Indirect spend control: a Controller guide

Executive Summary

Indirect spend invoices post correctly against the purchase order and still carry terms the contract does not support. A rate that expired, a surcharge that outlived its trigger event, a volume tier never applied. Standard AP controls were not built to catch this because they check the invoice against internal records, not against the external contract PDF sitting outside the ERP.

The mechanism is structural, not a lapse by any one person. Contract terms live in documents. Invoice review lives in a system. Nobody owns the translation between the two, so an invoice can be perfectly matched to a PO and still be wrong.

For a Controller, the practical response is not more AP headcount. It is a periodic contract-to-invoice review, sized to your indirect spend categories, that produces evidence for close and a defensible answer when audit or the board asks why margin moved.

1. What does indirect spend control actually mean?

Indirect spend control is the discipline of verifying that every recurring vendor invoice, freight, MRO, contract labor, IT services, still matches the contract that governs it, not just the PO that authorized the purchase. It covers rate cards, volume tiers, rebate clauses, surcharge schedules, and not-to-exceed caps. Where AP controls confirm quantity and unit price against a PO, spend control confirms the PO itself, and every recurring charge on it, against the underlying agreement.

Most Controllers already run strong transactional controls: three-way match, approval hierarchies, duplicate payment checks inside the ERP. These catch the errors they were built to catch. A line item billed twice on the same invoice. A quantity that exceeds the receipt. What they do not test is whether the rate itself is still the rate the vendor agreed to.

That gap exists because contract terms are unstructured. A rebate clause sits in a PDF signed two years ago. A fuel surcharge schedule sits in a carrier's tariff document. Neither is loaded into the ERP as a rule the system checks automatically, so the invoice passes every internal test and still overcharges against the external agreement.

Spend control closes that gap by adding one more comparison: invoice against contract, not just invoice against PO. It does not replace your existing AP controls. It sits alongside them, covering the exact area they were never designed to cover.

2. Why does indirect spend drift past standard AP review?

Indirect spend drifts because the control that would catch it does not exist inside the transaction system. AP review confirms the invoice matches the purchase order and the received quantity. It has no mechanism to check a surcharge's expiration condition, a minimum volume commitment, or a rebate accrual, because those terms live in a contract document, not a system field.

The invoice can be internally correct and contractually wrong at the same time.

Take a carrier fuel surcharge. It is set when diesel prices are high and tied to an index. The index falls. The surcharge, structured to fall with it, does not, because nobody re-checks the clause once the invoice starts posting cleanly. AP has no reason to flag it: the PO matches, the receipt matches, the amount is within the usual range.

The same pattern applies to a volume-tier rate card in MRO purchasing, a not-to-exceed cap in a staffing contract, or a rebate that accrues but is never claimed because no one tracks the threshold. Each is a contract term with no home in the transaction system.

This is a general information point, not a legal one: your contract almost certainly gives you the right to dispute these charges. The problem is operational, not legal, finding the discrepancy before the dispute window closes.

3. Which categories should a Controller prioritize first?

Freight and 3PL, contract labor and staffing, maintenance and repair, IT and professional services, MRO and Class C supplies, and calibration and safety compliance are the categories where contract terms are most often unstructured and recurring. Each carries its own mechanism for drift: freight through surcharge schedules, labor through NTE caps, MRO through volume tiers. None ranks above another in scale; each is worth reviewing on its own terms.

A Controller does not need to review every category with equal depth every close cycle. Prioritize by two factors: dollar volume flowing through the category, and how much of the contract's terms are unstructured, living outside the ERP as a PDF or an email rather than a system rule.

Freight and contract labor tend to combine both factors for an industrial manufacturer: high recurring spend, and terms that are genuinely hard to encode into a purchasing system. MRO and calibration often carry lower per-invoice dollar amounts but higher invoice volume, which makes manual review impractical without a defined sampling method.

Whichever categories you start with, treat the exercise as additive coverage rather than a one-time cleanup. The categories that drift once will drift again unless something changes structurally.

• Freight and 3PL: Fuel surcharges, accessorial charges, and lane rates that outlive the index or event that justified them.
• Contract labor and staffing: Bill rates that exceed the contracted rate card, and not-to-exceed caps applied inconsistently across invoices.
• Maintenance and repair: Service call minimums and parts markups that drift from the master service agreement over time.
• IT and professional services: Renewal invoices that carry a prior rate increase never authorized in the current statement of work.
• MRO and Class C supplies: Volume-tier pricing that never steps down once your purchase volume crosses the contracted threshold.
• Calibration and safety compliance: Recurring service fees that continue after equipment is decommissioned or a contract term expires.

4. How should a Controller build a repeatable review into the close cycle?

Build the review as a defined, recurring step rather than an ad hoc investigation triggered by a margin surprise. Assign ownership of the contract-to-invoice comparison to a named role, set a sampling method sized to invoice volume, and produce a short evidence file each period: what was checked, what was found, what was disputed. That file is what makes the control auditable and what protects you the next time margin moves and someone asks why.

A repeatable review has three parts. First, a contract inventory: which vendor agreements exist, where they are stored, and when they renew or expire. Without this, nobody knows what to check the invoice against.

