WorkflowProcurement

The complete guide · November 2026

Supplier invoice audit, explained.

A company signs a price with a supplier, and later someone else pays the bill, often checking only its total. A supplier invoice audit reads the bill line by line: it lays each line beside the contract, the rate card (the signed price list), the purchase order and the record of what was delivered, and shows the difference. Then a person decides whether to dispute it, and someone follows the money until it comes back.

Written for payables leads, category managers, clinical finance, controllers and internal auditors at drug, biotech and device companies, and for leaders deciding whether to automate the work. No finance background needed.

See one case, screen by screen →
Watch with transcript →
A quick example · fictional

Imagine you are the payables audit lead at Cobbleford Pharma, a mid-size drug company. Tomorrow at 2:00 pm the next batch of supplier payments goes out. Today, Wednesday, October 7, 2026, a research firm, Quillon Clinical Research, has billed $438,322.00 for one month of monitoring on a clinical trial, meaning the visits and checks at the sites running it. The purchase order has plenty of room left, so the total passes the finance system's automatic match.

You open line 1: 486 hours of a clinical research associate, the monitor, at $180.00 an hour. The rate card both companies signed on January 9 says $160.00, in an exhibit far behind the contract's main text. The $180.00 comes from a proposal for 2027 that nobody signed.

Quillon's invoice · line 1
Hours
486
Rate billed
$180.00
Amount
$87,480.00
Signed card · Exhibit B
Hours entered
486
Rate signed
$160.00
Amount
$77,760.00
$9,720.00 above contractone of five linesworth $23,065.60 on this invoice, each one your decision.

A careful audit catches overcharges the total hides: a rate nobody signed, two visits billed that had not taken place, a handling fee the contract forbids, before the money leaves.

Supplier invoice audit guide
Part A · Understand it

Inside a supplier invoice audit: the line, the clause, the evidence and the money coming back

What the work is, which documents it rests on, what the law says about withholding and recovery, and why the published numbers disagree, explained without selling anything. If invoice checking is new to you, start here.

01 · In plain words

Reading the bill against the deal: what a supplier invoice audit does

Think about the bill at a garage. You agreed to $400 for a repair. The bill says $400, so you pay it. Now imagine the bill has ten lines, the agreement runs to sixty pages with three later changes, the price list is on a separate signed sheet, and the person paying has never met the person who agreed the price. That is a drug company paying a contract research organization, or CRO, the firm it hires to run its clinical trials.

Many companies check invoices with a match. A system, often the company's ERP (its main finance and operations software), compares the invoice with the purchase order, called a PO, and with a record that the goods or services arrived. If the totals fit, the invoice goes on to the next payment run, the batch of payments sent out together. Large service contracts often sit on a blanket PO, a single order with a big budget drawn down month by month. A wrong invoice passes as long as the budget has room.

So the mistakes live inside the lines. An hourly rate from a proposal nobody signed. Fourteen monitoring visits billed when twelve took place. A handling fee on lab kits that the contract says are charged at cost. A volume discount that should have started at the 31st site. Each line looks reasonable by itself. You only see the problem with the contract open beside it.

A supplier invoice audit opens the contract beside it, line by line. Some teams call this a contract compliance audit. When it runs before payment, the disputed amount is held back and the rest is paid on time. When it runs after payment, the difference becomes a claim, and someone has to follow that claim until a credit note, the supplier's written reduction of the bill, arrives. A person decides each one, because a difference on paper is sometimes a change order (a signed change to scope or budget) sitting in someone's inbox.

One disputed monitoring rate, from signature to credit note

  1. The contract sets the priceThe two companies sign a master agreement and a rate card: $160.00 an hour for a clinical research associate in 2026, in this guide's example.
  2. The work happensThe associate logs 486 hours in September. The purchase order system records that the month's work was accepted.
  3. The invoice arrivesIt bills those hours at $180.00. The total fits the PO, so the system's match passes it.
  4. Someone reads the line against the clauseThe $20.00 gap on 486 hours is $9,720.00. A person disputes it, and only the disputed amount is held.
  5. The money comes backA letter cites the clause, the supplier agrees, and a credit note closes the item.

Step 4 is the subject of this guide. The people, companies and figures in this example are fictional.

From a passed match to an unpaid win: four surprises on supplier invoices

A passed match says little about the price

A three-way match confirms that an order, a receipt and an invoice agree with each other. On a blanket PO for services, the order rarely holds the rate, the cap or the tier, so nobody asks whether the rate is the signed one.

Much of a CRO's bill is other people's costs

One public CRO's filing shows reimbursed out-of-pocket costs equal to 41% of its 2025 revenue, by our arithmetic, and says customers reimburse them "at cost".1 Those lines rest on third-party receipts. One change order we read also bills them at actual cost.2

A win on paper is often still unpaid

Texas hired a firm to find overpayments across 51 state agencies. Valid claims came to $840,613, and $205,475 had come back when the contract ended.3 A finding is the start of the work.

A wrong line need not mean a villain

A research firm's billing clerk may have loaded next year's rates a quarter early. We know of no public split between honest error and deliberate overbilling, and an audit letter should read accordingly: courteous, specific and cited.

Four terms on every disputed invoice: rate card, pass-through, short-pay, credit note

Rate card

The signed list of prices by role or item, usually an exhibit to the contract and updated each year.

Pass-through cost

A cost the supplier pays to someone else and bills on, such as lab kits, site payments or travel.

Short-pay

Paying the undisputed part of an invoice and holding back the disputed part, with written notice.

Credit note

The supplier's own document reducing what you owe. It is what closes a claim.

Fourteen terms are defined in the cheat sheet.

02 · Line check against a match

What a supplier invoice audit checks that a three-way match leaves alone

In shortA three-way match asks whether the invoice, the order and the receipt agree. A supplier invoice audit, or line audit, asks whether each line is the price the contract allows for what was delivered. The two answer different questions, and on services billed to a blanket PO the match has little to compare.

A two-way match compares an invoice with a purchase order. A three-way match adds a receipt or a service entry. These controls catch a real class of error: an invoice with no order, a quantity far above what arrived, a price far from the order's. They were built for goods, where a PO line holds a part number, a quantity and a unit price.

Services work differently. A PO for a year of trial monitoring may hold one line and a budget of several million dollars. The service entry records that the month's work was accepted. Neither document holds the hourly rate for a senior associate, the 3% cap on yearly increases, the lower fee above 30 sites, or the rule that only completed visits are billable. Those live in the contract, its amendments and its exhibits.

Each kind of check has its blind spots, and a totals match misses most of what costs money

Our judgment of how often each check finds each error, on services billed against a blanket PO

RarelySometimesUsually
Totals matchSample of paid invoicesRecovery audit laterLine audit firstRate above the rate cardRarelySometimesUsuallyUsuallyVolume tier not appliedRarelyRarelyUsuallyUsuallyMarkup on pass-throughRarelySometimesSometimesUsuallyMore billed than deliveredRarelySometimesSometimesUsuallyDuplicate invoiceSometimesSometimesUsuallyUsuallyRebate never creditedRarelyRarelyUsuallyUsuallyChange order not yet signedRarelyRarelyRarelySometimes

Our reading of the sources 4 · A classification we drew from the error types one recovery firm lists and from the mechanics of each check. There are no measured rates behind it. Test your own.

