods receipt is itself a finding worth recording, even when you conclude the purchase is genuine. It is a control observation, and it belongs in the report to management whether or not it changes the financial statements.
The exception taxonomy
| Exception | What it usually means | Escalate when |
|---|---|---|
| No goods receipt on file | Either the client does not raise GRNs for this category, or the document was not retained | The vendor is new, the amount is significant, or the pattern is confined to one approver |
| No purchase order | Purchases below an approval threshold, or a supplier on a running arrangement | The value exceeds the client's own approval threshold — that is a control override, not a paperwork gap |
| Duplicate invoice | Same invoice entered twice, often once from the original and once from a scanned copy | Always. Check whether it was also paid twice — a duplicate booking that was paid once is a control weakness; paid twice is a loss |
| Duplicate payment | The same amount paid twice to the same vendor against the same reference | Always. Confirm whether a recovery was made in the subsequent period before concluding |
| Price variance against the order | Rate revisions agreed after the order, or freight and incidentals added on invoice | The variance is one-directional across many vendors, or concentrated with one approver |
| Quantity variance | Short or excess delivery, or partial deliveries against one order | The variance favours the supplier consistently, or stock records do not reflect the difference |
| Invoice value does not agree to the ledger posting | Very often the tax component posted separately to a GST receivable account | The difference is not explained by tax. Recompute before treating it as an exception |
| Cut-off: invoice booked in the wrong period | Goods received before year end, invoice booked after — or the reverse | The aggregate across the population is material, or the pattern is one-sided at the year end |
| Round-sum values | Estimates, provisions, or service arrangements billed at a round figure | Repeated identical round amounts to one vendor with no supporting invoice |
| Just below an approval threshold | Coincidence, usually | Several purchases cluster just under the threshold with the same approver or vendor — consider whether one arrangement was split |
| Payment with no matching invoice | Advances to suppliers, or invoices booked in a later period | The advance is old and unadjusted, or the vendor does not appear in the master |
| Vendor not in the master, or master incomplete | One-off purchases entered against a generic ledger | The vendor has no PAN or GSTIN recorded and the amounts are significant |
How to decide what is worth pursuing
Three questions usually settle it. Is the amount material, individually or in aggregate with similar items? Does the exception indicate a control that is not operating, as opposed to a document that was not filed? And is there a pattern — one vendor, one approver, one month, one direction? A single unexplained item below materiality is a note in the file. The same item repeated forty times is a finding.
Record the exceptions you dismissed and why, not only the ones you pursued. A reviewer asking “did you look at this?” should find the answer in the file rather than in your memory.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Purchase & AP auditPurchase testing in statutory audit: procedures, samples and exceptionsAgreeing the population, choosing a sample basis that survives review, the procedures that address each assertion, and what to do with what they throw up.
- Purchase & AP auditPurchase invoice vouching: a practical approachWhat to examine on a purchase invoice, in what order, the tickmarks worth using, and how to record the test so a reviewer can tell what was checked without asking.
- Purchase & AP auditDuplicate invoice detection during auditWhy exact matching finds almost nothing, the six match rules that do work, and how to tell a duplicate booking from a duplicate payment.
- Purchase & AP auditCut-off testing for purchases: procedures and worked examplesWhich dates to compare, how terms of delivery decide the answer, how to size the window, and four worked examples including the two that are usually misjudged.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.