# Auditing IT services spend in SAP Business One > How to audit IT and professional services spend in SAP Business One, where the ERP's approval flow stops and where drift still gets through. Source: https://valuexpa.com/insights/how-do-you-audit-it-and-professional-services-spend-in-sap Publisher: ValueXPA (https://valuexpa.com) Updated: 2026-10-22 --- Margin drift is the gap between what a vendor contract says and what the invoice actually charges. IT and professional services spend is one of the easiest places for that gap to open, because the reference document is a statement of work sitting outside SAP Business One, not a rate card the ERP can check an invoice against. SAP Business One approves an IT vendor invoice by matching it to a purchase order or a service entry sheet. It has no field for a not-to-exceed cap, a rate escalation clause, or a milestone deliverable. This page covers what the ERP actually verifies on this category, and what an audit still has to check by hand. ## Executive Summary SAP Business One's AP module confirms that an IT services invoice matches an open purchase order or approved service entry, and that the amount falls within budget. That check answers one question: does the number on the invoice match the number someone entered into SAP. It does not answer whether the rate on the invoice matches the rate in the signed statement of work, whether a not-to-exceed cap has been breached, or whether a contractor's hours were billed at the tier the contract specifies. The mechanism behind this is structural. SAP Business One has no data model for a rate card, a resource tier table, or an NTE clause. Those terms live in a PDF or a signed SOW, and nothing in the ERP reads that document. Three-way matching in SAP checks the invoice against the PO and the goods receipt or service entry. It does not test a contract clause it was never given. An audit of this category has to start from the contract, not the invoice queue, and reconcile each line against the rate, tier, and cap the SOW actually states. ## 1. What does SAP Business One actually check on an IT services invoice? **SAP Business One matches the invoice to a purchase order and, where configured, a service entry sheet. It confirms the vendor is approved, the PO is open, and the invoiced amount does not exceed the PO line. That is a document-matching check, not a contract check: it verifies the invoice agrees with what a buyer typed into SAP, not with what the statement of work actually authorizes for rate, tier, or scope.** The service entry sheet is the closest SAP Business One gets to a receiving check for services. A requester or approver confirms hours or a milestone was delivered before the invoice posts. That step catches a service that was never rendered. It does not catch a rendered service billed at the wrong rate. If a contract specifies an hourly rate for a senior consultant and the invoice bills a higher rate for the same role, SAP has no field holding the contracted figure to compare against. The service entry sheet only confirms hours, not the price attached to them. Budget checks in SAP Business One work the same way: they compare spend to a budgeted total, not to a contracted rate. A vendor can stay under budget while overbilling every line, because budget and contract compliance are two different tests, and SAP Business One only runs the first one. ## 2. Where do rate and tier errors hide on a professional services invoice? **Rate and tier errors hide in the gap between the labor category printed on the invoice and the labor category defined in the SOW's rate table. A vendor bills a mid-level engineer at the senior rate, or applies a blended rate where the contract specifies role-based billing. Because SAP Business One has no rate table of its own, nothing in the approval flow compares the invoice's labor category to the contracted one.** SOWs for IT and professional services often define a rate card by role: project manager, senior consultant, analyst, offshore resource. Each role has its own hourly or daily rate, sometimes with a blended average stated separately for reporting. An invoice error at this level looks routine. A line item naming a role, a headcount, and a total looks unremarkable on its face. Confirming it requires opening the SOW, finding the rate assigned to that role, and checking it against the hours billed. Approved requesters in SAP Business One are confirming that work happened, not what rate applies to it. Checking rate against role is a step the approval workflow does not perform, so it has to happen as a separate reconciliation against the contract. ## 3. How does an NTE cap get missed inside SAP Business One? **A not-to-exceed cap gets missed when the PO is issued for a round number and never revised against cumulative billing across the engagement's life. SAP Business One tracks spend against the open PO balance for that document, but the NTE clause in the SOW may cover a longer period, multiple POs, or a phase structure the purchase order does not mirror, so the ERP's running total and the contract's cap stop matching.** An NTE clause typically caps total billing for a phase or an engagement, for example a project capped at a fixed ceiling regardless of hours worked. If procurement issues one PO per invoice cycle rather than one PO for the whole engagement, SAP Business One never holds a single number to compare against the cap. Even where a single PO is used, a recurring pattern is raising the PO line whenever the vendor requests it, which keeps every invoice within PO while the underlying NTE figure in the contract stays fixed and gets breached. Catching this requires tracking cumulative billing against the SOW's cap directly, independent of how the PO was structured, because the PO's approval status and the contract's NTE status can diverge without either one showing an error. ## 4. What should an AP team pull before reconciling IT vendor invoices? **Before reconciling, pull the signed SOW or master services agreement, the rate card or exhibit defining role-based pricing, any change orders that amended scope or rate, and twelve to eighteen months of paid invoices for that vendor. Matching these side by side against SAP Business One's payment history is what surfaces a rate applied incorrectly since the contract's start date, not just on the most recent invoice.