How does an NTE overrun happen in IT services?

Executive Summary

A not-to-exceed overrun in IT and professional services is rarely a single bad invoice. It is the accumulation of small approvals: a change order that widened scope without adjusting the cap, a monthly invoice that landed under a threshold and skipped a second look, a resource added mid-project without a rate check against the original statement of work. Each one clears review individually.

None of them triggers the cap by itself.

The mechanism that lets this happen is a mismatch between where the cap lives and where spend gets approved. The cap sits in a contract document. Spend gets approved against a purchase order or a budget line that often has no live link back to that contract figure.

Three-way matching checks the invoice against the PO and the receipt of service; it does not test whether cumulative billings under a statement of work have crossed the dollar ceiling the contract states.

What changes it is tracking cumulative billings against the cap as a running total, checked at invoice time, rather than checked only when someone happens to remember the contract terms. That is a control question, not a vendor-honesty question: the vendor is billing hours actually worked, and the invoice is accurate on its own terms. The overrun is a contract-to-invoice matching failure, not a billing error, and it gets fixed by changing what AP checks the invoice against, not by chasing the vendor.

1. What is a not-to-exceed clause supposed to control?

A not-to-exceed clause sets a dollar ceiling on what a vendor can bill under a statement of work, regardless of hours actually worked past that point. It exists so a time-and-materials engagement does not become open-ended spend. The clause typically requires written approval before billing past the cap.

It does not stop work from continuing. It only obligates the vendor to get sign-off first, which is the exact step that gets skipped when approval workflows lag behind delivery.

The cap is written into the statement of work as a single dollar figure, sometimes with a note that it excludes pre-approved change orders. That figure is the only thing standing between a time-and-materials arrangement and unlimited billing.

The clause puts the obligation on the vendor to stop and ask before crossing the line. It does not put a system in place that stops the invoice automatically. Whether the cap holds depends entirely on whether someone on the buyer's side is tracking cumulative billings against it in real time, separate from whether any single invoice looks reasonable.

2. Where does the tracking gap actually open?

The tracking gap opens between the document that states the cap and the system that approves payment. The statement of work sits in a contract repository or a shared drive. The purchase order or budget line that AP checks invoices against is a separate record, created once and rarely updated to reflect a running total.

Nothing forces those two numbers to talk to each other, so an invoice can pass every routine check and still push cumulative billings past the.

A purchase order is typically issued once, at or near the value of the original statement of work. AP then matches each invoice to that PO number and to a receipt confirming the service was delivered. That match answers one question: did the vendor bill for something we agreed to receive.

It does not answer a second question: has the running total of every invoice paid under this SOW crossed the dollar ceiling stated in the contract. That second question requires a cumulative figure nobody is maintaining outside the contract document itself, so it goes unchecked invoice by invoice, even while every individual invoice clears review.

3. How do change orders erode the cap without anyone noticing?

A change order adds scope, a resource, or a phase to an engagement, and it is common practice to approve the added work without revisiting the original not-to-exceed figure. The cap was set against the original scope. Once scope changes, the cap either needs a matching revision or an explicit statement that it still applies.

When neither happens, the project accrues billings against a ceiling that no longer reflects what was actually approved to be delivered.

Change orders are usually approved by the project sponsor or the business owner, not by AP or procurement. The approval focuses on whether the added work is needed and whether the new rate is fair, not on whether the original NTE figure still makes sense given the expanded scope.

Each change order is a reasonable decision in isolation. The cumulative effect is a cap that was sized for a smaller engagement now governing a larger one, with no single document stating the current, true ceiling. AP continues matching invoices to the original PO, unaware the underlying scope has moved.

4. Why does invoice review miss the overrun even when it looks routine?

Invoice review is built to catch errors on a single invoice: wrong rate, wrong hours, missing approval. It is not built to hold a running total across every invoice paid under one statement of work over the life of a multi-month engagement. A monthly invoice for a reasonable number of hours at the agreed rate passes every line-item check.

The overrun only becomes visible when someone sums every prior invoice against the contract's dollar ceiling, a step outside the normal.

Most AP workflows are transactional. An analyst opens an invoice, checks it against a PO and a receipt, and approves or rejects it on its own merits. That workflow is efficient for catching a wrong rate or a duplicate line item.

A cumulative cap requires a different kind of check: not does this invoice look right, but does this invoice, added to everything paid before it, exceed a number written in a different document entirely. Building that check means the AP system needs a live link to the contract's dollar ceiling and a running total per statement of work, not just a per-invoice comparison.

5. What role does resource substitution play in NTE overruns?

A statement of work typically prices specific roles at specific rates: a senior architect at one rate, a junior developer at another. When a vendor substitutes a more senior resource without a rate adjustment, or adds a role the original SOW did not price, hours accrue faster against the cap than the original plan assumed. The invoice still shows a plausible rate and plausible hours.

