Workflow automation for procurement: approvals and the three-way match

Workflow automation for procurement should start by finding spend that bypasses the process, then automating approvals and the three-way match (comparing the order, the receipt and the invoice). Speeding up approvals is the smaller half of the job. Many organisations cannot say what they buy, from whom, or on what terms, because spend outside the process is invisible. People go around the process when the compliant route is slower than the alternative.

Key takeaways

• Make the compliant purchasing route faster than the alternative, because policy cannot replace speed.
• Set approval thresholds by value and category, and check aggregation so split purchases cannot bypass them.
• Automate the three-way match but leave mismatch resolution to a person, with tolerances that are explicit and logged.
• Verify every supplier bank detail change through a channel that did not come from the request.
• Diarise contract notice periods, not renewal dates, and name an owner for each contract.

What we'll cover

• Maverick spend is the real problem
• Thresholds and who approves what
• The three-way match
• Building it with CodeWords
• Supplier data and onboarding
• What fraud looks for
• Contracts and renewals
• Reporting that changes behaviour
• Making the request easy for the requester
• Making it survive
• Limits worth knowing about
• What to build first
• Frequently asked questions

Maverick spend is the real problem

Maverick spend is purchasing outside the approved process, and it is the real problem because it is invisible. Invisible spend is unnegotiated, unconsolidated and often duplicated.

People go around the process because it is slow, not because they are careless.

The company card is the usual route. It turns a procurement question into an expense claim that nobody reviews commercially.

Duplicate suppliers accumulate, so the same service is bought three times at three prices.

Negotiating leverage is lost. Volume you cannot see is volume you cannot use.

Speed is the intervention. People use a compliant route that is faster than the alternative, and policy cannot substitute for that.

Thresholds and who approves what

Set approval thresholds by value and by category, because a routine purchase and an unusual one need different scrutiny at the same amount.

Approve by exception for low-value routine spend with an existing supplier. That covers most transactions.

Check for splitting. Two purchases just under a threshold must aggregate. An automation that does not check this has removed the control.

Give approvals a clock. An approval process with no deadline is the reason people stop using it.

Delegate for absence, or every approval stops when somebody takes leave.

Show approvers the difference, not the whole request. What is unusual about this request is what they should read.

The three-way match

The three-way match compares the purchase order, the goods receipt and the supplier invoice, and checks that quantity and price agree. It is the core control in purchasing.

Automate the matching, not the resolution. A mismatch is a question, not an error to correct.

Make tolerances explicit, logged and reviewed. Invisible defaults quietly absorb differences.

Handle partial deliveries. They are normal and are not exceptions.

Use a different confirmation step for services. Services have no receipt, so they need their own confirmation, not an exemption.

Report unmatched items by age. A mismatch that sits for weeks is how a duplicate payment happens.

Building it with CodeWords

CodeWords connects to 3,000+ integrations (CodeWords pricing page, 2026), and each connection is made once and reused.

1. Open CodeWords and start a new automation.
2. Describe what should happen in plain language to Cody, the automation builder: the thresholds, the routing, the matching rules, and what escalates.
3. Authorize the connections: the purchasing or finance system, the supplier records, and the approval channel.
4. Describe the exceptions: a new supplier, a value above threshold, a bank detail change, an unmatched invoice.
5. Run it alongside the current process for a cycle and compare what each would have approved.

You describe the outcome; Cody builds it, connects it and deploys it. The free plan covers light use, with Pro at $39 per month and Business at $100 per month as usage grows (CodeWords pricing page, 2026). Details are on the pricing page.

Supplier data and onboarding

Supplier onboarding is a checklist, and it is where the delay sits. The checklist covers company details, bank information, insurance, certifications and terms.

Verify bank details independently, through a channel that did not come from the request, without exception.

Check for a duplicate supplier before creating one. Otherwise one company gets three records and total spend is invisible.

Track expiring documents automatically: insurance, certifications and compliance attestations. A lapsed certificate found during an audit is a finding.

Collect what your own obligations require. For many organisations that includes sanctions screening, modern slavery statements or sector-specific checks.

Keep supplier data current. An annual refresh prompt costs less than discovering a problem at payment time.

What fraud looks for

Procurement fraud most often starts with a supplier bank detail change. The change usually arrives as a convincing email from a real supplier's compromised account.

Verify through a known number, not one supplied in the request. Treat urgency as a reason for more care.

Flag a new supplier followed by an immediate invoice.

Flag repeated invoices just under an approval threshold from the same supplier.

Check periodically for suppliers sharing bank details with employees.

Do not let urgency skip a control. Fraud relies on approval bypass under pressure, so the automation should escalate an urgent request to someone who can decide quickly, not bypass the check.

Contracts and renewals

Money leaks through auto-renewal on contracts nobody reviewed. Diarise the notice period, not the renewal date, because the notice period is the deadline that matters and it often falls months earlier.