Show the numbers
Totals matchSample of paid invoicesRecovery audit laterLine audit first
Rate above the rate cardRarelySometimesUsuallyUsually
Volume tier not appliedRarelyRarelyUsuallyUsually
Markup on pass-throughRarelySometimesSometimesUsually
More billed than deliveredRarelySometimesSometimesUsually
Duplicate invoiceSometimesSometimesUsuallyUsually
Rebate never creditedRarelyRarelyUsuallyUsually
Change order not yet signedRarelyRarelyRarelySometimes

Leaving the recovery firm for section 9, three ways of looking at the same invoice give three different answers. The match says the documents agree. A sample of paid invoices, pulled each quarter by accounts payable or internal audit, says whether the few it picked were right. A line audit says whether every line of every invoice it covers follows the contract. The last one takes the most reading, and that reading is why many companies ration it.

The total passes at step 2, and the overcharge only surfaces at step 3
  1. 1Invoice arrives

    $438,322.00 for September, by e-invoice.

    Accounts payableOctober 7
  2. 2Totals match

    Invoice fits the PO's remaining budget. The match passes it.

    ERP systemSame day
  3. 3Line against clause

    Five lines differ from the signed terms by $23,065.60.

    Payables audit leadBefore the run
  4. 4Decision

    Each difference disputed or accepted with a reason.

    A personSame day
  5. 5Payment

    $415,256.40 paid on the contract's date, the rest withheld with notice.

    Accounts payableDecember 6

Fictional example from this guide · This guide's fictional example.

Show the numbers
StepWhat happensWhoTime
Invoice arrives$438,322.00 for September, by e-invoice.Accounts payableOctober 7
Totals matchInvoice fits the PO's remaining budget. The match passes it.ERP systemSame day
Line against clauseFive lines differ from the signed terms by $23,065.60.Payables audit leadBefore the run
DecisionEach difference disputed or accepted with a reason.A personSame day
Payment$415,256.40 paid on the contract's date, the rest withheld with notice.Accounts payableDecember 6
A line audit also finds undercharges and honest gaps. The check runs both ways. A supplier that under-applied a rate should hear about it, and a difference caused by a change order that was signed and not yet filed is a filing problem on your side. That is why the outcome of a check is a question for a person, with the evidence attached.
03 · The paper behind a line

The paper behind one invoice line: master agreement, SOW, amendment, rate card, PO and visit log

In shortTo check one line you may need six documents held by four teams. The signed version decides, and an unsigned proposal has no force. Real contracts filed with the SEC show how specific this paper is, and sometimes how flawed.

DocumentWhat it settlesWho usually holds itThe trap
Master services agreementPayment terms, dispute rights, caps on increases, pass-through rules, rebatesLegal, procurementTerms sit far from the invoice, sometimes in a section nobody in payables has read
Statement of work (SOW)The work for one study or project: tiers, fixed fees, unit pricesCategory manager, clinical operationsSeveral SOWs under one agreement, each with its own terms
Amendment or change orderWhat changed, from what dateClinical operations, legalSigned late, filed later; the invoice may be right and the file behind
Rate cardPrice by role or item for a periodProcurementNext year's draft in circulation before anyone signs it
Purchase order and service entryBudget, and that the month's work was acceptedERP system, the requesterHolds budget and little else, on a blanket order
Delivery recordWhat actually happened: visit log, active-site list, seat report, shipment file, batch registerClinical, IT, logistics, qualityOutside finance, in a system payables cannot see
Third-party receiptThe real cost of a pass-throughThe supplierAttached as a stack of PDFs, or requested only after a dispute

What real CRO contracts say about undisputed amounts and signed changes

CRO agreements are mostly private, but some are filed with the SEC as exhibits, and those show the working language. An agreement between AROG Pharmaceuticals and DAVA Oncology, effective June 12, 2018, says "Sponsor shall pay each undisputed invoice within thirty (30) days of receipt", asks for written notice of any disputed portion, and says "No Amendment will be binding upon either Party until it is signed by the authorized representatives of both Parties".5

A 2016 change order between RedHill Biopharma and inVentiv Health Clinical says "all undisputed portions of the invoice(s) are due within the above stated terms", and that "any pass-through costs in excess of the amounts set out below will require the Client's prior written approval".2

These terms are the auditor's raw material. They also show where a check needs a person. The same RedHill change order sets interest on overdue balances "at the rate of one and a half percent (0.5%) per month".2 The words and the figure disagree. A reader, human or software, should flag that and leave the choice to someone who can ask.

One rate takes five documents to confirm, and four teams hold them
  1. 1The master agreement

    Section 4.1: bill at the rate card. Section 4.3: yearly rise capped.

    Legal
  2. 2The rate card

    Exhibit B, 2026: $160.00, signed January 9, 2026.

    Procurement
  3. 3The proposal

    A 2027 rate of $180.00, dated August 14. Never signed.

    Category manager
  4. 4The change orders

    None lists $180.00.

    Clinical operations
  5. 5The service entry

    486 hours accepted against the PO, at the signed rate.

    Requester

Fictional example from this guide · This guide's fictional example. The section numbers belong to its sample contract.

Show the numbers
StepWhat happensWhoTime
The master agreementSection 4.1: bill at the rate card. Section 4.3: yearly rise capped.Legal
The rate cardExhibit B, 2026: $160.00, signed January 9, 2026.Procurement
The proposalA 2027 rate of $180.00, dated August 14. Never signed.Category manager
The change ordersNone lists $180.00.Clinical operations
The service entry486 hours accepted against the PO, at the signed rate.Requester

Agreements often say which document wins when two disagree, a clause called the order of precedence, and the latest signed amendment often governs the terms it changes. Read that clause first, and write the answer down for each supplier. A team that argues about it from memory during a dispute loses time it could spend on the claim.

04 · What the law says

The laws around invoice checking: what SOX, ICH E6(R3), the UCC and EU late-payment rules say

In shortNo law or guideline we read requires a line-by-line audit of supplier invoices. Several set the frame around it: accurate books, internal controls, oversight of trial vendors, notice before withholding, and late-payment interest in the EU. Your contract decides most of the rest. Take legal advice on your own paper.

