# How to audit an IT services invoice against its SOW > A concrete, numbered method for auditing IT and professional services invoices against statements of work, rate cards, and change orders. Read the full guide. Source: https://valuexpa.com/insights/how-to-audit-it-and-professional-services-invoices-step-by Publisher: ValueXPA (https://valuexpa.com) Updated: 2026-09-05 --- Margin drift is the gap between what a vendor contract says and what the invoice actually charges. In IT and professional services spend, that gap hides inside statements of work, change orders, and blended rate tables that few AP teams read line by line before approving payment. This guide gives a concrete, repeatable method for auditing IT and professional services invoices: what to pull before you start, what to check on every line, and how to turn a finding into a recovered credit or a corrected control. ## Executive Summary IT and professional services invoices carry more unstructured contract terms than almost any other indirect category: statements of work with milestone triggers, change orders that alter scope mid-engagement, and rate cards with role-level tiers that shift by seniority or location. Three-way matching checks the invoice against the purchase order and receipt; it does not test whether the resource billed matches the rate the SOW specifies for that role. The mechanism behind the drift is straightforward. A vendor invoices against the master agreement's rate card, but the actual staffing on the engagement includes roles, locations, or seniority levels the agreement prices differently, or a change order altered the scope without altering the invoice template. Nobody reconciles the two documents because they live in different systems: the SOW in a shared drive, the invoice in the ERP. What changes it is a defined audit sequence run against source documents rather than against the invoice alone: pull every SOW and change order, extract the rate card and milestone terms into a single reference sheet, and check each invoice line against that sheet before approval. The rest of this guide walks through that sequence step by step. ## 1. What documents do you need before starting the audit? **You need the master services agreement, every statement of work and change order signed against it, the current rate card by role and location, and twelve months of invoices with backup timesheets or milestone acceptance records. Without all four, you are auditing the invoice against itself, which only confirms the vendor's own math.** Start by assembling the master services agreement and every SOW executed under it, including superseded versions. A change order that revised scope six months ago still governs invoices issued before the change took effect, so keep both versions and note the effective date of each. Next, pull the rate card. Some agreements embed it inside the MSA; others attach it as a schedule that gets updated separately and does not always reach AP. If the version AP has on file predates the vendor's last rate increase, you are matching against a stale reference before you even open an invoice. Finally, pull invoice backup: timesheets for time-and-materials work, milestone acceptance sign-offs for fixed-fee work. An invoice without backup is not auditable; it is only payable on trust. - **Master services agreement:** The base contract terms: payment terms, rate escalation clauses, and any caps that apply across all SOWs. - **Statements of work and change orders:** The specific scope, deliverables, and pricing for each engagement, including dated revisions. - **Current rate card:** Role, seniority, and location pricing tiers, with an effective date for each version. - **Invoice backup:** Timesheets or milestone acceptance records supporting each invoice line. ## 2. How do you check a time-and-materials line against the rate card? **Match each billed resource to a named role and seniority tier in the rate card, then confirm the hourly rate on the invoice equals the rate card's figure for that tier and location. A mismatch is either a billing error or an undocumented rate change, and both need a vendor response before payment.** Build a reference sheet listing every role the rate card defines, its rate by location, and any seniority modifiers the agreement allows. Then, for each invoice line, identify the individual or role code billed and look up the corresponding rate card entry. Watch for role reclassification: a vendor short-staffed on a senior resource may bill a junior consultant at the senior rate, or bill a resource working remotely at an onsite location's higher rate. Neither shows up in three-way matching because the PO and receipt confirm hours delivered, not the rate applied to those hours. Also check the escalation clause. Many MSAs cap annual rate increases at a fixed percentage or tie them to an index. If the current invoice reflects an increase larger than the clause allows, or an increase applied before its effective date, that is a contract compliance finding, not a pricing dispute. ## 3. How do you check a fixed-fee or milestone invoice? **Confirm the milestone billed actually appears in the SOW's deliverables schedule, that it was formally accepted before invoicing, and that the amount matches the SOW's payment schedule rather than an even split of the total contract value. Milestone invoicing drifts when acceptance and billing happen on different clocks. Treat each check as independent: a correct deliverable name with no acceptance record is still a finding, and a correct amount against the wrong schedule is still a finding.