** A single invoice reviewed in isolation rarely shows an error, because a wrong rate applied consistently looks like the vendor's standard price. The comparison has to run against the contract, and it has to run across the full period the contract has been billed. Change orders matter because they are where scope and rate most often shift without the underlying PO being updated to match. A vendor that added a new role mid-engagement may be billing that role at a rate never formally agreed. - **Signed SOW or MSA:** The document defining scope, rate structure, and any NTE cap for the engagement. - **Rate card exhibit:** The role-by-role pricing table the SOW references, often as a separate attachment. - **Change orders:** Amendments to scope, rate, or term that may not have been reflected in the PO. - **Paid invoice history:** Twelve to eighteen months of AP records for the vendor, pulled from SAP Business One. ## 5. Can three-way matching in SAP Business One catch a contract violation? **No. Three-way matching in SAP Business One confirms the invoice, the purchase order, and the goods receipt or service entry agree with each other. It does not read the statement of work, so it cannot confirm the PO itself was set up at the contracted rate. If the rate was entered incorrectly when the PO was created, three-way matching will pass every invoice built against that PO without flagging the underlying error.** This is a distinction worth stating plainly because it explains why a company can run disciplined three-way matching and still carry margin drift on services spend. The control is working exactly as designed. It was simply never given the contract terms to check against. The fix is not more matching inside SAP Business One. It is a separate reconciliation step that compares the PO's own rate fields, at the time each PO is created or renewed, against the current SOW and its exhibits. That step sits outside the ERP because the ERP has no place to store the contract. ## 6. Should this audit be run inside SAP Business One or outside it? **Run it outside SAP Business One and reconcile back into it. SAP holds the system of record for what was paid; it is not the system of record for what should have been paid. Export the vendor's paid invoice history from SAP, lay it against the SOW's rate card and NTE terms in a separate workbook or the diagnostic's working file, and treat SAP as the source of actuals rather than the tool that validates them.** Some teams try to build the check inside SAP Business One using custom fields or a query report that flags invoices above a threshold. That catches large invoices, not incorrect rates on invoices of ordinary size, which is a separate way for drift to sit in this category. Take your annual IT and professional services spend with a given vendor, multiply by the share billed under a role whose rate you have not independently verified against the SOW, and that product is what a rate reconciliation on that vendor is worth confirming. A fixed-scope diagnostic performs this reconciliation as a one-time pass across the full vendor list and hands back a prioritized list of lines to dispute or renegotiate, rather than leaving it as an ongoing manual task for AP. For the wider pattern this sits inside, start with the [margin drift](/insights/best-invoice-validation-software-smb) guide. See also [diagnostic or software: what to buy first](/insights/diagnostic-or-software-what-to-buy-first) and [build vs. buy: can you do contract-to-invoice matching in excel?](/insights/build-vs-buy-can-you-do-contract-to-invoice-matching-in). ## 7. Frequently Asked Questions (People Also Ask) ### Does SAP Business One store a vendor's contract terms anywhere? No. SAP Business One has no field for a rate card, a resource tier table, or an NTE clause. Those terms live in the signed SOW or MSA, typically a PDF outside the ERP. The system can enforce what is entered into it, such as a PO amount, but it never reads the contract itself. ### Can a custom field in SAP Business One hold the contracted rate? It can hold a value, but nothing keeps that value synchronized with the SOW if the contract is amended later. A custom field is a manual entry, not a live link to the contract, so it drifts out of date the same way any manually maintained reference does. ### Is a service entry sheet the same thing as a rate check? No. A service entry sheet confirms hours or a milestone were delivered. It says nothing about whether the rate applied to those hours matches the contract. Confirming rate requires comparing the invoice to the SOW's rate table directly. ### Why would a vendor pass budget checks while still overbilling? Because a budget check compares total spend to a budgeted ceiling, not to a contracted rate. A vendor can overbill every line and still land under the budget total if the budget was set generously, so staying within budget is not evidence of contract compliance. ### Does raising the PO amount fix an NTE cap problem? It resolves the PO mismatch but not the contract issue. Raising the PO line keeps invoices matching in SAP Business One, but the NTE figure in the signed SOW stays fixed unless the contract itself is amended, so the underlying cap can still be breached. ### How far back should an IT vendor rate reconciliation go? Pull twelve to eighteen months of paid invoices alongside the SOW and any change orders. A rate error applied consistently over that period looks identical to the vendor's normal pricing on any single invoice, so the