RuleWhat it saysStatus, November 2026What it means for invoices (our reading)
Sarbanes-Oxley (SOX) section 404Management reports on and assesses internal control over financial reporting.6In force. Smaller reporting companies with revenue under $100 million need no auditor attestation on it, and management still assesses.7Payment controls may be among the controls you test. The statute never mentions invoices.
Securities Exchange Act 13(b)(2)Books that "in reasonable detail, accurately and fairly reflect" transactions, and controls so that transactions follow management's authorization.8In force for issuers: companies with registered securities or a duty to file reports under the Act.A rate nobody authorized is a control question, whatever its size.
ICH E6(R3), the good clinical practice guideline, 3.6.6, 3.6.9, 3.5The sponsor keeps "ultimate responsibility" for transferred trial activities, should ensure "appropriate oversight", and documents the financial aspects of a trial in an agreement with the investigator or institution.9Principles and Annex 1 in effect in the EU from July 23, 2025;10 FDA final guidance September 2025.11It governs trial conduct. A visit billed and not done is also an oversight signal, so clinical operations should hear about it.
21 CFR 312.52, an FDA ruleA sponsor may transfer obligations to a CRO, described in writing.12In force.Scope in writing gives the audit something to read.
Uniform Commercial Code (UCC) 2-717, 2-607, 2-725A buyer who notifies the seller may deduct damages from price still due on the same contract.13 A buyer must notify within a reasonable time or be barred.14 Four years to sue, reducible by contract to one, from the breach whether or not you knew.15Model text; each state enacts its own.These cover goods: lab supplies, packaging, drug substance. CRO services usually fall to common law and the contract's own terms.
EU Directive 2011/7Business payment periods limited, as a general rule, to 60 calendar days, longer only if expressly agreed and not grossly unfair; statutory interest at the reference rate plus at least eight points; at least EUR 40 in recovery costs.16In force. The proposed regulation with a 30-day cap passed Parliament's first reading on April 23, 2024 and reads "Awaiting Council's 1st reading position".17 In June 2024 a group of member states led by Germany and Austria asked the Commission to withdraw it, and a trade body reported the group was large enough to block it in the Council.18Paying late has a price, so the undisputed part should go out on time.
The rules that frame invoice work keep moving, while the core duties date back years
  1. 2011EU late-payment directive

    60-day general limit, statutory interest.

  2. Apr 2024Parliament votes on a 30-day cap

    Still awaiting the Council in November 2026.

  3. Jul 2025ICH E6(R3) in effect in the EU

    Sponsor oversight of service providers; FDA final September 2025.

  4. Nov 2026Now

    No rule we read requires line-by-line checks.

Source 9,10,11,16,17,19

Show the numbers
WhenWhat
2011EU late-payment directive
Apr 2024Parliament votes on a 30-day cap
Jul 2025ICH E6(R3) in effect in the EU
Nov 2026Now
Jul 2030EU cross-border e-invoicing

None of these makes a piece of software "compliant", and no vendor can have that status for you. A tool can give you controls that support your own program, and your auditors will test those controls the way they test any other. Section 12 comes back to what that means for a new control.

05 · Eight overcharges worked

Eight overcharges worked through with numbers, from a rate above the card to a missed rebate

In shortOvercharges fall into a small number of shapes, and each has a simple sum: rate above contract, cap, tier, delivered quantity, markup, expense class, duplicates and rebates. Write the sum out on the page, and the disagreement narrows to the facts behind it.

ShapeWhat the clause says, in the exampleThe sumAbove contract
Rate above the cardExhibit B: $160.00 an hour. Billed $180.00.486 h × ($180.00 − $160.00)$9,720.00
Renewal above the capSeat fee may rise 5% a year. Last year $380.00, so at most $399.00. Billed $412.00.1,200 seats × ($412.00 − $399.00)$15,600.00
Volume tier missed$1,150 a site to 30 sites, $980 above. 38 active, all billed at $1,150.8 sites × ($1,150 − $980)$1,360.00
More billed than deliveredCompleted visits only. 14 billed, 12 in the visit log.2 visits × $2,450.00$4,900.00
Markup on a pass-throughAt actual cost, no handling fee. 8% added to a $58,420.00 lab receipt.$58,420.00 × 8%$4,673.60
Expense outside policyEconomy under six hours. Two business fares on short flights, no approval.$3,418.00 − $1,006.00 economy$2,412.00
Duplicate invoiceEach service invoiced once. A "-R" copy matches one paid September 17.The whole invoice$22,750.00
Rebate never credited1.2% once a year's fees pass $10 million, due by March 31.$11,860,000 × 1.2%$142,320.00
On one CRO invoice, five lines carry the whole $23,065.60 gap

Quillon's September invoice, dollars rounded, the five disputed lines only

BilledPer contract
Monitoring hours$87.5K$77.8K
Site management fee$43.7K$42.3K
On-site visits$34.3K$29.4K
Travel and expenses$9,786$7,374
Handling fee on pass-through$4,674$0

Fictional example from this guide · This guide's fictional example: $438,322.00 billed, $415,256.40 per contract. The other five lines match.

Show the numbers
BilledPer contract
Monitoring hours$87.5K$77.8K
Site management fee$43.7K$42.3K
On-site visits$34.3K$29.4K
Travel and expenses$9,786$7,374
Handling fee on pass-through$4,674$0

A sum that needs the outside world: the CPI-U cap on rate increases

Some agreements cap yearly rises at the lesser of an inflation index or a fixed percent. In the example, 2026 rates may rise by "the lesser of the change in CPI-U for the prior twelve months or three percent". CPI-U is the US Consumer Price Index for All Urban Consumers.

Using real data, CPI-U rose 2.68% in the twelve months to December 2025, by our calculation from the published index.20 On a 2025 rate of $155.34, that lesser-of rule gives about $159.50. A flat 3% gives $160.00. Fifty cents is small until you multiply it by a year of hours and every role on the card. Agree which month and which index the clause means, in writing, before it matters.

Thirty-six days early: what a Net 30 request costs on a 60-day contract

An invoice can ask for less time than the contract gives. Quillon's asks for Net 30, payment within 30 days, due October 31; the contract gives 60 days from receipt, so December 6. Paying $415,256.40 thirty-six days early at an illustrative 5% cost of cash costs about $2,048. No line in the invoice shows it, and it recurs every month.

06 · Why CRO invoices are hard

Why CRO invoice reconciliation is the hardest part: reimbursed costs, amendments and delivery records outside finance

In shortCRO bills mix hourly rates, unit prices, fixed fees and other people's costs, under contracts that amendments keep changing. One public CRO's reimbursed costs equaled 41% of its revenue in 2025. And the proof of what happened sits in clinical systems that accounts payable does not use.

Medpace, a public CRO, reported $2,530.2 million of revenue in 2025 and $1,037.5 million of reimbursed out-of-pocket expenses, up from $770.7 million against $2,109.1 million in 2024.1 It describes direct costs as including third-party service expenses, fees paid to site investigators and reimbursed out-of-pocket expenses, and says these "can fluctuate significantly from period to period".

Its accounting note says such expenses, including investigator site payments and travel, are "reimbursed by its customers at cost". That is one company's mix, so read it as a scale for how much of a CRO's bill can be other people's costs.

At one public CRO, reimbursed costs rose from 37% to 41% of revenue in a year

Medpace, reimbursed out-of-pocket expenses as a share of total revenue

Reimbursed out-of-pocketEverything else
202436.5%63.5%
202541%59%

Source 1 · Shares computed by us from the dollar figures in its annual report (Form 10-K). One company; its filing notes the swings.