** Fixed-fee engagements bill against a payment schedule tied to deliverables, not hours worked. The first check is whether the milestone named on the invoice exists in the SOW at all. Vendors sometimes invoice for a phase using different language than the contract, which makes matching impossible without a side-by-side read. The second check is acceptance. Many SOWs require a written sign-off, often from a named project sponsor, before a milestone invoice is valid. If no acceptance record exists, the invoice was issued ahead of the contractual trigger. The third check is amount. A SOW with an uneven payment schedule, weighted toward the final milestone for example, should not be invoiced in equal installments. Compare each invoice against the SOW's own schedule, not against the total contract value divided by the number of milestones. ## 4. How do you handle a change order that altered scope mid-engagement? **Treat every change order as a new pricing baseline: confirm the invoice issued after its effective date reflects the revised scope, rate, or cap, and confirm no invoice after that date still bills against the terms the change order replaced. Overlap between old and new terms is where this category's drift concentrates.** A change order rarely rewrites the whole SOW. It usually adjusts one term: added headcount, a new rate for a new role, an extended end date, or a revised not-to-exceed cap. The risk is that the invoicing system does not update in step with the contract. List every change order chronologically with its effective date, and line up invoices against that timeline. An invoice dated after a change order's effective date should reflect its terms; one dated before should still reflect the prior terms. A vendor invoice template that pulls from a single stored rate table can miss this transition in either direction. Also check for [a not-to-exceed cap](/guides/rate-card-enforcement-why-approved-timesheets-still-produce) on the change order itself, separate from any cap on the original SOW. Two caps on the same engagement is a common source of confusion, and an invoice can breach the newer cap while appearing compliant against the older one. ## 5. How do you tell margin drift apart from a legitimate rate increase? **A rate change is legitimate when it traces to a clause in the signed agreement: an escalation schedule, an index tie, or a documented amendment. It is drift when the invoice reflects a higher rate with no corresponding contract language, or an increase that exceeds what the clause allows. The test is documentation, not size: a large increase with a clause behind it is compliant, and a small one without a clause is still a finding.** The distinction is not the size of the increase; it is whether the increase has a contractual basis. Pull the escalation clause first. Some agreements permit an annual increase up to a stated percentage or tied to a published index; an invoice reflecting exactly that increase, on schedule, is compliant. An increase becomes drift when it exceeds the clause's ceiling, arrives before the clause's effective date, or has no clause behind it at all. It is also drift when the increase was verbally agreed with a project manager but never documented in an amendment, because AP has no record against which to verify it. When you find an increase with no traceable basis, treat it as a finding requiring vendor confirmation rather than an assumed error. The vendor may hold documentation that never reached procurement, and the resolution is often a paperwork gap rather than an overcharge. ## 6. What do you do once you find a discrepancy? **Document the discrepancy against the specific contract clause it violates, hold the disputed line rather than the full invoice, and route it to the vendor with the SOW or rate card excerpt attached. Then log the finding so the same error does not recur on the next invoice from the same vendor.