comparison needs the full history to surface it. ### Who inside the company usually owns this reconciliation? It varies by company: some assign it to AP, some to procurement, some to the budget owner for the SOW. What matters is that whoever owns it has access to both the signed contract and the SAP Business One payment history, since the check requires both. ### What happens if a change order was never reflected in the PO? The PO keeps referencing the original scope and rate while the contract has moved on. Invoices billed under the new change order can still pass SAP Business One's matching against the stale PO, so the reconciliation has to check change orders separately from PO status. ### Is contract complexity quietly draining your operating margin? A small systematic drift between your negotiated contracts and your actual vendor billing compounds quietly across a year of invoices. Stop guessing at your exposure and run a targeted audit. **[Take the Free Screener → https://valuexpa.com/margin-drift-screener](https://valuexpa.com/margin-drift-screener)** ## Executive Summary SAP Business One's AP module confirms that an IT services invoice matches an open purchase order or approved service entry, and that the amount falls within budget. That check answers one question: does the number on the invoice match the number someone entered into SAP. It does not answer whether the rate on the invoice matches the rate in the signed statement of work, whether a not-to-exceed cap has been breached, or whether a contractor's hours were billed at the tier the contract specifies. The mechanism behind this is structural. SAP Business One has no data model for a rate card, a resource tier table, or an NTE clause. Those terms live in a PDF or a signed SOW, and nothing in the ERP reads that document. Three-way matching in SAP checks the invoice against the PO and the goods receipt or service entry. It does not test a contract clause it was never given. An audit of this category has to start from the contract, not the invoice queue, and reconcile each line against the rate, tier, and cap the SOW actually states. ## 1. What does SAP Business One actually check on an IT services invoice? SAP Business One matches the invoice to a purchase order and, where configured, a service entry sheet. It confirms the vendor is approved, the PO is open, and the invoiced amount does not exceed the PO line. That is a document-matching check, not a contract check: it verifies the invoice agrees with what a buyer typed into SAP, not with what the statement of work actually authorizes for rate, tier, or scope. The service entry sheet is the closest SAP Business One gets to a receiving check for services. A requester or approver confirms hours or a milestone was delivered before the invoice posts. That step catches a service that was never rendered. It does not catch a rendered service billed at the wrong rate. If a contract specifies an hourly rate for a senior consultant and the invoice bills a higher rate for the same role, SAP has no field holding the contracted figure to compare against. The service entry sheet only confirms hours, not the price attached to them. Budget checks in SAP Business One work the same way: they compare spend to a budgeted total, not to a contracted rate. A vendor can stay under budget while overbilling every line, because budget and contract compliance are two different tests, and SAP Business One only runs the first one. ## 2. Where do rate and tier errors hide on a professional services invoice? Rate and tier errors hide in the gap between the labor category printed on the invoice and the labor category defined in the SOW's rate table. A vendor bills a mid-level engineer at the senior rate, or applies a blended rate where the contract specifies role-based billing. Because SAP Business One has no rate table of its own, nothing in the approval flow compares the invoice's labor category to the contracted one. SOWs for IT and professional services often define a rate card by role: project manager, senior consultant, analyst, offshore resource. Each role has its own hourly or daily rate, sometimes with a blended average stated separately for reporting. An invoice error at this level looks routine. A line item naming a role, a headcount, and a total looks unremarkable on its face. Confirming it requires opening the SOW, finding the rate assigned to that role, and checking it against the hours billed. Approved requesters in SAP Business One are confirming that work happened, not what rate applies to it. Checking rate against role is a step the approval workflow does not perform, so it has to happen as a separate reconciliation against the contract. ## 3. How does an NTE cap get missed inside SAP Business One? A not-to-exceed cap gets missed when the PO is issued for a round number and never revised against cumulative billing across the engagement's life. SAP Business One tracks spend against the open PO balance for that document, but the NTE clause in the SOW may cover a longer period, multiple POs, or a phase structure the purchase order does not mirror, so the ERP's running total and the contract's cap stop matching. An NTE clause typically caps total billing for a phase or an engagement, for example a project capped at a fixed ceiling regardless of hours worked. If procurement issues one PO per invoice cycle rather than one PO for the whole engagement, SAP Business One never holds a single number to compare against the cap. Even where a single PO is used, a recurring pattern is raising the PO line whenever the vendor requests it, which keeps every invoice within PO while the underlying NTE figure in the contract stays fixed and gets breached. Catching this requires tracking cumulative billing against the SOW's cap directly, independent of how the PO was structured, because the PO's approval status and the contract's NTE status can diverge without either one showing an