Show the numbers
Reimbursed out-of-pocketEverything else
202436.5%63.5%
202541%59%

Amendments change what the next invoice should say

In a Tufts study published in 2024, drawing on 950 protocols from 16 companies, 76% of protocols had at least one amendment, up from 57% in 2015, and 77% of amendments were judged unavoidable.21 An amended study often means a new budget: more sites, a new visit, a different tier. In the example, Amendment 2 is what introduced the lower fee above 30 sites. If the amendment reached procurement and never reached the person checking the invoice, the check runs on old terms.

Three in four protocols now get amended at least once, and an amendment can reprice the next invoice
76 in 100

protocols had at least one amendment in the Tufts benchmark, up from 57 in 100 in 2015

Source 21

Show the numbers
MeasureValue
protocols had at least one amendment in the Tufts benchmark, up from 57 in 100 in 201576 of 100

Where the proof of a billed visit lives

Monitoring is a large cost. A 2014 report for the US Department of Health and Human Services put site monitoring at 14.28% of a Phase 3 study's per-study subtotal, as a weighted average.22 It is more than a decade old, and it is the public figure we could read.

The evidence for each visit sits in a clinical trial management system, or CTMS, with a monitor's report behind it. Accounts payable usually has no login, so the check turns into an email to a study manager, weeks after the month closed. A cancelled visit, or one moved into next month, is easy to bill by accident and easy to miss for the same reason.

Investigator payments raise the stakes on any hold

Part of a CRO's invoice may fund the hospitals running the trial. A 2017 white paper from the Society for Clinical Research Sites and Greenphire reports that 66% of sites worldwide had under three months of operating cash in 2016, and that about 40% of sites, in US research it cites, call slow payment a primary operating concern.23 A dispute over a handling fee should never hold up a site's visit payment. Keep disputed lines narrow, and pay the rest.

Two in three trial sites worldwide reported under three months of operating cash in 2016
66 in 100

sites worldwide had under three months of operating cash, in the 2016 survey a 2017 white paper reports

Source 23

Show the numbers
MeasureValue
sites worldwide had under three months of operating cash, in the 2016 survey a 2017 white paper reports66 of 100
07 · Error, dispute or fraud

Billing error, contract dispute or invoice fraud: three problems that need three different responses

In shortMany invoice differences are questions about a contract. Some are deliberate, by an insider or an impostor. The published fraud numbers describe those crimes, and they tell you nothing about how often suppliers overbill. Keep the three apart, in your data and in your letters.

ProblemTypical pictureWho handles itPublic measure
Billing errorNext year's rates loaded early, a tier never set up, a duplicate from a corrected invoicePayables and the supplier's billing teamNo public rate for life sciences that we could find
Contract disputeBoth sides read the clause differently, or a change was agreed by email and never signedCategory manager, then legalCourt records only, for the few that reach a court
Billing scheme by an insiderAn employee sets up a shell company or inflates invoicesInternal audit, investigators21% of cases in a 2026 fraud study24
ImpostorA fake email changes a supplier's bank detailsTreasury, security74% of organizations were affected by business email compromise in 2025, in a survey of 465 US treasury practitioners25

The Association of Certified Fraud Examiners (ACFE) studied 2,402 cases of fraud by people inside organizations, in 143 countries, in its 2026 report. Billing schemes appeared in 21% of those cases, with a median loss of $90,000, and ran a median 14 months before anyone noticed.24,26 Tips found 43% of all cases, internal audit 15%, and automated monitoring 3%. Vendors supplied 11% of the tips.24 These are crimes by insiders, so they cannot size supplier overbilling.

Billing schemes run for over a year before anyone notices

Median months from start to detection, selected schemes, ACFE 2026

Financial statement fraud24 months
Expense reimbursements18 months
Billing schemes14 months
Check and payment tampering13 months
Payroll13 months
All cases in the study12 months

Source 24 · Fraud by people inside the victim organization. No measure of supplier error.

Show the numbers
ItemValue
Financial statement fraud24 months
Expense reimbursements18 months
Billing schemes14 months
Check and payment tampering13 months
Payroll13 months
All cases in the study12 months

Bank detail fraud needs its own control, and an invoice line audit does not address it unless someone also checks the remittance details against the supplier record. In the 2026 survey by the Association for Financial Professionals (AFP), 76% of organizations experienced attempted or actual payments fraud in 2025, and 17% use AI against it.25 The survey was underwritten by a bank.

The language matters as much as the labels. A letter that says "you overcharged us" starts a fight. A letter that says "line 7 shows an 8% handling fee, section 7.2 rules out handling fees on pass-through costs, please credit $4,673.60" starts a correction. If a pattern looks deliberate, it goes to legal and internal audit, and the supplier letter stops.

08 · Withholding in good faith

Short-paying a supplier in good faith: notice, the undisputed amount and what can go wrong

In shortYou may withhold only where the contract lets you, and only in the way it says. That normally means written notice naming the disputed items, and paying everything else on time. Do it badly and you become the party in breach. A public case shows how far an invoice fight can run.

Four steps a short-pay usually takes under a CRO agreement

1. Find the clause

What notice, how soon, to whom, and in what form. Real agreements ask for written notice of a disputed portion.5

2. Name the items

Line, clause, amount. A vague "we dispute this invoice" can put the whole amount at risk.

3. Pay the rest on its date

Undisputed amounts stay due.5,2 The contract's date applies, even when the invoice asks for an earlier one.

4. Close it in writing

A credit note, or a signed change order that makes the bill right. An email saying "agreed" leaves the books unsettled.

The invoice asks for October 31, the contract says December 6, and the run is October 8
  1. Oct 1Invoice date

    Quillon's invoice asks for payment in 30 days.

  2. Oct 7Received

    The contract's 60 days start here.

  3. Oct 8Payment run

    The disputed invoice stays out of it.

  4. Oct 31Date on the invoice

    Net 30 from the invoice date. No clause supports it.

  5. Dec 6Date in the contract

    $415,256.40 paid, $23,065.60 withheld with notice.

Fictional example from this guide · This guide's fictional example.

Show the numbers
WhenWhat
Oct 1Invoice date
Oct 7Received
Oct 8Payment run
Oct 31Date on the invoice
Dec 6Date in the contract

When to hold, and when to pay and claim later

Holding a whole invoice over a $40 difference is a poor trade. Many teams set a threshold: below it, pay on time and claim the amount afterward; above it, hold the disputed part. Where the line sits depends on the supplier, the amount and what depends on that payment. Patient-facing work, investigator funds and a sole-source manufacturer may each deserve a lighter touch than a stationery bill.

What an invoice fight looks like when it reaches a court

In inVentiv Health Clinical v. Odonate Therapeutics, a Delaware court in January 2021 ruled on a motion to dismiss in a dispute between a CRO, called Syneos in the opinion, and a biotech. Syneos alleged about $12 million owed across monthly fees, milestones, expenses and late fees.

