What reports should a CFO see on vendor invoice exceptions?

Executive Summary

A CFO needs four things on a vendor invoice exception report, and most companies have one. The first is a payment-blocking exception log from AP: what stopped an invoice from paying this week, by vendor and dollar amount. The second is a contract compliance report: what invoices paid correctly against a three-way match but incorrectly against the underlying contract, because those two tests are not the same.

The third is an aging and ownership view: who is responsible for resolving each open exception, and how long it has sat open.

The fourth is a recovery and prevention summary: what was found, what was recovered, and what changed in the process so the same exception does not recur.

The mechanism that breaks this stack is simple. Three-way matching checks the invoice against the purchase order and the receipt. It does not check the invoice against the rate card, the volume tier, the rebate clause, or the surcharge schedule sitting in a PDF outside the ERP.

Those checks require a separate report, built on contract terms rather than transaction records, and most AP systems were never configured to produce one.

Without that second report, a CFO sees a clean exception queue and a leaking margin line at the same time, and has no report that explains the gap between them. The fix is not a new AP tool. It is adding the contract-compliance layer as a distinct report, with its own owner, its own aging clock, and its own line to the board.

1. What does a standard AP exception report actually show?

A standard AP exception report shows invoices that failed a three-way match: the invoice does not agree with the purchase order, the receipt, or both, or it duplicates an invoice number already paid. It is built from transaction data inside the ERP and stops an invoice before payment. It says nothing about whether a cleanly matched invoice still overcharges against the vendor's contract, because that comparison sits outside the fields the match engine reads.

The report is valuable and incomplete for the same reason. It only tests what the ERP holds: PO, receipt, invoice. A surcharge that was never on the PO, a rate that crept above the rate card, or a rebate that was never applied all pass the match cleanly because nothing in the ERP disagrees with them.

This is why a CFO reviewing only this report can see zero open exceptions and still be paying above contract. The report is answering a narrower question than the one the CFO is asking.

A useful version of this report still belongs in the stack. It should show count, dollar value, and vendor concentration weekly, not just a queue AP works through.

2. Why isn't a clean three-way match the same as a compliant invoice?

A three-way match confirms the invoice agrees with the purchase order and the receipt. It does not test the invoice against the vendor contract: the rate card, the volume tier trigger, the not-to-exceed cap, or the rebate clause. Those terms often live in a separate PDF the ERP never reads.

An invoice can clear the match and still charge above what the contract allows, and no exception fires because nothing inside the ERP contradicts it.

Take a freight surcharge. It appears on the PO because the carrier submitted it, it matches the receipt because the shipment happened, and it matches the invoice because the carrier billed what it quoted. Three fields agree. The only thing that disagrees is the contract, which said the surcharge should have expired two quarters ago.

The same pattern shows up in contract labor rate escalations, MRO catalog pricing, and rebate tiers that were earned but never credited. Each of these needs a distinct report line: invoices matched cleanly but flagged against contract terms.

This is the report most companies do not have, and it is where a margin drift diagnostic starts, because it compares invoices to the contract library rather than to the PO.

3. Who should own each exception on the report?

Ownership belongs on the report itself, not in a separate tracker. AP owns match exceptions: missing documentation, duplicate numbers, receipt mismatches. Procurement or category owners resolve contract compliance exceptions, because closing them requires a vendor conversation about a rate card or a rebate, not a data correction.

Controllership owns the recovery and prevention line: what was credited back and what control now prevents recurrence.

An exception with no named owner ages indefinitely, because it belongs to whoever happens to notice it next. A report that lists dollar value without an owner column produces exactly this: a growing queue nobody is accountable for closing.

Assigning ownership by exception type also fixes a common misrouting problem. A rate card violation sent to AP for resolution sits there, because AP has no authority to renegotiate a vendor rate. It needs to route to whoever owns that vendor relationship.

The report should carry an owner and a target resolution date on every open line, the same discipline applied to any other open item on a controller's close checklist.

4. How should aging be tracked across exception types?

Aging should be tracked separately by exception type, because the two categories resolve on different timelines. A match exception, a missing receipt or duplicate invoice number, should close within days; anything open past a week signals a process breakdown. A contract compliance exception, a rate card or rebate dispute, routinely takes longer because it requires a vendor conversation, so the aging bands and escalation triggers for each type should differ.

Blending both types into one aging bucket hides the more expensive problem. A ninety-day-old rate card dispute and a ninety-day-old missing receipt look identical on a single aging column, but one is a documentation gap and the other is uncollected money sitting on the books.

A useful aging view splits by type, shows the oldest open item in each bucket, and shows the dollar value aging past a set threshold, not just the count. Count-only aging rewards closing small items fast while a large one sits untouched.