** Isolate the disputed line and pay the undisputed portion of the invoice on schedule. Holding an entire invoice over one line damages the vendor relationship and slows recovery of the parts that were correct. Write the dispute with the contract citation attached: the SOW section, the rate card row, or the change order clause the invoice fails to match. A dispute without a citation reads as a negotiating position; one with a citation reads as a documented finding, and vendors resolve it faster. Finally, log the finding by vendor and category. If the same rate mismatch appears again on a later invoice, the issue is not a one-time billing error, it is a control gap on the vendor's side or on yours, and it belongs on [the next quarterly review](/guides/the-quarterly-margin-drift-review-a-control-design-pattern) rather than being re-discovered each cycle. For the wider pattern this sits inside, start with the [margin drift](/guides/contract-compliance-controls-p2p) guide. ## 7. Frequently Asked Questions (People Also Ask) ### What is the fastest way to spot a stale rate card in an IT services contract? Compare the effective date on the rate card AP has on file against the date of the vendor's most recent rate increase notice. If the notice postdates the file copy, AP is matching invoices against superseded pricing until someone pulls the current schedule. ### Can a vendor legally bill a junior resource at a senior rate? Only if the SOW or rate card defines the role by function rather than by named seniority tier, or if a documented substitution was approved. Absent that, billing a junior consultant at a senior rate is a mismatch between the resource delivered and the rate charged, and it is a valid dispute. ### Do change orders need to be signed to be enforceable against an invoice? Treat an unsigned or verbally agreed change as unenforceable for audit purposes. If AP cannot point to a signed document changing the scope, rate, or cap, the original SOW terms still govern the invoice, regardless of what was discussed in a meeting. ### How do you handle a milestone invoice with no acceptance sign-off on file? Hold the invoice and request the acceptance record from the project sponsor named in the SOW. If none exists, the invoice was issued ahead of its contractual trigger and should not be paid until acceptance is documented, even if the deliverable itself is not in dispute. ### What is the difference between a not-to-exceed cap and a rate card? A rate card sets the price per unit of work: an hourly rate by role and location. A not-to-exceed cap sets a ceiling on total billing for a phase or engagement regardless of hours logged. An invoice can comply with the rate card and still breach the cap. ### Should AP dispute a whole invoice or just the affected line? Dispute and hold only the affected line. Paying the undisputed portion on schedule keeps the vendor relationship intact and avoids delaying payment for work that was billed correctly. ### Where do blended rate tables cause the most confusion in an audit? Blended rates combine multiple roles into a single hourly figure, which hides whether the underlying mix of seniority and location matches what the SOW assumed. Ask the vendor for the unblended breakdown behind any blended rate before accepting it as compliant. ### How long should an IT services contract file be kept for audit purposes? Keep the master services agreement, every SOW and change order version, and the rate card history for as long as invoices tied to them remain payable or disputable, typically the full contract term plus the period allowed for post-payment audit under the agreement. ### What counts as sufficient backup for a time-and-materials invoice? A timesheet identifying the individual or role, hours worked, and the engagement or milestone the hours were logged against. An invoice total with no supporting timesheet is not auditable against the rate card. ### Is a verbal rate increase from a project manager ever valid? Not for audit purposes. If the increase is not captured in a signed amendment or change order, AP has no document to verify the rate against, and the invoice should be treated as reflecting an undocumented increase until it is put in writing. ### Is contract complexity quietly draining your operating margin? A small systematic drift between your negotiated contracts and your actual vendor billing compounds quietly across a year of invoices. Stop guessing at your exposure and run a targeted audit. **[Take the Free Screener → https://valuexpa.com/margin-drift-screener](https://valuexpa.com/margin-drift-screener)** ## Executive Summary IT and professional services invoices carry more unstructured contract terms than almost any other indirect category: statements of work with milestone triggers, change orders that alter scope mid-engagement, and rate cards with role-level tiers that shift by seniority or location. Three-way matching checks the invoice against the purchase order and receipt; it does not test whether the resource billed matches the rate the SOW specifies for that role. The mechanism behind the drift is straightforward. A vendor invoices against the master agreement's rate card, but the actual staffing on the engagement includes roles, locations, or seniority levels the agreement prices differently, or a change order altered the scope without altering the invoice template. Nobody reconciles the two documents because they live in different systems: the SOW in a shared drive, the invoice in the ERP. What changes it is a defined audit sequence run against source documents rather than against the invoice alone: pull every SOW and change order, extract the rate card and milestone terms into a single reference sheet, and check each invoice line against that sheet before approval. The rest of this guide walks through that sequence step by step. ## 1. What documents do you