Odonate alleged that of about $25.5 million invoiced, its own count of work units supported about $18.4 million, so $7.1 million was overbilled, and that missed milestones were worth $4.65 million in payment penalties. It also alleged monthly invoices of $217,717.82 sent for six months after services were suspended.27

These are allegations. The court took them as pleaded, as courts do at that stage, and found no facts. It kept Odonate's breach of contract claim and dismissed its claims for breach of the implied covenant and for fraud in the inducement.27 We did not find how the case ended. What it shows is the shape: units of work against invoices, milestone credits, and bills continuing after a change in scope. Those are the same checks an audit runs each month, long before anyone hires a lawyer.

Federal money raises the stakes. When the payer is a government agency, a billing error can become a False Claims Act matter. In March 2017 a trade report said Charles River Laboratories agreed to pay $1.8 million to settle allegations of billing the National Institutes of Health for labor not rendered, after the company disclosed the issue itself.28 The report describes allegations and a settlement. If you bill public grants through your suppliers, ask counsel what your own checks need to catch.
09 · Recovery audits after payment

AP recovery audits after payment: contingency fees, the 0.1% benchmark and what Texas got back

In shortA recovery audit firm reads your paid invoices, months or years later, and keeps a share of what it recovers. The numbers vendors publish are their own: about 0.1% of spend and fees of 20% to 30%. A public government report shows how small the result can be.

0.1%

of total spend is what one recovery vendor calls typical recovery, in its own article.29

apexanalytix · April 2025
20–30%

of what is recovered is the fee range the same vendor gives. Texas's contract was paid as a percentage of recoveries too.29,3

Vendor figure · April 2025
$205K

recovered from $54 billion of eligible vendor spend at 51 Texas agencies, on $840,613 of valid claims.3

Texas Comptroller · January 2023

The recovery audit is an old business. PRGX, which called itself one of the world's leading providers, described its work in its 2019 annual report as mining client purchasing data for "billing errors and overpayments made to their third-party suppliers", including "missed or inaccurate discounts, allowances and rebates, vendor pricing errors", miscoding, credits never applied and duplicate payments.

Most of its revenue came from contingent fees, a pre-agreed share of successful claims, and it said "historically these claims were audited months and in some cases years after the original transaction".4

apexanalytix, another vendor, wrote in April 2025 of "typical recovery rates around 0.1 percent of total spend" and fees "between 20 to 30 percent", with returns "often exceeding 300 percent". Its worked example is $5 billion of spend, $5 million recovered, a $1.25 million fee and $3.75 million kept.29 Read those as a seller's figures, with its own date on them. We found no independent survey to set beside them, and no public recovery rate for life sciences.

When the Texas audit contract ended, about a quarter of the valid claim dollars had come back
24 in 100

dollars of valid claims recovered by August 31, 2021: $205,475 of $840,613

Source 3

Show the numbers
MeasureValue
dollars of valid claims recovered by August 31, 2021: $205,475 of $840,61324 of 100

The one public result with government numbers behind it

The Texas Comptroller's letter to the Legislature, dated January 23, 2023, is the most candid document on this subject that we read. An audit firm covered fiscal years 2016 to 2019 at 51 agencies. It reviewed duplicate payments and wrong-vendor payments, asked 4,331 vendors for statements and received them from 2,095 (48%), and sampled construction contracts for overcharges.

Of $54 billion of eligible vendor spend it found $840,613 of valid claims, and $205,475 had been recovered by August 31, 2021. The firm concluded that the agencies' controls had reduced the rate of failure to 0.05% on average, against an expected 0.1%, and declined to renew because, on a percentage fee, the work was not profitable.3

Texas agencies differ from a drug company, and that audit concentrated on duplicates and wrong-vendor payments, with contract rates sampled only in construction. Its lesson is about what a low number means. A low rate may mean that controls work, or that the audit could not read the contracts. Ask which it is before you celebrate or sign.

Claims lose value with age

Old claims are harder to win. People leave, contracts expire, relationships shift, and the supplier's books have closed. Under the UCC, the clock on a claim for goods starts at the breach whether or not you knew, and contracts can shorten the four-year period to one.15 Check your own agreements for a shorter deadline on billing disputes.

A finding made before payment avoids that decay. Rebates and tiers only show up once a year is over, so there is a case for running both: a check before the run, and a sweep behind it.

10 · Why the numbers disagree

Why published invoice leakage numbers run from 0.05% to 11%

In shortLeakage, also called contract leakage or value leakage, is money lost between the signed deal and what is finally paid, and it has no agreed definition. A recovery firm counts what it can claim back. A benchmark counts wrong payments. A contract survey counts value lost across a contract's life, including missed savings and unmanaged clauses that may never show on an invoice. The numbers can all be honest and still differ by a factor of about 200. Use none of them as your plan.

Seven published figures, about 200-fold apart, because each one measures something different

Percent of spend, disbursements or contract value, as each source defines it

Failure rate reported at Texas agencies, 20230.05%
Vendor's 'typical' recovery, apexanalytix, 20250.1%
Duplicate or erroneous payments, APQC top performers, 20200.8%
Duplicate or erroneous payments, APQC bottom performers, 20202%
One pharma client's trial tool, McKinsey, 20254%
Contract value erosion, WorldCC with Deloitte, 20238.6%
Lost after signature, WorldCC, 202611%

Source 29,3,30,31,32,33 · Blue marks the two that count wrong payments as a share of disbursements. Populations, definitions and motives all differ, and some publishers sell services. Compare them only with care.

Show the numbers
ItemValue
Failure rate reported at Texas agencies, 20230.05%
Vendor's 'typical' recovery, apexanalytix, 20250.1%
Duplicate or erroneous payments, APQC top performers, 20200.8%
Duplicate or erroneous payments, APQC bottom performers, 20202%
One pharma client's trial tool, McKinsey, 20254%
Contract value erosion, WorldCC with Deloitte, 20238.6%
Lost after signature, WorldCC, 202611%
FigureWho says it, and whenWhat it countsHow to read it
0.05%, expected 0.1%Audit firm, via the Texas Comptroller, January 20233Failure rate of government payment controlsThe firm's conclusion, on an audit that sampled contracts only in construction. The valid claims themselves come to about 0.0016% of eligible spend, by our arithmetic
0.1%apexanalytix, a vendor, April 202529Recoverable after paymentA seller's planning figure
0.8% to 2%APQC, reported on CFO.com, March 202030Annual disbursements that were duplicate or erroneousTop and bottom performers, cross-industry, six years old
4%McKinsey, April 202531One pharma company's trial tool: over $10 million in four weeks, an average of 4% of the spend analyzedA consultant's own figure, on one unnamed client's selected spend. We read excerpts of the report, not the whole PDF, and left out its wider estimate because those excerpts did not agree on it
8.6%WorldCC with Deloitte, 202332Contract value erosion, down from 9.2% in 2014Surveyed value loss across contracting, 1,236 organizations
11%WorldCC with Ironclad, a contract software vendor, January 202633"Organizations lose an average of 11% of contract value" after signatureWe read the two summary pages, not the members-only report. They give no formula or sample, and say most organizations do not track this formally

The useful figure is yours, and you can get it cheaply. Pick one large CRO and one everyday supplier. Re-check twelve months of invoices against the contracts, line by line. Separate what was wrong from what was merely unfiled, and record what the supplier agrees to return. A rate from that exercise beats anything in the chart above.

