Workflow automation for procurement: approvals and the three-way match

Procurement automation is usually described as speeding up approvals, which is the smaller half. The larger half is that most organisations do not know what they are buying, from whom, on what terms — because a meaningful share of spend never passes through the process at all.

Fixing that is not primarily an approval problem. It is a question of why people go around the process, which is almost always that the compliant route is slower than the alternative.

What we'll cover

• Maverick spend is the real problem
• Thresholds and who approves what
• The three-way match
• Building it with CodeWords
• Supplier data and onboarding
• What fraud looks for
• Contracts and renewals
• Reporting that changes behaviour
• Making the request easy for the requester
• Making it survive
• Limits worth knowing about
• What to build first
• Frequently asked questions

Maverick spend is the real problem

Spend outside the process is invisible and therefore unnegotiated, unconsolidated and frequently duplicated.

People go around it because it is slow, not because they are careless.

The card is the usual route, and it converts a procurement question into an expense claim nobody reviews commercially.

Duplicate suppliers accumulate, so the same service is bought three times at three prices.

Negotiating leverage is lost. Volume you cannot see is volume you cannot use in a negotiation.

Speed is the intervention. A compliant route that is faster than the alternative is complied with, and no amount of policy substitutes for that.

Thresholds and who approves what

Set thresholds by value and by category, since a routine purchase and an unusual one warrant different scrutiny at the same amount.

Approve by exception for low-value routine spend against an existing supplier, which is most transactions.

Never let splitting work. Two purchases just under a threshold must aggregate, and an automation that does not check for that has removed the control.

Give approvals a clock. An approval process with no deadline is the reason people stop using it.

Delegate for absence, or every approval stops when somebody takes leave.

Show approvers the delta, not the whole request — what is unusual about this one is the thing they should be reading.

The three-way match

Order, receipt and invoice, agreeing on quantity and price, is the core control in purchasing.

Automate the matching, not the resolution, since a mismatch is a question rather than an error to correct.

Tolerances should be explicit, logged and reviewed, rather than invisible defaults that quietly absorb differences.

Partial deliveries are normal and need handling rather than treating as exceptions.

Services are harder than goods, since there is no receipt, and they need a different confirmation step rather than being exempted.

Report unmatched items by age, because an unresolved mismatch that sits for weeks is how a duplicate payment happens.

Building it with CodeWords

CodeWords connects to more than 3,000 integrations, and the connection is made once and reused.

1. Open CodeWords and start a new automation.
2. Describe what should happen in plain language to Cody, the automation builder: the thresholds, the routing, the matching rules, and what escalates.
3. Authorize the connections — the purchasing or finance system, the supplier records, and the approval channel.
4. Describe the exceptions: a new supplier, a value above threshold, a bank detail change, an unmatched invoice.
5. Run it alongside the current process for a cycle and compare what each would have approved.

You describe the outcome; Cody builds it, connects it, and deploys it. The free plan covers light use, with Pro at $39 per month and Business at $100 per month as usage grows; details are on the pricing page.

Supplier data and onboarding

Onboarding is a checklist — details, bank information, insurance, certifications, terms — and it is where the delay sits.

Verify bank details independently, through a channel that did not come from the request, without exception.

Check for a duplicate supplier before creating one, since the alternative is three records for one company and no visibility of total spend.

Track expiring documents — insurance, certifications, compliance attestations — automatically, since a lapsed certificate discovered during an audit is a finding.

Collect what you need for your own obligations, which for many organisations includes sanctions screening, modern slavery statements or sector-specific checks.

Keep it current. Supplier data decays and an annual refresh prompt is cheaper than discovering a problem at payment time.

What fraud looks for

Bank detail changes are the most common vector, usually arriving as a convincing email from a real supplier's compromised account.

Verify through a known number, not one supplied in the request, and treat urgency as a reason for more care rather than less.

New supplier plus immediate invoice is a pattern worth flagging automatically.

Invoices just under an approval threshold, repeatedly, from the same supplier.

Suppliers sharing bank details with employees, which is a check worth running periodically.

Approval bypass under pressure is what fraud relies on, which is why the automation must not let urgency skip a control — only escalate it to somebody who can decide quickly.

Contracts and renewals

Auto-renewal is where money leaks, quietly, on contracts nobody reviewed.

Diarise notice periods, not renewal dates, since the notice period is the deadline that matters and it is frequently months earlier.

Alert the owner with enough time to negotiate rather than to react.