need before starting the audit? You need the master services agreement, every statement of work and change order signed against it, the current rate card by role and location, and twelve months of invoices with backup timesheets or milestone acceptance records. Without all four, you are auditing the invoice against itself, which only confirms the vendor's own math. Start by assembling the master services agreement and every SOW executed under it, including superseded versions. A change order that revised scope six months ago still governs invoices issued before the change took effect, so keep both versions and note the effective date of each. Next, pull the rate card. Some agreements embed it inside the MSA; others attach it as a schedule that gets updated separately and does not always reach AP. If the version AP has on file predates the vendor's last rate increase, you are matching against a stale reference before you even open an invoice. Finally, pull invoice backup: timesheets for time-and-materials work, milestone acceptance sign-offs for fixed-fee work. An invoice without backup is not auditable; it is only payable on trust. - Master services agreement: The base contract terms: payment terms, rate escalation clauses, and any caps that apply across all SOWs. - Statements of work and change orders: The specific scope, deliverables, and pricing for each engagement, including dated revisions. - Current rate card: Role, seniority, and location pricing tiers, with an effective date for each version. - Invoice backup: Timesheets or milestone acceptance records supporting each invoice line. ## 2. How do you check a time-and-materials line against the rate card? Match each billed resource to a named role and seniority tier in the rate card, then confirm the hourly rate on the invoice equals the rate card's figure for that tier and location. A mismatch is either a billing error or an undocumented rate change, and both need a vendor response before payment. Build a reference sheet listing every role the rate card defines, its rate by location, and any seniority modifiers the agreement allows. Then, for each invoice line, identify the individual or role code billed and look up the corresponding rate card entry. Watch for role reclassification: a vendor short-staffed on a senior resource may bill a junior consultant at the senior rate, or bill a resource working remotely at an onsite location's higher rate. Neither shows up in three-way matching because the PO and receipt confirm hours delivered, not the rate applied to those hours. Also check the escalation clause. Many MSAs cap annual rate increases at a fixed percentage or tie them to an index. If the current invoice reflects an increase larger than the clause allows, or an increase applied before its effective date, that is a contract compliance finding, not a pricing dispute. ## 3. How do you check a fixed-fee or milestone invoice? Confirm the milestone billed actually appears in the SOW's deliverables schedule, that it was formally accepted before invoicing, and that the amount matches the SOW's payment schedule rather than an even split of the total contract value. Milestone invoicing drifts when acceptance and billing happen on different clocks. Treat each check as independent: a correct deliverable name with no acceptance record is still a finding, and a correct amount against the wrong schedule is still a finding. Fixed-fee engagements bill against a payment schedule tied to deliverables, not hours worked. The first check is whether the milestone named on the invoice exists in the SOW at all. Vendors sometimes invoice for a phase using different language than the contract, which makes matching impossible without a side-by-side read. The second check is acceptance. Many SOWs require a written sign-off, often from a named project sponsor, before a milestone invoice is valid. If no acceptance record exists, the invoice was issued ahead of the contractual trigger. The third check is amount. A SOW with an uneven payment schedule, weighted toward the final milestone for example, should not be invoiced in equal installments. Compare each invoice against the SOW's own schedule, not against the total contract value divided by the number of milestones. ## 4. How do you handle a change order that altered scope mid-engagement? Treat every change order as a new pricing baseline: confirm the invoice issued after its effective date reflects the revised scope, rate, or cap, and confirm no invoice after that date still bills against the terms the change order replaced. Overlap between old and new terms is where this category's drift concentrates. A change order rarely rewrites the whole SOW. It usually adjusts one term: added headcount, a new rate for a new role, an extended end date, or a revised not-to-exceed cap. The risk is that the invoicing system does not update in step with the contract. List every change order chronologically with its effective date, and line up invoices against that timeline. An invoice dated after a change order's effective date should reflect its terms; one dated before should still reflect the prior