11 · What is shifting

E-invoicing mandates and moving price indexes: what is changing supplier invoice work in 2026

In shortStructured e-invoices, sent as data a system can read instead of a document, are becoming law in more European countries, and for cross-border EU sales from 2030. That removes the reading step and leaves the contract check. Inflation and diesel prices are moving enough that index-linked clauses now change what gets paid. We found no public figure for the size of this software market.

Structured invoices are arriving by law

Council Directive (EU) 2025/516, published March 25, 2025, makes electronic invoicing the rule for cross-border business sales within the EU from July 1, 2030, with an issue deadline of 10 days after the taxable event.19 Member states may also impose domestic e-invoicing.

A Deloitte note dated January 29, 2026 lists Belgium from January 1, 2026, Poland from February 2026 and France from September 1, 2026.34 On France, EY reported on July 27, 2026 that the tax authority's guidance says the timetable "remains unchanged".35 Check the current dates with your tax adviser, because national timetables have moved before.

National e-invoicing mandates start first, and the EU's cross-border rule follows in 2030
  1. Jan 2026Belgium

    Mandatory business e-invoicing.

  2. Feb 2026Poland

    Domestic e-invoicing through its national system.

  3. Sep 2026France

    E-invoicing and near real-time reporting begin.

  4. Nov 2026Now

    Check each date against national notices.

Source 19,34 · National dates as a Deloitte note gave them in January 2026; the EU dates from the directive.

Show the numbers
WhenWhat
Jan 2026Belgium
Feb 2026Poland
Sep 2026France
Nov 2026Now
Jul 2030EU cross-border
Jan 2035Older national systems

An e-invoice fixes transcription and leaves the billed rate as it is. A clean structured line that says $180.00 is as wrong as a scanned one, and easier to pay without a second look.

Ardent Partners' 2025 report, as one accounts payable vendor summarizes it (we did not read the report itself), puts the average invoice at 8.2 days to process, and 2.9 days with advanced automation.36 Faster processing cuts the time available for anyone to look at the line, so the check has to run earlier.

CPI-U and diesel: index-linked clauses now change what a supplier may bill

Two indexes show why. CPI-U ran under 3% for most of 2025, then rose above it in March 2026 and reached 4.25% in May, by our calculation from the published index.20 A "lesser of CPI-U or 3%" clause gives different answers from one year to the next.

The US on-highway diesel price was $6.352 a gallon on October 26, 2026, up $2.634 from a year earlier, according to the US Energy Information Administration.37 A cold-chain contract that sets a fuel surcharge from a monthly diesel band needs someone to look up the band every month.

CPI-U has stayed above a 3% cap since March 2026, so a lesser-of clause now gives a different answer

Twelve-month change in CPI-U, not seasonally adjusted, against a 3% contract cap

CPI-U, twelve-month changeA 3% cap
0%2%4%6%3.74%3%
Jan 25Mar 25Jun 25Sep 25Dec 25Mar 26May 26Sep 26

Source 20 · Computed by us from FRED's CPIAUCNS series, selected months. October 2025 has no reading.

Show the numbers
CPI-U, twelve-month changeA 3% cap
Jan 253%3%
Mar 252.39%3%
Jun 252.67%3%
Sep 253.01%3%
Dec 252.68%3%
Mar 263.26%3%
May 264.25%3%
Sep 263.74%3%
12 · AI on invoices

A model reads the line, plain code does the sum, a person decides: AI on supplier invoices

In shortSoftware can now read invoices and contracts at a scale that makes checking every line practical, and its accuracy is yours to measure. It should do the arithmetic in plain code, cite every value, and leave every recovery decision to a person. Drug regulators' AI rules mostly leave this work alone. Your financial controls still apply.

Automate the reading and the arithmetic, and keep the judgment with people
How easy it is to verify the output →
Automate first
Automate, then read
Leave manual
People decide
Rate sumsDuplicatesReading PDFsAmendmentsDraft lettersAccept a gapSend a claim
Judgment needed →

Our reading of the sources 38,39 · Our judgment. Your risk appetite and your controls may move these.

Show the numbers
ItemJudgment needed (0–1)How easy it is to verify the output (0–1)
Rate sums0.100.80
Duplicates0.100.68
Reading PDFs0.100.56
Amendments0.800.72
Draft letters0.800.60
Accept a gap0.800.30
Send a claim0.800.16

What FDA, the EU and the PCAOB say about AI, and where it stops for invoices

SourceWhat it saysFor invoice audits (our reading)
FDA draft guidance, January 2025Does not address AI "when used for operational efficiencies (e.g., internal workflows, resource allocation, drafting/writing a regulatory submission) that do not impact patient safety, drug quality, or the reliability of results".38Paying suppliers is an operational workflow, so this draft stands aside.
Draft EU GMP Annex 22Covers AI in good manufacturing practice (GMP), the rules for making medicines. It says generative AI and large language models "should not be used in critical GMP applications".40 Still a draft: EudraLex Volume 4 lists no Annex 22 and Annex 11 at its January 2011 revision.41 EMA's report records that the drafting group has discussed widening the scope.42An invoice audit is a finance control outside GMP. Keep it away from batch and quality decisions, and from any record that feeds one.
EU AI Act, after the AI Omnibus (Regulation (EU) 2026/1744)The Omnibus took effect July 27, 2026; Annex III high-risk rules apply from December 2, 2027, Annex I product rules from August 2, 2028.43Invoice checking is not on the Annex III list as we read it. Have counsel confirm.
Amendments by the Public Company Accounting Oversight Board (PCAOB), AS 1105 and AS 2301Audit evidence from technology-assisted analysis, for fiscal years beginning on or after December 15, 2025.44Your auditors have their own rules for such analysis, and may ask how yours works.

Four limits of AI on supplier invoices

An invoice is untrusted inputA supplier writes it. The OWASP Gen AI Security Project lists prompt injection first among language model risks, including instructions hidden in external files.39 Treat text on an invoice as data, never as instructions.
Models can misreadWe found no independent benchmark of line-item reading on pharmaceutical invoices, and vendors' figures are not comparable. Measure it on yours, and send low-confidence fields to a person.
The arithmetic should be codeA model reads the numbers. Plain code multiplies them, so the same inputs always give the same answer.
A new control needs testingIf the check becomes a key control, one your auditors rely on, it gets tested like any other. Keep who checked, cited, decided and approved.

The decision stays with a person for a practical reason as well as a legal one. A difference on paper may be a signed change order that never reached the file, an approved exception, or a credit already given. The software cannot phone the category manager and ask. A person decides each recovery, and a person's name goes on each letter.

13 · Checking invoices by hand

Sampling, email chases and a recovery firm: how supplier invoices get audited by hand

In shortAccounts payable matches and pays. Someone checks a sample. A recovery firm may come years later. By our estimate, a single contested CRO invoice can take a working day or more by hand, spread across people who rarely sit together, and the follow-through on the claim is often the first thing to slip.

