Auditing vendor invoices in Business Central

Executive Summary

Dynamics 365 Business Central checks an invoice against a purchase order and a receipt. It does not check an invoice against a contract. Those are different documents with different lifespans, and Business Central only stores one of them as a structured record.

A rate card, a volume tier, a rebate clause or a not-to-exceed cap usually lives in a PDF or a signed letter outside the ERP, so nothing in the posting routine ever tests the invoice against it.

The gap this creates is structural, not a configuration mistake. Three-way matching answers "does this invoice match the PO and the receipt," which is a real control and worth keeping. It cannot answer "does this rate match what the contract says," "has this surcharge outlived the condition that justified it," or "did we hit the volume tier that should have dropped our unit price." Those questions require reading the contract itself and holding its terms as data, which is a separate step from anything Business Central's purchase invoice workflow performs.

What changes this is treating the contract as a second source of truth and matching against it deliberately, either as a one-time retrospective pass across recent vendor spend or as a standing check built alongside the ERP. Both routes are covered below, along with what a manufacturer running Business Central can realistically build in-house before deciding whether to bring in a fixed-scope diagnostic.

1. What does Business Central actually check when an invoice posts?

Business Central's purchase invoice workflow runs three-way matching: it compares the invoice quantity and price against the purchase order and the posted receipt, and it can block posting if the variance exceeds a tolerance you set. That check confirms the vendor billed what was ordered and what arrived. It says nothing about whether the price on the PO itself was the correct contract price, because the PO price is typically typed in or pulled from a vendor price list the.

The control sits at the point of entry, not at the point of contract. A purchasing agent, or an integration, populates the unit price on the PO line. Business Central then holds that price steady through receipt and invoice. If the price was wrong when entered, matching confirms a wrong number three times instead of catching it once.

Vendor price lists inside Business Central update the number the system checks against, but only if someone maintains them against the actual signed agreement. A rate card renegotiated last quarter does not update itself in the ERP. Until someone re-enters it, the system matches faithfully against a stale figure.

This is not a defect in the software. Three-way matching does exactly what it is designed to do: confirm internal document agreement. A contract audit is a different task, comparing an external legal document against a billing record, and Business Central's posting routine was never the layer built to run it.

2. Where do contract terms live if not in Business Central?

Rate cards, volume tiers, rebate clauses, surcharge schedules and not-to-exceed caps are almost always stored as PDFs, signed letters or email threads outside Business Central. The ERP holds vendor cards, price lists and purchase documents. It does not hold contract clauses as structured, queryable fields, so nothing in a standard posting or approval workflow can test an invoice line against a rebate trigger or a tier threshold without someone first extracting those terms manually.

This split is why audits stall on volume: a mid-market manufacturer might carry several hundred active service vendor contracts, each with its own document, its own renewal date and its own clause structure. None of that is normalized data.

Some categories are worse than others for this. Freight contracts bury accessorial and fuel surcharge terms in a separate tariff document referenced by the master agreement rather than stated in it. Staffing and contract labor agreements state a bill rate and a not-to-exceed cap in the statement of work, a document that often never touches the ERP at all.

A contract compliance audit starts by pulling these documents together and turning the clauses into rules: a rate, a tier boundary, a trigger condition, an expiration date. Only once that step is done does an invoice-to-contract comparison become possible.

3. Can Business Central's approval workflows catch a rate schedule violation?

Approval workflows in Business Central route an invoice to a person based on amount, vendor or dimension. They do not evaluate whether the rate charged matches a contracted rate card, because the workflow engine has no contract data to check against. An approver sees the invoice and the PO it matched to; unless that approver happens to have the current rate card open and remembers to compare it line by line, a rate schedule violation passes through looking exactly like.

This is worth stating plainly because it is the most common assumption behind a missed control: that a human approval step functions as a contract check. It functions as an exception check, catching invoices that are unusually large, from an unfamiliar vendor, or coded to the wrong account. None of those conditions describes a rate schedule violation, which typically looks unremarkable: the invoice format is normal, the PO matched, and the amount sits within a plausible range.

Approval workflows can be configured to route by vendor or spend category, which helps direct scrutiny, but the scrutiny itself still depends on someone holding the contract terms in their head or in a separate spreadsheet during review. Where that spreadsheet exists and is kept current, it functions as the missing layer. Where it does not, the approval step is a formatting and authorization gate, not a contract gate.

4. How do you build a retrospective invoice-to-contract check using Business Central data?

Export posted purchase invoice lines from Business Central for the vendors and categories you want to review, typically 12 to 18 months of history, and match them against the contract terms you have separately normalized into a rate table. Compare invoiced unit price, quantity and surcharge lines against the contract's rate card, tier thresholds and trigger conditions row by row. This is arithmetic and lookup work, not a Business Central feature, and the ERP's job in it is limited to.

Two separate pieces of work make this possible, and each has its own discipline.

A. Building the extract

Business Central can export posted purchase invoice lines, vendor ledger entries and PO history through its standard reporting or via API to a spreadsheet or a data warehouse. The fields that matter for a contract check are vendor, invoice date, line description, quantity, unit price and any surcharge or accessorial lines billed separately. Dimension codes, if your chart of accounts uses them by category, make it far faster to isolate freight, MRO, contract labor or IT services spend without touching invoices from unrelated categories.

