Vendor invoice checks for a new CFO's first 100 days

Executive Summary

A new CFO inherits vendor invoices that the outgoing regime already called normal. Margin drift sits inside freight accessorials, contract labor rate tables, MRO catalogs and IT service agreements that nobody has re-read against the invoices in years. Contracts change through amendments, side letters and verbal renewals that never reach AP.

Invoices keep processing against whatever rate the ERP has on file, because closing that loop is not anyone's assigned job.

What changes it in the first 100 days is a fixed, time-boxed pull of vendor invoices against their underlying contracts, run before the CFO signs off on any budget, forecast or board narrative built on the prior team's numbers. This is not a full audit. It is five targeted checks: rate card match, PO and receipt tie-out, credit memo application, contract renewal terms, and duplicate payment exposure, each run against a defined sample rather than the whole ledger.

The output is a short list of vendors and dollar exposure the CFO can name in the first board meeting, with a stated basis for each figure. That list is worth more in week 12 than a full audit finished in month 8, because it is the evidence a new CFO uses to justify what comes next: a vendor renegotiation, a managed services contract, or a diagnostic scoped to the categories the sample flagged.

1. What should you check in a new CFO's first 100 days?

Check five things: whether current invoices bill at the contracted rate, whether every invoice ties to a purchase order and a receipt, whether earned credit memos and rebates were actually applied, whether any contract auto-renewed on terms nobody reviewed, and whether any vendor was paid twice for the same charge. Run each check on a defined sample of top vendors by spend, not the full ledger. A sample finished in three weeks beats a full audit finished in month eight.

Each of these five checks tests a different failure point, and each one is fast to run against a sample. Rate card match compares a sample of recent invoice line items to the current signed rate schedule for the vendor, not the schedule from the last renewal you can find in email. PO and receipt tie-out confirms the invoice quantity and price match what was ordered and what physically arrived.

Credit memo application checks whether rebates or returns the vendor owes were actually posted, or whether they are sitting in a spreadsheet nobody closed out.

Contract renewal terms means reading the actual document, not the summary someone wrote when it was signed, for auto-renewal clauses, rate escalators, and minimum volume commitments. Duplicate payment exposure is a data pull, not a judgment call: same vendor, same amount, same invoice number or date range, paid twice.

Run these on the 20 to 30 highest-spend service vendors first. That sample size is small enough to finish inside 100 days and large enough to surface a real number.

2. Why do these gaps survive a CFO transition in the first place?

Contract terms live in PDFs, side letters and email threads that never reach the ERP or AP's rate tables. The prior finance team built its processes around whatever rates were loaded years ago, and those processes ran without anyone re-testing the underlying contract. A transition is the one moment a new set of eyes reviews the invoice-to-contract relationship at all, which is exactly why the gap is still there to find and exactly why it will not be found without.

AP systems and three-way matching check the invoice against the purchase order and the goods receipt. That control confirms quantity and a stored price code. It does not test whether the stored price code still matches the current signed contract, or whether a surcharge clause expired eighteen months ago and the invoice never noticed.

A rate change that arrives as an amendment, a side letter, or a verbal agreement at a renewal meeting has no natural path into the ERP's rate table. Someone has to manually update it, and that update depends on someone connecting the new contract term to the specific invoice field it should change. When that connection breaks, the invoice keeps processing at the old rate indefinitely, and the control built to catch errors reports no error at all, because by its own definition nothing is wrong.

A leadership transition is one of the few moments this gets tested, because a new CFO has both the reason and the standing to ask for the underlying contract rather than accept the prior team's summary of it.

3. Which vendor categories should the first pull cover?

Pull freight and 3PL, contract labor and staffing, maintenance and repair, IT and professional services, and MRO and safety supply first, because these are the categories where rate schedules, volume tiers and surcharge tables sit outside the ERP in vendor-held documents. Each category has its own drift mechanism, so treat them as a list of separate checks rather than ranking one against another. A category with no dataset behind it cannot be called bigger or smaller than another honestly.

Freight and 3PL invoices carry accessorial charges and fuel surcharges defined in a tariff document the carrier holds, not the ERP. Contract labor and staffing invoices carry bill rates and overtime multipliers set in a master services agreement that AP rarely opens once signed. Maintenance and repair invoices carry not-to-exceed caps and scope definitions that get overridden verbally on site.

IT and professional services invoices carry auto-renewal clauses and tier pricing that step up at usage thresholds nobody is tracking. MRO and safety supply invoices carry catalog pricing that a vendor updates on their own schedule and expects the buyer to catch.

• Freight and 3PL: Accessorial charges and fuel surcharges defined in a carrier tariff outside the ERP.
• Contract labor and staffing: Bill rates and overtime multipliers set in a master agreement, not the timesheet system.
• Maintenance and repair: Not-to-exceed caps and scope limits that get overridden verbally at the job site.
• IT and professional services: Auto-renewal clauses and usage-tier pricing that steps up without a change order.
• MRO and safety supply: Catalog pricing the vendor updates on its own schedule.

4. How do you tell a real finding from a normal invoicing variance?

A real finding has a document trail: the signed contract term, the invoice line it should have controlled, and the dollar difference between what the contract says and what was billed. A normal variance is a price change properly reflected in an amendment everyone has, or a timing difference that nets to zero within a billing cycle. If you cannot point to the specific clause an invoice violates, treat it as unconfirmed and keep looking rather than reporting it as.