Escalation should trigger on dollar value crossing an age threshold, not age alone, so a large exception cannot sit quietly behind a queue of small, fast-closing ones.

5. What belongs on the recovery and prevention summary?

A recovery and prevention summary shows three things: what was found, what was actually credited or recovered, and what changed in the process, contract, or control so the same exception cannot recur. Found and recovered are frequently different numbers, since not every identified overcharge results in a credit. The prevention column is what separates a report that closes the loop from one that only documents leakage after it happened.

Found-but-not-recovered is its own useful line. It shows where a vendor disputed a claim, where a credit memo was never issued, or where the finding was too recent to have cleared yet. Reporting only recovered dollars understates the scope of what compliance work actually surfaced.

The prevention column is where the report earns its place on a board agenda rather than an AP status meeting. A closed exception with no process change behind it will recur on the next invoice cycle from the same vendor.

This is also where the report connects to the broader margin picture, distinct from a category-by-category breakdown: a CFO explaining a gross margin gap to a board needs this summary as supporting evidence, not the category detail behind it.

6. How often should this reporting stack reach the CFO?

The AP match exception log belongs in a weekly operating review, since it is transactional and moves daily. The contract compliance report and the recovery and prevention summary belong on a monthly cadence, aligned to close, since resolving them takes longer and the dollar values are what a CFO carries into a margin explanation. A quarterly rollup of all three, by vendor and category, supports board-level reporting.

Matching cadence to resolution speed prevents two failure modes. Reviewing contract compliance weekly produces a report with the same few unresolved items every week, which reads as stalled rather than working. Reviewing match exceptions only monthly lets a process breakdown run for weeks before anyone notices.

The quarterly rollup is the version worth building once and reusing: total exceptions by type, dollar value found versus recovered, and the aging distribution. It is the version that also supports a multi-entity close process, where the same categories need to roll up consistently across locations.

A CFO who only sees the quarterly rollup and never the underlying detail will not catch a misrouted or misowned exception until it has already aged past the point of easy recovery.

For the wider pattern this sits inside, start with the margin drift guide.

7. Frequently Asked Questions (People Also Ask)

Is a three-way match report enough for a CFO to sign off on AP controls?

No. A three-way match confirms the invoice agrees with the purchase order and the receipt. It does not test the invoice against the vendor contract, so an invoice can clear the match and still overcharge against a rate card or missed rebate. A CFO needs a separate contract compliance report alongside it.

Should exception reports be split by vendor or by exception type?

Both views matter for different reasons. Splitting by exception type shows which control is breaking down, match failures versus contract compliance gaps. Splitting by vendor shows where to focus a renegotiation or a compliance conversation. A monthly report that only shows one view is missing the other.

Who should present the contract compliance report to the CFO?

Whoever owns the contract library and the vendor relationships it covers, typically procurement or category management, not AP. AP can confirm an invoice matched its PO. Only the team that owns the contract terms can confirm the invoice matched the contract.

What is the difference between found and recovered on the summary?

Found is the dollar value of an identified overcharge or missed credit. Recovered is what was actually credited or refunded. A vendor may dispute a finding, delay a credit memo, or the finding may be too recent to have cleared, so recovered is almost always a smaller number than found, and both should be reported.

How long should an open contract compliance exception be allowed to age before escalation?

There is no single fixed number that applies to every company; it depends on the vendor relationship and dollar value involved. What matters is that the aging threshold triggers on dollar value crossing an age band, not age alone, so a large unresolved item cannot sit quietly behind a queue of small closed ones.

Does a clean AP exception queue mean there is no margin drift?

No. A clean AP exception queue means nothing failed a three-way match. Margin drift is the gap between the contract and the invoice, which a three-way match does not test. A CFO can have zero AP exceptions and still be paying above contract on rate cards, surcharges, or rebate clauses.

Should the exception report include indirect spend categories like freight and contract labor?

Yes, and each category needs its own contract terms tracked, since a freight surcharge schedule and a contract labor rate escalation clause are structured differently and drift in different ways. A single generic exception report field cannot capture both accurately.

What should change after a recovery and prevention summary identifies a recurring exception?

The specific control that let it through should change: an added rate-card check, a corrected PO template, a renegotiated ambiguous clause, or a new approval step. Closing the dollar amount without a process change means the same exception recurs on the next invoice cycle from that vendor.

Can a CFO build this reporting stack from existing AP software alone?

AP software will reliably produce the match exception log, because that is what it is built to test. The contract compliance layer requires comparing invoices against contract terms that typically live outside the ERP, in PDFs and rate schedules, which most AP systems are not configured to read.