B. Building the rule set

The contract side has to be built by hand, at least the first time: read each agreement, and record the rate card, the volume tier boundaries, the rebate trigger and any expiration date for a surcharge as rows in a table. Once that table exists, matching it against the Business Central extract is a lookup exercise: does the invoiced unit price equal the contracted rate for that tier, given the volume actually shipped or billed that period. A mismatch is a finding, not a guess.

5. Which service spend categories should a Business Central manufacturer check first?

Freight and 3PL, contract labor and staffing, maintenance and repair, IT and professional services, MRO and Class C consumables, and calibration and safety compliance are the categories where a rate card, a tier, a surcharge schedule or a not-to-exceed cap most commonly sits outside Business Central entirely. Each is described on its own mechanics below, because comparing them against each other for size or frequency is not something the available data supports.

Reviewing all six as one undifferentiated block usually means none of them gets checked properly, since each depends on a different contract structure and a different document to source terms from.

• Freight and 3PL: Base rates, fuel surcharges and accessorial charges are governed by a tariff document separate from the invoice, so a surcharge condition can lapse without the billed rate changing.
• Contract labor and staffing: A bill rate and a not-to-exceed cap live in the statement of work, a document that often never reaches Business Central's vendor or PO records.
• Maintenance and repair: Service agreements frequently include a response-time or parts markup clause tested nowhere in a standard purchase invoice workflow.
• IT and professional services: Milestone and time-and-materials billing terms sit in a master services agreement, distinct from the invoice format the ERP reconciles against a PO.
• MRO and Class C consumables: Volume tier discounts tied to annual spend commitments require tracking cumulative purchases across the year, a calculation outside the posting routine.
• Calibration and safety compliance: Recurring service contracts often include an escalation cap that limits year-over-year price increases, a term with no field in Business Central to hold it.

6. Should you build this check in-house or bring in a fixed-scope diagnostic?

Build it in-house when the vendor list is short enough that one person can hold the contract terms current and the extract-and-match process fits inside existing AP capacity. Bring in a fixed-scope engagement when the contract volume, the categories involved, or the backlog of unreviewed history make that manual process too slow to finish before the findings go stale. Both routes produce the same kind of output: a list of invoices that diverged from contract terms, with the dollar variance.

The deciding factor is usually time and specialization rather than company size. Reading several hundred service contracts, normalizing their terms, and running a line-by-line match against 12 to 18 months of Business Central invoice history is a defined, finite project, but it competes directly with an AP team's ongoing close and payment work.

A fixed-scope diagnostic does this work as its sole task and delivers a prioritized recovery and prevention roadmap in 2 to 4 weeks, across ValueXPA diagnostics, covering AP recovery findings, contract compliance findings and an indirect spend review together rather than as separate projects. The client retains 100% of recoveries under that model, unlike a contingency arrangement where the firm takes a cut of what it finds.

Neither route replaces the other permanently. A retrospective pass, whichever way it is done, tells you what already leaked. Keeping it from recurring requires a standing check that runs against every new invoice, which is a forward control decision separate from this one.

For the wider pattern this sits inside, start with the margin drift guide.

7. Frequently Asked Questions (People Also Ask)

Does Business Central have a built-in contract compliance feature?

No. Business Central's native controls are three-way matching, vendor price lists and approval workflows, all of which reconcile internal purchasing documents against each other. None of them read a contract PDF or test an invoice against a rate card, volume tier or rebate clause. That comparison has to be built separately, either manually or through an outside audit.

Will three-way matching catch a duplicate payment in Business Central?

It can catch some duplicates, particularly exact repeats of the same invoice number against the same PO, if duplicate-check settings are enabled. It is less reliable against a duplicate submitted with a slightly different invoice number or date, which is why a retrospective AP recovery review still finds duplicates in systems where matching was active the whole time.

Can I add contract terms as custom fields in Business Central?

Business Central supports custom fields and extensions, so a rate card or a tier threshold can technically be stored there. The harder part is keeping those fields current as contracts renew and populating them accurately in the first place, which is a data maintenance task independent of the ERP's technical capability.

How far back should a retrospective invoice audit go?

Twelve to 18 months of historical spend is the typical window, across ValueXPA diagnostics, because it is recent enough that credit memos and rebates may still be recoverable from vendors, and long enough to capture a full contract cycle including any annual tier reset.

Does this apply the same way to Business Central Essentials and Premium?

The matching and approval mechanics described here are consistent across both editions. Premium adds service order management and manufacturing functionality, but neither changes how purchase invoices are matched against POs or how contract terms are, or are not, stored.

What is the difference between an AP recovery review and a contract compliance check in this context?

An AP recovery review looks for errors already paid: duplicate payments, missed credit memos, unapplied rebates. A contract compliance check compares invoiced rates and terms against the signed agreement going forward and backward. Both draw on the same Business Central invoice extract but apply different rules to it.

Do I need to migrate off Business Central to fix this?

No. The gap is not a defect to migrate away from, it is a structural limit shared by every ERP's native purchase invoice workflow, including higher-tier systems. The fix is adding a contract-matching layer alongside Business Central, not replacing it.

Who should own this audit inside a manufacturer running Business Central?

Ownership typically sits with the Controller or AP lead, since they hold both the invoice data and the escalation path to vendors when a finding turns up. Procurement's involvement matters too, since they usually hold the actual contract documents the check depends on.