Control Gap

A control gap is the missing check in an approval workflow that would have tested an invoice against a specific contract term before payment.

Twitter LinkedIn WhatsApp
Ask AI: ChatGPT Claude Gemini Grok
Control Gap

A control gap is a point in the invoice-to-payment process where no system or person checks a specific contract term before payment is released. It is not the contract term itself, and not the drift that results. It is the missing check that let the drift through.

Control gaps explain why the same billing error can repeat for months without anyone noticing. The invoice looks ordinary. Nobody was ever assigned to test the one clause that would have caught it.

1. What is a control gap?

A control gap is a missing or incomplete check in the invoice approval process that would otherwise test a specific contract term before payment. It sits between the contract and the invoice: the term exists, the invoice violates it, but no step in the workflow was built to compare the two. The gap is structural, not a one-time mistake.

It recurs on every invoice that passes through the same unchecked path.

Three-way matching checks the invoice against the purchase order and the receipt. It does not test a rate card, a rebate threshold, or a surcharge expiration date, because those terms live in a separate document. A control gap is the absence of a step that would pull that document in.

2. How does a control gap differ from margin drift itself?

Margin drift is the outcome: the dollar gap between contract terms and what got billed. A control gap is the cause: the workflow reason the outcome went undetected. One invoice with a wrong rate is a drift event.

The recurring absence of a rate check on every invoice from that vendor is the control gap producing it. Closing the gap prevents the next occurrence; it does not recover what already leaked.

Distinguishing the two matters for where you spend effort. Chasing individual drift events one invoice at a time treats a symptom. Naming the control gap, and building the check into the approval workflow, addresses the source.

3. Where do control gaps typically originate?

Control gaps form wherever a contract term lives outside the system that approves payment. AP software reads purchase orders and receipts. It does not read a PDF rate card, a side letter amending a rebate tier, or an email confirming a volume commitment change. Any term negotiated after the master agreement, or stored outside the ERP, is a candidate control gap until someone builds a check for it.

Rate cards, rebate clauses, and NTE caps stored as PDFs outside the ERP have no system path into the approval workflow. A rate change negotiated by email after the master agreement often never reaches the team approving invoices. When contract management and AP approval sit in different departments, neither treats the check as their job.

4. How is a control gap closed?

Closing a control gap means adding the specific check that was missing, at the point in the workflow where the invoice is approved, not after. This starts with naming every contract term that currently has no corresponding check, then building or assigning that check. A diagnostic that reviews 12 to 18 months of historical spend against contract terms surfaces where these gaps sit before any new control is designed.

A gap named without a fix stays a gap. The work is naming which terms have no check, then deciding who or what performs the check going forward, whether that is a person, a rule in AP software, or a step added to vendor onboarding.

Margin drift recurs through gaps like volume tier misapplication and accessorial charge creep until the specific missing check is identified and assigned.

For the wider pattern this sits inside, start with the margin drift guide.

5. Frequently Asked Questions (People Also Ask)

Is a control gap the same as an internal control weakness in an audit sense?

Related but narrower. An audit control weakness usually covers financial reporting risk broadly. A control gap here refers specifically to a missing check between a contract term and the invoice approval workflow, which is a subset of that broader category.

Can a control gap exist even with AP automation software in place?

Yes. AP automation tests what it is configured to test, typically the purchase order and receipt match. It does not automatically know about a rebate clause or a surcharge expiration date written into a separate contract document unless someone configures that specific check.

Who is responsible for closing a control gap?

It varies by company. Sometimes AP owns it, sometimes procurement or the contract owner. A common failure is that nobody owns it, because the gap sits between departments rather than inside one.

Does every missed contract term represent a control gap?

Only if the miss is structural and recurring. A one-time data entry error is a mistake, not a control gap. A control gap is the absence of a check, which means the same type of error can recur on future invoices until the check is added.

How do you find control gaps before they cause a large loss?