It just consumes the ceiling faster than the staffing plan the cap was built around.

Rate cards attached to a statement of work usually list role, rate and sometimes a planned allocation of hours per role. That allocation is what the not-to-exceed figure was calculated from.

When the actual staffing mix shifts toward higher-rate roles, or adds a role outside the original plan, the dollar ceiling gets consumed faster than the hour count alone would suggest. Nothing on a single invoice flags this: the rate matches the rate card, the hours are logged, the work was delivered. The only way to see it is comparing planned burn rate to actual burn rate against the same cap, which sits outside standard invoice review.

A. Rate card drift

A rate card lists approved roles and their billing rates for the engagement. Drift happens when a role appears on an invoice that the rate card does not list, or at a rate the card does not state, and the invoice is still approved because the total looks reasonable against budget expectations rather than against the specific rate card terms.

B. Allocation drift

Allocation drift happens when the mix of hours by role shifts from what the statement of work assumed when the cap was calculated, even though every individual hour is billed at its correct, contracted rate.

6. How does a contract compliance audit catch this after the fact?

A contract compliance audit rebuilds the cumulative total for each statement of work directly from the invoice history and compares it against the not-to-exceed figure and every approved change order, line by line. That comparison is exactly what routine invoice review does not do, because it requires reading the contract document and every amendment alongside twelve or eighteen months of invoices, not just the current one. The audit produces the running total that should have existed the whole time.

The audit starts with the contract file: the original statement of work, its stated NTE figure, and every subsequent change order with its own scope and dollar impact. That produces a single, current ceiling figure, which is often different from the number on the original PO.

Against that figure, the audit sums every invoice paid to date under the engagement. Where the cumulative total exceeds the current ceiling without a documented approval to exceed it, that is a finding: an overrun that happened inside individually reasonable invoices, invisible until someone reconstructed the running total the AP process was never built to maintain.

For the wider pattern this sits inside, start with the margin drift guide. See also the Margin Drift Diagnostic and our insights.

7. Frequently Asked Questions (People Also Ask)

What is a not-to-exceed clause in an IT services contract?

It is a dollar ceiling written into a statement of work that caps what a vendor can bill for a time-and-materials engagement without separate written approval to exceed it. It protects against open-ended billing on work priced by the hour rather than by fixed unit, and it typically requires the vendor to flag approaching the cap before billing past it.

Does an NTE overrun mean the vendor overbilled us?

Not necessarily. The hours billed can be entirely accurate and the rates entirely correct, and the engagement can still exceed the contract's dollar ceiling. The overrun is usually a matching failure on the buyer side: nobody tracked cumulative billings against the cap as work progressed, not a case of the vendor charging for work it did not do.

Why does three-way matching not catch this?

Three-way matching checks an invoice against a purchase order and a receipt of service, confirming the vendor billed for something that was ordered and delivered. It does not test a separate figure: the cumulative dollar total billed to date under a statement of work against that contract's not-to-exceed ceiling.

How do change orders affect the original NTE cap?

A change order adds scope or resources to an engagement, and approval of that added work commonly happens without revisiting whether the original not-to-exceed figure still applies. Unless the change order explicitly restates or revises the cap, the engagement can accrue billings against a ceiling that no longer matches its actual scope.

Can a monthly invoice look completely normal and still overrun the cap?

Yes. A single invoice is checked against its own rate and hours, both of which can be entirely correct. The overrun only shows up when that invoice is added to every prior invoice paid under the same statement of work and compared to the contract's dollar ceiling, a check that sits outside routine per-invoice review.

Does resource substitution cause NTE overruns?

It can. When a vendor staffs a more senior role than the original statement of work priced, or adds a role the rate card did not include, the dollar ceiling gets consumed faster than the original staffing plan assumed, even though each invoiced rate matches an agreed figure.

How would we find out if this has already happened to us?

A contract compliance audit rebuilds the cumulative billing total for each statement of work from invoice history and compares it against the current not-to-exceed figure, including every change order. That reconstruction is what surfaces an overrun that individual invoice review missed.

Is this specific to IT and professional services spend?

Not-to-exceed clauses appear in other service categories too, but IT and professional services spend is especially exposed because billing is hourly and milestone-based rather than unit-based, and engagements frequently change scope mid-contract through change orders that are approved without revisiting the original cap.

What should change to prevent this going forward?

The cumulative total billed under each statement of work needs to be tracked against its current not-to-exceed figure at the time each invoice is reviewed, not reconstructed later. That requires linking the contract's dollar ceiling to the invoice approval workflow rather than relying on a one-time purchase order match.