The discipline here matters because the first number a new CFO reports to the board sets the credibility bar for everything that follows. A finding without a cited contract clause is an assertion, not evidence, and a board member or auditor who asks for the source document will find out fast whether the number holds up.

Build each finding as a pair: the contract language, quoted directly, and the invoice line it contradicts, with the dollar gap between them. Where a vendor disputes the finding, the contract language resolves the dispute rather than a negotiation over who remembers the terms correctly.

This also protects against the opposite error, treating an ordinary price increase properly documented in a signed amendment as a finding. That kind of false positive costs credibility in exactly the same board meeting a real finding is meant to build it in.

5. Should you use internal AP staff, an outside audit, or software for this check?

Use internal staff when the CFO already trusts the AP team's independence and has the bandwidth to direct a focused pull within 100 days. Use an outside review when the transition itself makes internal objectivity hard to establish quickly, or when contract documents are scattered across an acquired entity's systems. Software that matches future invoices against configured rules is a forward control; it enforces whatever rules it is given and cannot by itself find drift already embedded in the last.

Internal AP staff know the vendor relationships and where documents are filed, which speeds up the pull. What they may not have is time protected from daily processing work, or full independence from decisions the prior finance team made that they were part of.

An outside review brings a fixed timeline and no stake in how the prior team's numbers looked. This matters most after an acquisition, when contract documents live in an acquired entity's systems the new CFO's own staff has not yet fully mapped, a scenario covered directly in post-acquisition vendor contract consolidation.

Software that checks invoices against configured rules going forward is a different tool solving a different problem. It cannot interpret a rebate clause sitting in a PDF outside the ERP, and it has nothing to say about the 12 to 18 months of invoices already paid before it was configured. That earlier period is exactly what a one-time review is built to test.

6. What should you tell the board about what you found?

Report the sample size, the dollar exposure found within that sample, and the specific categories it came from, and state plainly that the figure is a sample result, not a full-population estimate. Do not extrapolate a small sample to the whole vendor base without saying so. Recommend a next step scoped to the categories that showed exposure, whether that is a wider review, a contract renegotiation, or a forward control, rather than a vague commitment to fix accounts payable.

A board wants three things from this report: what was found, how confident the number is, and what happens next. State the sample explicitly, for example the number of vendors and invoices reviewed, so a reader can judge how far the finding generalizes rather than assuming it applies to every vendor in the ledger.

Separate the finding from the fix. The finding is retrospective: dollars already leaked in invoices already paid. The fix is forward: whichever categories showed exposure need either a contract renegotiation, a change to the PO matching rules, or a wider review of the same category across the full vendor base.

This distinction also protects a board narrative that ties recovered dollars into a margin bridge, which is worth building deliberately rather than folding into a generic cost-savings line, an approach covered in building a gross margin bridge that separates inflation from non-compliance.

For the wider pattern this sits inside, start with the margin drift guide. See also the six categories drift hides in and margin drift vs. legitimate price increases: how to tell them apart.

7. Frequently Asked Questions (People Also Ask)

How long should the first invoice review take a new CFO?

Scope it to 2 to 4 weeks for a sample of the top 20 to 30 service vendors by spend, across ValueXPA diagnostics. A longer timeline delays the board report without materially improving the sample's usefulness for deciding what happens next.

Should the review happen before or after the first board meeting?

Before, if the timeline allows it. A finding with a stated dollar exposure and sample size is stronger evidence for a board narrative than a promise to look into vendor spend later, and it lets the CFO frame the next 100 days around a specific plan rather than a general concern.

Do we need a full audit, or is a sample enough to start?

A sample is enough to start. A sample of the highest-spend vendors surfaces the categories worth investigating further, and a fuller review can follow once the CFO knows which categories and vendors actually warrant it.

What if the prior finance team already ran vendor audits?

Ask for the contract documents the prior audit tested against, not just its conclusions. A rate card audit is only as current as the contract version it was checked against, and a contract amendment signed after the last audit invalidates its findings for that vendor.

Can AP automation software catch this instead of a manual review?

AP automation and three-way matching test the invoice against the purchase order and receipt. They do not test whether the stored rate still matches the current signed contract, which is a different check that requires reading the contract document itself.

What counts as a legitimate invoice variance versus a finding worth reporting?

A legitimate variance has a signed amendment or documented price change behind it. A finding worth reporting has a contract clause the invoice contradicts, with a specific dollar gap. Anything without that document trail should stay unconfirmed rather than get reported as recovered dollars.

Which vendor categories are most worth checking first after an acquisition?

Start with categories where the acquired entity's contracts are least likely to have migrated cleanly into the new company's ERP: freight, contract labor, and maintenance agreements. Each has terms that live in vendor-held documents rather than the system of record.

Is this the same thing as a margin drift diagnostic?

It is a smaller, time-boxed version of the same idea, sized to fit inside a new CFO's first 100 days. A full diagnostic covers more vendors and categories and produces a prioritized roadmap; this checklist is the fast version a new CFO can run alone or direct staff to run.

What legal exposure does a vendor contract review carry?

This guide provides general information, not legal advice. Any dispute over contract interpretation, especially around auto-renewal or termination clauses, should go to counsel before a CFO acts on a finding.

How does this connect to a fractional CFO or managed AP arrangement?

A finding from this review often points to a control gap the current AP process was never built to catch, which is a reasonable trigger to evaluate a managed services arrangement scoped to the categories that showed exposure.