An invoice with no order and no contract stops getting into your system once the system refuses to record it as payable without a valid reference: an approved purchase order number, or an active contract number for spend that never goes through a PO. Without that reference, the invoice is received, dated and parked, but nobody can post it to a budget or pay it. That moves the check to the point of entry, instead of leaving it to the month-end exceptions report.
Which report should you run in the ERP today?
Pull last month's supplier invoices out of the ERP with the supplier, the amount before tax and the PO reference, or ask accounts payable for the list. Filter the rows with no PO reference and divide their number by the total. The query does almost all the work, and you will have the figure in under an hour. The percentage you get is your baseline, and then the KPI you track every month.
Sort the rows by supplier next, and you will often see a handful of suppliers account for a large share of the volume (the electricity distributor, the telecom operator, the maintenance contractor, the software vendor). If that's what you see, part of the problem goes away without blocking anything: you link those suppliers to their contracts.
What does an invoice you discover after the fact cost you?
An invoice with no PO means someone committed spend that nobody approved beforehand. The budget owner and the controller find out afterwards, and any argument about price or quantity starts after the service has already been consumed.
It also costs time. An orphan invoice bounces between inboxes until someone recognises the purchase, and the payment clock runs the whole time. In Morocco, Law 69-21, published in the Official Bulletin on 15 June 2023, sets the payment term at 60 days from the invoice date when the parties have agreed nothing, and caps an agreed term at 120 days. Your internal routing doesn't stop that clock.
Past that term, the delay turns into a fine. The company that pays late declares the invoice itself to the tax authority (DGI) in its quarterly return, and pays the fine to the Treasury at the same time. The fine is calculated on the unpaid amount including VAT, at the Bank Al-Maghrib key rate for the first month of delay plus 0.85% for each further month or part of a month. The DGI revises the first-month rate when Bank Al-Maghrib changes its key rate. The rules have applied since July 2023 to companies with turnover above 50 million dirhams, since January 2024 to those between 10 and 50 million, and since January 2025 to every company above 2 million.
At the close, finally, late invoices force you to estimate accruals for spend nobody declared.
How do you make the PO exist before the invoice?
A blocking rule only holds if raising a PO is easy. The requester enters a purchase requisition with the quote, the budget approver signs it off, and the system generates a numbered PO. For goods, and for services someone can confirm, the warehouse or the requester then records the receipt. The invoice arrives last and attaches to records that already exist.
As a number someone typed by hand proves nothing, the PO number has to come from the system, generated from the approved requisition. Suppliers, for their part, need a dated letter telling them that after a short transition period an invoice without that number won't be scheduled for payment.
Two-way or three-way match: which one for which spend?
A two-way match compares the invoice with the PO on unit price, quantity and amount. It's enough when there's nothing physical to check, such as a subscription whose amount is fixed by contract. A three-way match adds the receipt, and the invoice then becomes payable only for what was actually delivered or performed. Use it for goods, parts and any service that can be delivered in part.
You also need a tolerance on variances. At zero, invoices get stuck over rounding differences and teams start working around the control. Too wide, and overbilling gets through. The right value depends on your volumes and spend categories. Set it per category, as a percentage and as an amount, and review it after three months of real blocks.
Which rules should stop your system from paying?
Each row can be configured in an ERP or a procurement application. The values in the third column are finance's call.
| Rule | What the system checks | Parameter you set | If the rule fails |
|---|---|---|---|
| Reference required | Invoice quotes an approved PO or an active contract | Closed list of categories allowed without a PO | Quarantine, no posting, no payment |
| Two-way match | Price, quantity and amount against the PO | Categories, tolerance in % and in amount | Payment blocked, reason shown |
| Three-way match | Invoiced quantity against received or confirmed quantity | Categories, quantity tolerance | Blocked until receipt or credit note |
| PO dated after the invoice | PO date later than invoice date | Approver and escalation threshold | After-the-fact PO approved one level up, counted in the KPI |
| No PO, no payment | No payment order without a matched invoice or an approved release | Fixed rule | Payment order refused |
| Block release | Approver is neither the requester nor the person who keyed the invoice | Authorisation matrix | Release refused |
In a specification, the central rule fits in one testable sentence: "The system refuses to create a payment order for any supplier invoice that is not matched to an approved purchase order within the configured tolerances, not linked to an active contract in an authorised category, and not covered by an approved, logged block release." A tester can then try each case and watch the system refuse. If your current tool can't carry these controls, a business application connected to the ERP, or an ERP configuration reviewed on this point, can.
Which invoices can arrive without a PO, and what replaces the PO?