Keep the contract findable, since a renewal decision made without the terms is not a decision.

Track what was actually used against what was bought, which is the basis of any renegotiation.

Name an owner per contract, because an unowned contract renews forever.

Reporting that changes behaviour

Spend by category and by supplier, which most organisations cannot produce quickly.

Spend outside the process, as its own number, since it is the one that justifies fixing the route.

Duplicate suppliers and near-duplicates, which are easy to find and rarely looked for.

Approval cycle time, distributed, since the tail is what drives people around the process.

Contracts approaching notice periods, monthly, to their owners.

Price variance for the same item across suppliers and over time, which is where negotiation opportunities are visible.

Making the request easy for the requester

Everything above is procurement's view. The person raising a request is usually doing it once a quarter, has no idea what the categories mean, and abandons it halfway if it is hard.

Ask what they need, not how to classify it. Categorisation is procurement's problem and should be inferred or added afterwards.

Prefill from the catalogue for anything routine, so a repeat purchase is a confirmation rather than a form.

Show them where it is, since the most common contact procurement receives is somebody asking what happened to their request.

Give a realistic date, and update it when it changes, because the absence of a date is what sends people to the card.

Let them save and return. A request abandoned at field eleven is spend that will happen anyway, outside the process.

Ask the people who abandon what stopped them, which is a short list and usually an easy fix.

Making it survive

Make approvals idempotent and never double-approve on a retry.

Enforce thresholds in the system, not by convention, and check aggregation.

Alert on control failures — a skipped approval, an unverified bank change — loudly and to somebody independent.

Keep an audit trail of every approval, change and match with timestamps and actors.

Report the outcome: requests processed, approvals pending and their age, matches, mismatches, and exceptions raised.

Limits worth knowing about

Purchasing systems vary enormously in what they expose and many are not built for integration.

Supplier portals are not standard, and each large supplier has its own.

Regulated and public sector procurement has legal process requirements that govern rather than your design.

Category expertise cannot be automated — knowing what a fair price is for a specialist service is judgement.

Automation does not create leverage, it reveals it; the negotiation is still a conversation somebody has to have.

What to build first

The spend-outside-the-process report: everything bought without a purchase order, by category and by value, with the duplicate suppliers named. It approves nothing and changes nothing, and it is usually the number that makes speeding up the compliant route an obvious priority rather than a policy argument.

Two habits make the difference. Verify every bank detail change through a channel that did not come from the request, since that single rule prevents the most common and most expensive fraud in this function. And diarise notice periods rather than renewal dates, because the deadline that actually matters is frequently months before the date everybody has in the calendar.

Frequently asked questions

What is the real problem in procurement?

Spend that never enters the process. It is invisible, unnegotiated and frequently duplicated, and people go around the process because it is slow rather than because they are careless.

How do I reduce maverick spend?

Make the compliant route faster than the alternative. Approve by exception for low-value routine purchases against existing suppliers, put a clock on approvals, and delegate for absence. Policy does not substitute for speed.

What is the three-way match?

Order, receipt and invoice agreeing on quantity and price. Automate the matching but not the resolution — a mismatch is a question. Keep tolerances explicit and logged rather than as invisible defaults.

How should approval thresholds work?

By value and by category, with aggregation checked so two purchases just under a threshold cannot bypass it. An automation that does not check splitting has removed the control it appears to enforce.

What is the most common procurement fraud?

A bank detail change arriving as a convincing email, often from a real supplier's compromised account. Verify through a known number rather than one supplied in the request, and treat urgency as a reason for more care.

What else is worth flagging automatically?

A new supplier followed immediately by an invoice, repeated invoices just under a threshold from one supplier, and suppliers sharing bank details with employees.

Why diarise notice periods rather than renewal dates?

Because the notice period is the actual deadline and it is frequently months before the renewal date everybody has in the calendar. Auto-renewal on unreviewed contracts is where money leaks quietly.

What can automation not do here?

Judge whether a price is fair for a specialist service, and conduct the negotiation. It reveals leverage — volume, duplication, price variance — but somebody still has to use it.

Why do purchase requests get abandoned?

Usually a form that asks the requester to classify something they do not understand, with no saved progress and no visible status. The spend then happens anyway, on a card, outside the process.

What should a requester have to provide?

What they need. Categorisation is procurement's problem and can be inferred or added afterwards, and routine repeat purchases should be a confirmation from a catalogue rather than a form.

Related reading

• Workflow automation for finance teams
• Workflow automation for supply chain
• Automating proposal generation