Alert the owner with enough time to negotiate, not just to react.

Keep the contract findable. A renewal decision made without the terms is not a decision.

Track what was used against what was bought. That is the basis of any renegotiation.

Name an owner per contract. An unowned contract renews forever.

Reporting that changes behaviour

Six reports change behaviour in procurement.

Spend by category and by supplier, which many organisations cannot produce quickly.

Spend outside the process, as its own number, because it justifies fixing the route.

Duplicate and near-duplicate suppliers, which are easy to find and rarely sought.

Approval cycle time, as a distribution, because the slow tail drives people around the process.

Contracts approaching notice periods, sent monthly to their owners.

Price variance for the same item across suppliers and over time, which shows where to negotiate.

Making the request easy for the requester

A purchase request is easy for the requester when it asks what they need, not how to classify it. The person raising a request does so rarely, does not know the categories, and abandons the form if it is hard.

Ask what they need. Categorisation is procurement's job and can be inferred or added afterwards.

Prefill from the catalogue for routine items, so a repeat purchase is a confirmation, not a form.

Show them where the request is. Asking what happened to a request is the most common contact procurement receives.

Give a realistic date and update it when it changes. A missing date sends people to the card.

Let them save and return. A request abandoned at field eleven is spend that will happen anyway, outside the process.

Ask the people who abandon what stopped them. The list is short and usually easy to fix.

Making it survive

Five practices keep a procurement automation trustworthy.

Make approvals idempotent: never approve twice on a retry.

Enforce thresholds in the system, not by convention, and check aggregation.

Alert on control failures such as a skipped approval or an unverified bank change, loudly and to somebody independent.

Keep an audit trail of every approval, change and match, with timestamps and actors.

Report the outcome: requests processed, approvals pending and their age, matches, mismatches and exceptions raised.

Limits worth knowing about

Five limits apply to procurement automation.

Purchasing systems vary in what they expose, and many are not built for integration.

Supplier portals are not standard. Each large supplier has its own.

Regulated and public sector procurement has legal process requirements that override your design.

Category expertise cannot be automated. Knowing a fair price for a specialist service is judgement.

Automation reveals leverage but does not create it. Somebody still has to hold the negotiation.

What to build first

Build the spend-outside-the-process report first: everything bought without a purchase order, by category and value, with duplicate suppliers named. It approves nothing and changes nothing. It is usually the number that makes speeding up the compliant route an obvious priority.

Two habits make the difference. Verify every bank detail change through a channel that did not come from the request, since that rule prevents the most common and most expensive fraud in this function. And diarise notice periods, not renewal dates, because the real deadline often falls months before the date in the calendar.

Frequently asked questions

What is the real problem in procurement?

The real problem is spend that never enters the process. It is invisible, unnegotiated and often duplicated. People go around the process because it is slow, not because they are careless, so the fix is a faster compliant route.

How do I reduce maverick spend?

Make the compliant route faster than the alternative. Approve by exception for low-value routine purchases with existing suppliers, put a clock on approvals, and delegate for absence. Policy does not substitute for speed.

What is the three-way match?

The three-way match checks that the purchase order, the goods receipt and the supplier invoice agree on quantity and price. Automate the matching but not the resolution, since a mismatch is a question. Keep tolerances explicit and logged.

How should approval thresholds work?

Set thresholds by value and by category, and check aggregation so two purchases just under a threshold cannot bypass it. An automation that does not check splitting removes the control it appears to enforce.

What is the most common procurement fraud?

A supplier bank detail change is the most common, usually arriving as a convincing email from a real supplier's compromised account. Verify through a known number, not one supplied in the request, and treat urgency as a reason for more care.

What else is worth flagging automatically?

Flag a new supplier followed immediately by an invoice, repeated invoices just under a threshold from one supplier, and suppliers sharing bank details with employees. Each is a pattern that is easy to check automatically and hard to spot by hand.

Why diarise notice periods rather than renewal dates?

The notice period is the actual deadline, and it often falls months before the renewal date in the calendar. Auto-renewal on unreviewed contracts is where money leaks quietly, so alert the contract owner early enough to negotiate.

What can automation not do here?

Automation cannot judge whether a price is fair for a specialist service, and it cannot hold the negotiation. It reveals leverage, such as volume, duplication and price variance, but a person still has to use it.

Why do purchase requests get abandoned?

Requesters abandon forms that ask them to classify something they do not understand, with no saved progress and no visible status. The spend then happens anyway, on a card, outside the process.

What should a requester have to provide?

A requester should provide only what they need. Procurement can infer or add the category afterwards, and routine repeat purchases should be a confirmation from a catalogue, not a form.

Related reading

• Workflow automation for finance teams
• Workflow automation for supply chain
• Automating proposal generation