Forcing a PO onto some kinds of spend only produces fake POs raised after the invoice. SAP's own training course on invoice entry gives utilities, repairs and phone bills as examples of items you may be invoiced for without a purchase order. Exceptions are normal, as long as each one has another control standing in for the PO.
| Category | Reference required instead | Substitute control |
|---|---|---|
| Water, electricity, telecoms | Contract or line number | Variance against last month above your threshold goes to general services |
| Recurring contracts (maintenance, vehicle or equipment hire) | Active contract number | Amount and frequency checked against the contract schedule, blocked once the contract has expired |
| Software subscriptions and licences | Contract or annual PO | Inventory kept by IT, licence count reviewed at each renewal |
| Insurance premiums | Policy and premium notice | Monthly review by treasury |
| Emergency purchase (breakdown, safety) | Dated, named emergency declaration | After-the-fact PO within the deadline you set, monthly review of the list |
Finance owns this list and keeps it closed. No department gets to decide on its own that a purchase falls under a contract.
What happens to an invoice with neither a PO nor a contract?
Since it exists legally and its payment term is running, with the fine waiting at the end if nobody decides, the invoice isn't rejected silently. The system records it in a quarantine queue with its receipt date, supplier and amount, where controllers can see it, with no posting and no payment possible.
The message on screen matters too. "Operation refused" invites a workaround. "Invoice without a PO or contract reference. Create an after-the-fact PO request; it will go to your director for approval" tells the person what to do and who to talk to.
For the after-the-fact PO, the requester raises the PO with a reason, and it goes to an approver one level above a normal PO (the next manager up, or finance, depending on the threshold you set). The system flags it permanently as retrospective, and those cases are then counted separately. A department that raises retrospective POs every month is buying outside the process, and that is the department finance needs to talk to.
Who can release a block, and what record does it leave?
Releasing a block is a decision to pay despite a variance, so it follows the same segregation of duties as payment. Neither the person who keyed the invoice nor the requester can release it. The authorisation matrix names who can, by spend category and amount band, and the system refuses anyone else.
Every release writes a time-stamped line that can't be edited: who released it, when, which invoice, which variance, which reason (picked from a closed list) and which attachment. Ban free-text reasons, since a bare "approved" tells an auditor nothing two years later. With a closed list, finance can go through the releases once a month and count the repeats. The same logic protects supplier bank details, as our article on locking supplier bank details explains.
Which KPI should you track, and how do you calculate it?
One is enough: the share of invoices received without a PO. The numerator counts invoices received during the month that, on arrival, quoted neither an approved PO nor an active contract in an authorised category. The denominator counts all supplier invoices received that month (excluding taxes and social contributions, which are not invoices). Count invoices rather than amounts, because a few large compliant invoices would hide dozens of small ones that aren't.
An invoice whose PO was raised later stays in the numerator, since it arrived without one. Take it out once it has been regularised and the KPI drops while nothing about how people buy has changed. Track it monthly by requesting department, and set the target yourself.
Where do a distributor's 280 invoices without a PO come from?
The figures below are invented for illustration. A consumer goods distributor with two warehouses receives 1,000 supplier invoices a month. Its stock purchases already go through a three-way match against warehouse receipts. Even so, the report from day one finds 280 invoices with no PO reference, or 28%. Sorting by supplier shows that 90 are for electricity, water and telecoms, and 70 come from contracts already signed for forklift maintenance and delivery truck hire. Once those suppliers are linked to their contracts, those 160 invoices arrive with a valid reference and the KPI falls to 120 out of 1,000, or 12%.
The remaining 120 are the real off-process purchases, such as transport booked one load at a time or packaging ordered over the phone. They go to quarantine, and each one needs an after-the-fact PO. If 80 of them come from logistics and sales, finance knows where to start.
On the matching side, the warehouse receives 400 cartons against a PO for 400, and the invoice bills 412 at the right unit price. The quantity tolerance for this category is set at 2%. The variance is 3%, so the invoice stays blocked until the supplier issues a credit note or a further receipt is recorded.
FAQ
- Do we really need to block small invoices too?
You can set a threshold below which a simpler route applies (purchasing card, petty cash), but that threshold soon becomes the way out. A purchase split into several invoices just under it goes through with no PO. If you set one, add a check on the cumulative amount per supplier per month, and keep those invoices in the KPI.
- Can our ERP already do this?
Before you commission any development, check three settings in your current ERP. Is the PO reference mandatory when an invoice is entered? Does a failed match block payment? Does the system stop users from releasing a block they caused themselves? Three yeses and configuration is enough. A single no shows you exactly what to fix, through configuration or an application connected to the ERP.
- How does this fit with e-invoicing?
The two projects help each other. If you are preparing to receive structured invoices, make the PO reference a field that is required and checked on arrival. Matching then happens without anyone retyping it. Our article on Morocco's DGI e-invoicing and your existing systems covers the rest.
Sources
- Le Matin, main changes under Law 69-21 (22 June 2023, in French)
- Finances News Hebdo, Law 69-21 (22 September 2023, in French)
- Le Matin, penalties for late payment (19 October 2023, in French)
- Le Matin, late-payment fines adjusted (1 July 2024, in French)
- SAP Learning, Creating Non-PO Invoices
Last verified: 1 November 2026.
At the next month-end close, take one number to the executive committee: the share of the month's invoices that arrived with neither a PO nor a contract, retrospective POs included. Our free audit can work it out with you and walk through your PO, receipt and invoice chain before you change any settings.