error. ## 4. What should an AP team pull before reconciling IT vendor invoices? Before reconciling, pull the signed SOW or master services agreement, the rate card or exhibit defining role-based pricing, any change orders that amended scope or rate, and twelve to eighteen months of paid invoices for that vendor. Matching these side by side against SAP Business One's payment history is what surfaces a rate applied incorrectly since the contract's start date, not just on the most recent invoice. A single invoice reviewed in isolation rarely shows an error, because a wrong rate applied consistently looks like the vendor's standard price. The comparison has to run against the contract, and it has to run across the full period the contract has been billed. Change orders matter because they are where scope and rate most often shift without the underlying PO being updated to match. A vendor that added a new role mid-engagement may be billing that role at a rate never formally agreed. - Signed SOW or MSA: The document defining scope, rate structure, and any NTE cap for the engagement. - Rate card exhibit: The role-by-role pricing table the SOW references, often as a separate attachment. - Change orders: Amendments to scope, rate, or term that may not have been reflected in the PO. - Paid invoice history: Twelve to eighteen months of AP records for the vendor, pulled from SAP Business One. ## 5. Can three-way matching in SAP Business One catch a contract violation? No. Three-way matching in SAP Business One confirms the invoice, the purchase order, and the goods receipt or service entry agree with each other. It does not read the statement of work, so it cannot confirm the PO itself was set up at the contracted rate. If the rate was entered incorrectly when the PO was created, three-way matching will pass every invoice built against that PO without flagging the underlying error. This is a distinction worth stating plainly because it explains why a company can run disciplined three-way matching and still carry margin drift on services spend. The control is working exactly as designed. It was simply never given the contract terms to check against. The fix is not more matching inside SAP Business One. It is a separate reconciliation step that compares the PO's own rate fields, at the time each PO is created or renewed, against the current SOW and its exhibits. That step sits outside the ERP because the ERP has no place to store the contract. ## 6. Should this audit be run inside SAP Business One or outside it? Run it outside SAP Business One and reconcile back into it. SAP holds the system of record for what was paid; it is not the system of record for what should have been paid. Export the vendor's paid invoice history from SAP, lay it against the SOW's rate card and NTE terms in a separate workbook or the diagnostic's working file, and treat SAP as the source of actuals rather than the tool that validates them. Some teams try to build the check inside SAP Business One using custom fields or a query report that flags invoices above a threshold. That catches large invoices, not incorrect rates on invoices of ordinary size, which is a separate way for drift to sit in this category. Take your annual IT and professional services spend with a given vendor, multiply by the share billed under a role whose rate you have not independently verified against the SOW, and that product is what a rate reconciliation on that vendor is worth confirming. A fixed-scope diagnostic performs this reconciliation as a one-time pass across the full vendor list and hands back a prioritized list of lines to dispute or renegotiate, rather than leaving it as an ongoing manual task for AP. For the wider pattern this sits inside, start with the [margin drift](/insights/best-invoice-validation-software-smb) guide. See also [diagnostic or software: what to buy first](/insights/diagnostic-or-software-what-to-buy-first) and [build vs. buy: can you do contract-to-invoice matching in excel?](/insights/build-vs-buy-can-you-do-contract-to-invoice-matching-in). ## Common questions ### Does SAP Business One store a vendor's contract terms anywhere? No. SAP Business One has no field for a rate card, a resource tier table, or an NTE clause. Those terms live in the signed SOW or MSA, typically a PDF outside the ERP. The system can enforce what is entered into it, such as a PO amount, but it never reads the contract itself. ### Can a custom field in SAP Business One hold the contracted rate? It can hold a value, but nothing keeps that value synchronized with the SOW if the contract is amended later. A custom field is a manual entry, not a live link to the contract, so it drifts out of date the same way any manually maintained reference does. ### Is a service entry sheet the same thing as a rate check? No. A service entry sheet confirms hours or a milestone were delivered. It says nothing about whether the rate applied to those hours matches the contract. Confirming rate requires comparing the invoice to the SOW's rate table directly. ### Why would a vendor pass budget checks while still overbilling? Because a budget check compares total spend to a budgeted ceiling, not to a contracted rate. A vendor can overbill every line and still land under the budget total if the budget was set generously, so staying within budget is not evidence of contract compliance. ### Does raising the PO amount fix an NTE cap problem? It resolves the PO mismatch but not the contract issue. Raising the PO line keeps invoices matching in SAP Business One, but the NTE figure in the signed SOW stays fixed unless the contract itself is amended, so the underlying cap can still be breached. --- ValueXPA runs a fixed-scope Margin Drift Diagnostic that validates every service vendor invoice against contract terms, for $100M+ US industrial manufacturers and distributors. Two to four weeks. The client retains 100% of recoveries. https://valuexpa.com/contact-us