Review a sample of paid invoices against their governing contracts and note, for each finding, which step in the approval process should have caught it and did not. That missing step is the control gap.

Is a control gap the same thing as a missing contract clause?

No. A missing clause means the contract itself does not address a scenario. A control gap assumes the clause exists and is being violated, but no workflow step checks the invoice against it.

1. What is a control gap?

A control gap is a missing or incomplete check in the invoice approval process that would otherwise test a specific contract term before payment. It sits between the contract and the invoice: the term exists, the invoice violates it, but no step in the workflow was built to compare the two. The gap is structural, not a one-time mistake. It recurs on every invoice that passes through the same unchecked path. Three-way matching checks the invoice against the purchase order and the receipt. It does not test a [rate card](/glossary/rate-card), a rebate threshold, or a surcharge expiration date, because those terms live in a separate document. A control gap is the absence of a step that would pull that document in.

2. How does a control gap differ from margin drift itself?

Margin drift is the outcome: the dollar gap between contract terms and what got billed. A control gap is the cause: the workflow reason the outcome went undetected. One invoice with a wrong rate is a drift event. The recurring absence of a rate check on every invoice from that vendor is the control gap producing it. Closing the gap prevents the next occurrence; it does not recover what already leaked. Distinguishing the two matters for where you spend effort. Chasing individual drift events one invoice at a time treats a symptom. Naming the control gap, and building the check into the approval workflow, addresses the source.

3. Where do control gaps typically originate?

Control gaps form wherever a contract term lives outside the system that approves payment. AP software reads purchase orders and receipts. It does not read a PDF rate card, a side letter amending a rebate tier, or an email confirming a volume commitment change. Any term negotiated after the master agreement, or stored outside the ERP, is a candidate control gap until someone builds a check for it. Rate cards, rebate clauses, and NTE caps stored as PDFs outside the ERP have no system path into the approval workflow. A rate change negotiated by email after the master agreement often never reaches the team approving invoices. When contract management and AP approval sit in different departments, neither treats the check as their job.

4. How is a control gap closed?

Closing a control gap means adding the specific check that was missing, at the point in the workflow where the invoice is approved, not after. This starts with naming every contract term that currently has no corresponding check, then building or assigning that check. A diagnostic that reviews 12 to 18 months of historical spend against contract terms surfaces where these gaps sit before any new control is designed. A gap named without a fix stays a gap. The work is naming which terms have no check, then deciding who or what performs the check going forward, whether that is a person, a rule in AP software, or a step added to vendor onboarding. Margin drift recurs through gaps like [volume tier misapplication](/glossary/volume-tier-misapplication) and [accessorial charge creep](/glossary/accessorial-charge-creep) until the specific missing check is identified and assigned. For the wider pattern this sits inside, start with the [margin drift](/insights/margin-drift-spend-leakage-guide) guide.

Questions & Answers

Is a control gap the same as an internal control weakness in an audit sense?

Related but narrower. An audit control weakness usually covers financial reporting risk broadly. A control gap here refers specifically to a missing check between a contract term and the invoice approval workflow, which is a subset of that broader category.

Can a control gap exist even with AP automation software in place?

Yes. AP automation tests what it is configured to test, typically the purchase order and receipt match. It does not automatically know about a rebate clause or a surcharge expiration date written into a separate contract document unless someone configures that specific check.

Who is responsible for closing a control gap?

It varies by company. Sometimes AP owns it, sometimes procurement or the contract owner. A common failure is that nobody owns it, because the gap sits between departments rather than inside one.

Does every missed contract term represent a control gap?

Only if the miss is structural and recurring. A one-time data entry error is a mistake, not a control gap. A control gap is the absence of a check, which means the same type of error can recur on future invoices until the check is added.

How do you find control gaps before they cause a large loss?

Review a sample of paid invoices against their governing contracts and note, for each finding, which step in the approval process should have caught it and did not. That missing step is the control gap.

Margin Drift Resources