Accounts payable to internal audit: who touches a contested invoice

AP

Accounts payable specialist

Codes the invoice, runs the match, releases it, and answers the supplier's calls.

Cares about: clean invoices never waiting.
AL

Payables or procure-to-pay audit lead

Reads the exceptions, decides what to dispute, and writes the letter.

Cares about: seeing the line, the clause and the receipt together.
CM

Category manager

Negotiated the rates and tiers, and holds the relationship.

Cares about: getting what was negotiated, without a fight.
SM

Study manager or clinical operations

Confirms visits and active sites from the trial system.

Cares about: being asked once.
FC

Finance controller

Sets hold rules, signs large claims, watches cash and late fees.

Cares about: withholding in good faith, and paying the rest on time.
IA

Internal audit

Tests payment controls, usually on a sample.

Cares about: evidence of who decided what.
A disputed invoice crosses five desks, and the claim often stalls at the last one
  1. 1Match and code

    PO and receipt checked on totals.

    Accounts payableSame day
  2. 2Exception or sample

    Something looks off, or a quarterly sample picks it.

    Audit leadDays to months
  3. 3Find the paper

    Agreement, amendment, rate card, receipts, visit log.

    Audit lead, category manager, study managerHours to days
  4. 4Decide and write

    Dispute or accept. The letter cites the clause.

    Audit lead, category managerHours
  5. 5Chase the credit

    Supplier agrees, and someone must match the credit note.

    Accounts payableWeeks
  6. 6Recovery firm

    Paid invoices re-read later, for a share.

    Outside firmMonths or years

Our reading of the sources 4 · Our summary of common practice, with the recovery firm's timing from its own filing. Your steps may differ.

Show the numbers
StepWhat happensWhoTime
Match and codePO and receipt checked on totals.Accounts payableSame day
Exception or sampleSomething looks off, or a quarterly sample picks it.Audit leadDays to months
Find the paperAgreement, amendment, rate card, receipts, visit log.Audit lead, category manager, study managerHours to days
Decide and writeDispute or accept. The letter cites the clause.Audit lead, category managerHours
Chase the creditSupplier agrees, and someone must match the credit note.Accounts payableWeeks
Recovery firmPaid invoices re-read later, for a share.Outside firmMonths or years
Finding the paper and chasing the credit take about as long as all the checking

An estimate for one monthly CRO invoice with findings, checked by hand: about 10 hours

Finding the agreement, latest amendment and signed rate card2 hours
Checking each line's rate, cap and tier2 hours
Writing the dispute letter with each clause1.5 hours
Matching visits, sites and receipts to what was billed1.5 hours
Checking pass-throughs, fees and travel1 hour
Following the claim to its credit note2 hours

Illustrative · replace with your own numbers · An estimate, with no public benchmark behind it. Time one of your own.

Show the numbers
ItemValue
Finding the agreement, latest amendment and signed rate card2 hours
Checking each line's rate, cap and tier2 hours
Writing the dispute letter with each clause1.5 hours
Matching visits, sites and receipts to what was billed1.5 hours
Checking pass-throughs, fees and travel1 hour
Following the claim to its credit note2 hours

Three ways teams run invoice audits: sample, recovery firm or software

WayGood atWeak atCost shape
In-house samplingKnows the contracts and the peopleSees only the sample, and competes with month-endStaff time
Recovery audit firmDuplicates, unapplied credits, statements; low up-front costComes after payment, and old claims are harder to winA share of recoveries; one vendor says 20% to 30%29
Software before paymentEvery line, before the money leavesNeeds contracts organized and access to delivery records; needs a person to decideSubscription, setup, and review time

Many teams combine them: a check before the run for what the contract and records can settle, a yearly sweep for rebates and tiers, and a recovery firm for the older years that no one will re-read. Check that your recovery contract does not claim a fee on amounts your own team finds.

Part B · See it working

$438,322.00 billed, five lines disputed, a person deciding each: Botminds Supplier Invoice Audit on one CRO invoice

Part A described the work without naming a product. This part shows how Botminds does it, at a fictional drug company on a Wednesday before its Thursday payment run. Every company, person, contract clause, invoice and number on the screens is sample data, and the contract text is written for the example.

14 · Quillon's invoice, line by line

Quillon's September invoice, from a red line at 9:40 am to a credit note on the tracker

In shortThis is the example from the top of the page, inside the product. Priya Ranvelle, the payables audit lead, opens the invoice as a table of lines. Each line sits beside its contract term, rate card and PO, receipt or log, with the difference in red. She decides each finding, the letter drafts itself from what she disputed, and the tracker follows it to the credit note.

1

Ten lines beside their contract, with a held invoice on top

Wednesday, October 7, 2026, with the run due Thursday at 2:00 pm. Across the top sit the invoices held for Priya: Quillon, Sorrelby, Bellwick, Holmbrae, Kelbrook, a Calderwyn duplicate, and new arrivals to check.

Quillon's invoice QCR-26-0917 bills $438,322.00, is worth $415,256.40 per contract, and sits $23,065.60 above it. Ten of ten lines were checked against master agreement MSA-0417, its rate card and PO 4500-8790. Five differ. The recovery tracker on the right shows seven steps from finding to credit note.

The line audit. Billed, per contract, above contract, and a row for each line. Line 1 is open with its arithmetic.
2

Line 1: invoice, contract and evidence side by side

The evidence view lays out three things. The invoice says $180.00 an hour. The contract says $160.00, in Exhibit B. The evidence is the cap in section 4.3. The sum on the screen is 486 hours × ($180.00 − $160.00) = $9,720.00.

The explanation: $180.00 comes from Quillon's unsigned 2027 proposal of August 14, is 15.9% above the 2025 rate of $155.34, and no change order lists it. The software rates its confidence at 0.98. Priya can dispute it, accept it with a reason, or ask Omar Haddad, the category manager.

Three panes of evidence. The finding in the middle and the source document on the right, with the line highlighted.
3

Line 4: fourteen visits billed, twelve in the visit log

Section 5.4 pays for completed visits only. The visit log from the clinical trial system shows twelve. The Site 118 visit on September 24 was canceled, and the Site 131 visit moved to October 6, so that one belongs on October's invoice. Two visits at $2,450.00 is $4,900.00.

The quantity comes from the delivery record. The invoice's own count is what is being tested.

Billed against delivered. The visit log decides the quantity.
4

Line 7: a handling fee the contract rules out

Section 7.2 says pass-through costs are invoiced "at actual cost, without markup, handling fee or administrative charge". Line 6 already bills the lab kits at the receipt amount, $58,420.00. Line 7 adds 8%, so the whole $4,673.60 line is extra.

Line 5 applies the tier from Amendment 2: 8 of the 38 active sites should be $980, a difference of $1,360.00. Line 10 finds two business fares on flights under three hours with no written approval: $3,418.00 against $1,006.00 economy, a difference of $2,412.00.

