Three-Way Matching in Xero: Building PO, Receipt and Invoice Checks

An invoice arrives for 12 pallets at $340 each. The purchase order said 12 at $310. The warehouse signed for nine. Somewhere between those three documents is $1,428 of overbilling, and in most Australian SMEs the only thing standing between it and a paid bill is whether the person approving in Xero happens to remember what was ordered.

Three-way matching is the control that catches this automatically. It is also the single most commonly misbought capability in accounts payable, because the market sells it adjacent to something that looks similar and costs a fraction as much.

Capture and matching are different products

OCR or AI capture reads a supplier invoice and extracts the fields: supplier name, invoice number, date, GST, line items, total. It removes typing. It does not tell you the invoice is correct. A perfectly extracted invoice for goods you never received posts to Xero just as cleanly as a legitimate one.

Matching is the control layer. Two-way matching compares the invoice against the purchase order — did we agree to this price and quantity? Three-way matching adds the goods-received record — did it actually turn up? Lightyear's Australian plans add goods-received notes and three-way PO matching at the higher tier, which tells you something about where vendors place the line.

Xero itself is the clearest illustration. A current comparison describes Xero as providing AI-assisted bill capture, role-based approval and domestic bill payments, but states that three-way matching is not supported in the present version. You can have a thoroughly modern, paperless AP process in Xero and still have no mechanical check that what you are paying for arrived.

So the question is not "should we automate invoice entry". It is "do we want a typing-removal product or a control product", and the answer changes the budget by a factor of ten.

What the automated version looks like end to end

1. The purchase order has to exist, digitally

This is where most SME three-way matching projects actually fail. If POs live in a spreadsheet, in an email thread, or in the head of whoever rang the supplier, there is nothing to match against. The first real deliverable is usually a PO form — a simple internal app where a staff member raises a request against a supplier, a cost centre and an account code, it routes to whoever holds the delegation for that dollar value, and it lands as a structured record with a PO number.

Xero does have purchase orders, and for a single-entity business with modest volume they are enough. Where they fall short is delegated authority — different approval limits by person, by category, by project — and that is usually the trigger for a purpose-built form sitting in front of Xero rather than inside it.

2. Goods receipt happens where the goods are

A receipt record means someone at the point of delivery confirms what arrived against the PO: quantity received, date, condition, and a photo of the delivery docket. On a phone, at the loading dock or the site gate, not back at the office three days later from memory.

Partial deliveries are the normal case, not the exception. The receipt record has to support receiving 9 of 12 and leaving the PO open for the balance, or the matching logic downstream will reject every split shipment you take.

3. The invoice arrives and is captured

Supplier emails the invoice to a dedicated AP inbox. Capture extracts the header fields and the line items. Line-item extraction matters here in a way it does not for simple capture — you cannot match quantities and unit prices you have not read.

4. The match runs

The workflow locates the PO by number if the supplier quoted it, or by supplier and value proximity if they did not. It then compares three figures per line: ordered, received, invoiced. Price variance against the PO. Quantity variance against the receipt. GST recalculated against the extracted subtotal.

Lines that agree within tolerance pass. Everything else goes to an exception queue with the variance stated in dollars and the three source documents side by side, so the person resolving it is making a decision rather than conducting an investigation.

5. Clean matches post to Xero

Matched invoices post as approved bills with the correct account codes, tracking categories and GST treatment, and the PO is closed or part-closed. The audit trail records which PO, which receipt, which tolerance rule, and who — or what — approved it.

Most of the build effort is not the comparison logic. It is the edges: supplier master cleanup, inbox routing, handling suppliers who never quote PO numbers, and the retry behaviour when the Xero API is unavailable mid-run. This is the kind of thing n8n workflow automation handles well, because the orchestration needs to survive partial failures and resume without double-posting a bill.

What stays with a person, deliberately

Three things should never be automated away, and a vendor who tells you otherwise is selling you an incident.

Tolerance exceptions. You set a tolerance — say, variance under $50 or under 2% passes automatically. Everything above it needs a human judgement about whether to accept the price rise, query the supplier, or reject. The tolerance threshold is a commercial decision and it should be reviewed, not set once and forgotten.

Credit notes and returns. A credit note against a partially received PO is a reconciliation problem with real judgement in it. Automate the capture and the linking; leave the decision.

Supplier bank detail changes. This is the one that costs real money. Some products advertise duplicate detection and supplier bank-detail checks — Pulsify's comparison lists duplicate checks, bank details, ABN validation and two-way PO matching, and Lightyear is described as checking supplier bank details. Treat these as detection, not prevention. The rule in a well-built workflow is that an extracted invoice can never silently update supplier payment data. A changed BSB or account number raises an exception requiring independent verification — a phone call to a known number, not the number on the invoice — and the verification is logged.

What the market charges

Published Australian pricing, observed between 19 August and 3 October 2026. Check live vendor pricing before you commit; the sources conflict on some plan structures.

The Airwallex row is the whole argument in one line. Capture and approval for up to 500 bills a month sits at A$99. PO governance, three-way matching and multi-entity management sit in a tier starting at A$999. That is not vendor greed — matching genuinely requires PO and receipt data structures that capture products do not carry — but it is a tenfold step that catches buyers who assumed matching was a checkbox on the cheap plan.

For context on the broader spend, Australian comparison data puts full AP automation at roughly A$300 to A$800 per month for 100 to 500 invoices, and a separate estimate for a 300-invoice Xero business lands at A$200 to A$500 per month. Headline subscription prices frequently exclude integration fees, extra entities, over-volume documents, payment transactions and onboarding — and several comparisons do not state whether prices include GST.

The failure modes worth planning for

• No PO on the invoice. Common with trades, freight and utilities. Decide in advance which supplier categories are exempt from matching and route them to a standard approval path instead of jamming the exception queue.
• Receipt recorded after the invoice. Build a hold state rather than rejecting. The invoice waits for the receipt, with an ageing report so nothing sits there for six weeks.
• Unit-of-measure mismatch. PO in cartons, delivery docket in units, invoice in kilograms. This needs supplier-level conversion rules, and it is a real cost of onboarding each supplier.
• Freight and rounding. Lines that exist on the invoice but not the PO. Treat as a separate tolerance.
• Duplicate invoice numbers. Especially from suppliers who restart numbering each financial year.
• Integration downtime. If Xero is unreachable mid-post, the workflow must know which bills landed and which did not.
• Data residency. Australian-dollar pricing does not prove Australian hosting. If invoice images and supplier bank details cannot leave the country, ask in writing about data-centre regions, subprocessors, retention, support-staff access and deletion on termination before you sign.

The metric that matters once it is live is not OCR accuracy. It is the percentage of invoices reaching posting without manual correction. Track it weekly for the first quarter; it tells you which suppliers and which rules are costing you.

Start here

Pull your last 200 supplier invoices and count how many had a purchase order you could actually match against, and how many had a receipt record. If the answer is under half, the first project is PO and receipt capture, not invoice automation — buying a matching tier before that data exists means paying A$999 a month for a control with nothing to control.

If you want that number without doing the counting yourself, book an assessment and we will work through your Xero data, your supplier mix and your approval structure, and come back with a scoped build, a fixed price, and a straight answer on whether three-way matching is worth it at your volume or whether two-way matching and a tighter approval rule gets you most of the benefit for a tenth of the cost. Most of our builds land in two to four weeks.