Second, a sampling method appropriate to volume. Not every freight invoice needs individual review, but a defined percentage or a threshold above which every invoice is checked keeps the review honest and repeatable rather than reactive.

Third, an evidence trail. Record what was reviewed, what discrepancies were found, and how each was resolved: credit memo issued, dispute filed, or accepted as within tolerance. This evidence is what turns a finding into something you can explain at close, to an auditor, or to the board, rather than an isolated catch that raises more questions than it answers.

5. Does a periodic audit replace the need for ongoing controls?

No. A periodic audit tests history, typically 12 to 18 months of invoices, and quantifies what has already leaked. It does not by itself prevent the same drift from recurring next quarter.

A forward control, whether a manual review cadence or a system rule, tests the next invoice as it arrives. Controllers who run a one-time audit and stop there recover the historical leakage and then watch the same drift start accumulating again immediately.

The two are complementary, not substitutes. A retrospective diagnostic, reviewing 12 to 18 months of historical spend across contracts and invoices, tells you where the leakage already happened and how much of it is recoverable through credit memos or vendor disputes. That is valuable, but it is backward-looking by design.

What prevents recurrence is a forward-looking step: someone, or some system, checking each new invoice against the current contract terms before it posts, or shortly after. Without that step, the same surcharge that overstayed its index will simply restart next month, on a new invoice, against the same uncorrected rate.

For a Controller building the case internally, frame the two together: quantify the past, then name what specifically changes so the same gap does not reopen. A number without a named prevention step reads as a one-time recovery, not a control improvement.

6. What should a Controller ask before hiring outside help for this?

Ask what the engagement actually reviews, on what basis it is priced, and who retains the recovered dollars. A fixed-scope engagement reviewing invoice-to-contract compliance across your indirect spend categories, delivering a prioritized roadmap in 2 to 4 weeks across ValueXPA diagnostics, differs from a contingency firm that takes a share of whatever it finds. Both models exist in the market; know which one you are buying before you sign.

A contingency-fee recovery audit firm is paid from what it finds, commonly 25% to 50% of recoveries across the industry. That model works well when the primary goal is a one-time cash recovery and you are comfortable ceding a share of it. It is a legitimate choice, and for a company with no internal bandwidth at all, it may be the only realistic starting point.

A fixed-scope diagnostic prices the engagement upfront regardless of what it finds, so the client retains 100% of any recovery identified. It also typically covers more ground: retrospective recovery, forward contract compliance, and a controls roadmap, in one engagement rather than three separate purchases.

Either way, ask specifically what categories are in scope, what the deliverable looks like, and whether the engagement leaves you with a repeatable control or just a one-time list of credit memos to chase.

For the wider pattern this sits inside, start with the margin drift guide. See also the six categories drift hides in and margin drift vs. legitimate price increases: how to tell them apart.

7. Frequently Asked Questions (People Also Ask)

What is the difference between AP controls and indirect spend control?

AP controls, like three-way matching, confirm an invoice against the purchase order and the receipt. Indirect spend control adds a further comparison: the invoice against the underlying contract terms, rate card, surcharge schedule, or rebate clause, which AP systems do not check automatically.

Which indirect spend categories carry the most contract risk?

Freight and 3PL, contract labor and staffing, maintenance and repair, IT and professional services, MRO and Class C supplies, and calibration and safety compliance. Each carries its own drift mechanism, tied to surcharge schedules, NTE caps, or volume tiers, and each is worth reviewing on its own terms.

How far back should a Controller look when reviewing indirect spend?

A typical retrospective review covers 12 to 18 months of historical invoices and contracts, across ValueXPA diagnostics. That window is usually enough to surface recurring drift patterns without pulling in data too old to be commercially actionable for a credit memo or vendor dispute.

Can this review be done with existing AP staff, or does it need outside help?

It can be done internally if someone owns the contract inventory and has time to build a sampling method. Many Controllers bring in outside help for the initial review, since it requires reading unstructured contract terms across many vendors, then keep the resulting cadence in-house.

Is a fixed-scope diagnostic the same thing as a contingency-fee recovery audit?

No. A contingency-fee firm is paid a share of what it recovers, commonly 25% to 50%. A fixed-scope diagnostic is priced upfront regardless of findings, so the client retains 100% of any recovery, and typically covers contract compliance and a controls roadmap in addition to recovery.

What should the deliverable of an indirect spend review look like?

A usable deliverable names specific findings by vendor and category, states the contract clause each finding violates, and includes a prioritized roadmap for both recovery and prevention, delivered in 2 to 4 weeks across ValueXPA diagnostics. A list of dollar amounts with no clause reference is not enough to act on or defend at audit.

Does this review require legal sign-off before disputing a vendor invoice?

This is general information, not legal advice. Most contracts give the buyer explicit rights to dispute a non-compliant charge, but your legal or procurement team should confirm the specific dispute process and any notice deadlines in your vendor agreement before you act.

How does a Controller know if the review is working?

Track two things over successive periods: the dollar value of new findings, which should decline as prevention improves, and whether the same vendor or clause reappears. A recurring finding on the same vendor means the forward control, not just the audit, needs attention.