terms. A vendor invoice template that pulls from a single stored rate table can miss this transition in either direction. Also check for [a not-to-exceed cap](/guides/rate-card-enforcement-why-approved-timesheets-still-produce) on the change order itself, separate from any cap on the original SOW. Two caps on the same engagement is a common source of confusion, and an invoice can breach the newer cap while appearing compliant against the older one. ## 5. How do you tell margin drift apart from a legitimate rate increase? A rate change is legitimate when it traces to a clause in the signed agreement: an escalation schedule, an index tie, or a documented amendment. It is drift when the invoice reflects a higher rate with no corresponding contract language, or an increase that exceeds what the clause allows. The test is documentation, not size: a large increase with a clause behind it is compliant, and a small one without a clause is still a finding. The distinction is not the size of the increase; it is whether the increase has a contractual basis. Pull the escalation clause first. Some agreements permit an annual increase up to a stated percentage or tied to a published index; an invoice reflecting exactly that increase, on schedule, is compliant. An increase becomes drift when it exceeds the clause's ceiling, arrives before the clause's effective date, or has no clause behind it at all. It is also drift when the increase was verbally agreed with a project manager but never documented in an amendment, because AP has no record against which to verify it. When you find an increase with no traceable basis, treat it as a finding requiring vendor confirmation rather than an assumed error. The vendor may hold documentation that never reached procurement, and the resolution is often a paperwork gap rather than an overcharge. ## 6. What do you do once you find a discrepancy? Document the discrepancy against the specific contract clause it violates, hold the disputed line rather than the full invoice, and route it to the vendor with the SOW or rate card excerpt attached. Then log the finding so the same error does not recur on the next invoice from the same vendor. Isolate the disputed line and pay the undisputed portion of the invoice on schedule. Holding an entire invoice over one line damages the vendor relationship and slows recovery of the parts that were correct. Write the dispute with the contract citation attached: the SOW section, the rate card row, or the change order clause the invoice fails to match. A dispute without a citation reads as a negotiating position; one with a citation reads as a documented finding, and vendors resolve it faster. Finally, log the finding by vendor and category. If the same rate mismatch appears again on a later invoice, the issue is not a one-time billing error, it is a control gap on the vendor's side or on yours, and it belongs on [the next quarterly review](/guides/the-quarterly-margin-drift-review-a-control-design-pattern) rather than being re-discovered each cycle. For the wider pattern this sits inside, start with the [margin drift](/guides/contract-compliance-controls-p2p) guide. ## Common questions ### What is the fastest way to spot a stale rate card in an IT services contract? Compare the effective date on the rate card AP has on file against the date of the vendor's most recent rate increase notice. If the notice postdates the file copy, AP is matching invoices against superseded pricing until someone pulls the current schedule. ### Can a vendor legally bill a junior resource at a senior rate? Only if the SOW or rate card defines the role by function rather than by named seniority tier, or if a documented substitution was approved. Absent that, billing a junior consultant at a senior rate is a mismatch between the resource delivered and the rate charged, and it is a valid dispute. ### Do change orders need to be signed to be enforceable against an invoice? Treat an unsigned or verbally agreed change as unenforceable for audit purposes. If AP cannot point to a signed document changing the scope, rate, or cap, the original SOW terms still govern the invoice, regardless of what was discussed in a meeting. ### How do you handle a milestone invoice with no acceptance sign-off on file? Hold the invoice and request the acceptance record from the project sponsor named in the SOW. If none exists, the invoice was issued ahead of its contractual trigger and should not be paid until acceptance is documented, even if the deliverable itself is not in dispute. ### What is the difference between a not-to-exceed cap and a rate card? A rate card sets the price per unit of work: an hourly rate by role and location. A not-to-exceed cap sets a ceiling on total billing for a phase or engagement regardless of hours logged. An invoice can comply with the rate card and still breach the cap. --- ValueXPA runs a fixed-scope Margin Drift Diagnostic that validates every service vendor invoice against contract terms, for $100M+ US industrial manufacturers and distributors. Two to four weeks. The client retains 100% of recoveries. https://valuexpa.com/contact-us