A fee the contract forbids. The clause, the receipt and the sum in one place.
5

Priya disputes all five, and the claim drafts itself

The letter writer drafts only from items a person has disputed, and cites each clause. The tracker's next step is Approved, and it shows who still has to sign: Priya and, because the claim is over $10,000, Omar. The sixth decision is the payment date: the invoice asks for Net 30, section 9.1 gives 60 days from receipt, so the undisputed amount is scheduled for December 6.

The claim drafts. Six of six decided. Nothing has gone to the supplier yet.
6

Approve the short-pay: $23,065.60 withheld, $415,256.40 paid on contract terms

The approval window shows billed, withheld and payable, the full letter, and the approvals it needs. Nothing goes out until both people approve. The ERP connection is read-only, and the short-pay posts only after approval.

Approve the short-pay. Amounts, letter and approvers on one screen.
7

The letter goes, and the tracker waits for a credit note

Claim RC-122 goes to Quillon's billing team with each item, clause and amount. It says what is being withheld and why, and that the rest will be paid on December 6. The tracker's next steps are the supplier's reply, due within 30 days, and a credit note for $23,065.60, which the software matches automatically when it arrives.

The claim as sent. The letter, the evidence for each item and who approved it.
Seven steps from finding to credit note, with a person at the second and the fourth
  1. 1Found

    Five findings, $23,065.60 above contract.

    The software7:12 am
  2. 2Decided

    Each one disputed or accepted with a reason.

    Priya RanvelleOct 7
  3. 3Claim drafted

    The letter cites five clauses of MSA-0417.

    The letter writerOct 7
  4. 4Approved

    Two people, because it is over $10,000.

    Priya Ranvelle, Omar HaddadOct 7
  5. 5Sent, short-paid

    $23,065.60 withheld, the rest paid December 6.

    Accounts payableOct 7
  6. 6Supplier agreed

    Reply due within 30 days.

    QuillonExpected
  7. 7Credit note received

    Matched to the claim automatically.

    The softwareExpected

Fictional example from this guide · The sample's dates and names.

Show the numbers
StepWhat happensWhoTime
FoundFive findings, $23,065.60 above contract.The software7:12 am
DecidedEach one disputed or accepted with a reason.Priya RanvelleOct 7
Claim draftedThe letter cites five clauses of MSA-0417.The letter writerOct 7
ApprovedTwo people, because it is over $10,000.Priya Ranvelle, Omar HaddadOct 7
Sent, short-paid$23,065.60 withheld, the rest paid December 6.Accounts payableOct 7
Supplier agreedReply due within 30 days.QuillonExpected
Credit note receivedMatched to the claim automatically.The softwareExpected
Where the sample meets the real world. Clause 4.3 of the sample contract caps 2026's rise at the lesser of CPI-U or 3%, and the signed card rises exactly 3%, from $155.34 to $160.00. Real CPI-U for the year to December 2025 was 2.68% by our calculation,20 which would give about $159.50. The check uses what both parties signed, so the example stays at $160.00. A real team might raise that difference too.
15 · Other suppliers, other errors

A renewal over its cap, a batch at the wrong tier, a duplicate blocked: the same check on other suppliers

In shortThe same screen handles a software renewal, a drug substance batch, a stability lab, a cold-chain carrier and a design agency. Each has its own contract and delivery record. A sweep behind the payment run finds what only shows after the fact, such as a yearly rebate.

1

The contract and its terms sheet: every rate with its clause

Before any check, the software reads the agreement. The terms sheet lists what will be checked, each with its clause: fees, the yearly cap, Exhibit B, the site tier, completed visits, pass-through at cost, travel, payment and rebate. The latest signed amendment wins, and drafts are ignored. Omar can read this page, and it is where he finds out how his negotiated terms are being billed.

A contract and its terms. The sample contract's text is written for the example.
2

A software renewal above its 5% cap

Sorrelby Data Systems bills 1,200 seats at $412.00. Last year's order form says $380.00, and section 6.2 caps the rise at 5%, so $399.00 at most. The invoice is 8.4% up. 1,200 × $13.00 is $15,600.00.

A renewal above its cap. The cap comes from last year's signed fee.
3

Batch 11 billed at the price for batches 1 to 10

Alder Peak Bioservices bills a Dravenzo drug substance batch at $412,000. Section 3.1 drops the price to $340,000 from the eleventh batch of the contract year, and the release register shows ten released already. The dispute has already gone: $72,000.00 is short-paid, co-signed on October 2, and the rest is payable November 29.

A batch at the wrong tier. The batch register supplies the count.
4

A "-R" invoice blocked before it is paid twice

Calderwyn Analytical Labs sends CAL-7781-R for $22,750.00: the same lot, tests and dates as CAL-7781, paid September 17. Section 8.3 says a corrected invoice must reference and cancel the one it replaces, and this one does neither. It is blocked before payment, and the supplier is asked to cancel it. Duplicate invoice detection looks back over 24 months of paid invoices.

A duplicate blocked. Every line matches an invoice already paid.
5

A fuel surcharge against the published diesel band

Holmbrae Logistics bills an 18.5% fuel surcharge on $88,460.00 of freight. Schedule 3 sets the percent each month from a national diesel index band. In the sample, August's index is $3.86, which falls in the 14.2% band. The difference is $3,803.78.

That index is sample data. The real US on-highway average was $6.352 a gallon on October 26, 2026.37 A real contract's band table would look different, and the check would read the real index.

A surcharge against its index. The sample's index and bands are fictional.
6

A new arrival, checked before the run

Holmbrae's October invoice arrives while Priya is working. She runs the audit and watches the steps: reading, finding terms, matching, checking. Three lines match, and a $1,240.00 residential delivery surcharge does not. All four deliveries went to hospital pharmacies, which Schedule 4 treats as commercial addresses.

A new arrival checked. Clean lines pass, and only the surcharge waits for a person.
7

The sweep behind the run finds a $142,320.00 rebate

Some errors only show when a year is over. The post-payment sweep reads paid invoices from the last 24 months for rebates and tiers never credited. It finds that Cobbleford paid Quillon $11,860,000 in 2025 across three SOWs. Section 9.5 gives 1.2% once a year passes $10,000,000, due by March 31, 2026. No credit note exists. Over $100,000, so Priya, Omar and Dana Okafor all sign.

A rebate claim drafted. Found after payment, still waiting for a person to approve it.
16 · Recoveries and leakage

Every claim from drafted to credited, and where the sample's leakage comes from

In shortThe invoices list shows what is held, blocked, short-paid and released. The recoveries board shows every claim by stage, the part where a finding turns into money. The dashboard shows found, withheld and recovered by supplier and finding type. Every figure here is sample data.

All invoices. Status, lines checked, amount above contract and pay date. Lena Ortiz in accounts payable works from here.
Recoveries by stage. Every amount withheld or found after payment, through to the credit note.

$68.4 million audited, $0.84 million found: the sample's 30-day dashboard

$68.4 million of spend audited, 27,840 lines checked, $0.84 million found above contract (1.2%), $0.38 million withheld before payment, and $0.17 million recovered after payment as credit notes arrive. The median from letter to credit is 18 days, and suppliers agreed to 83% of the letters sent. These are sample figures, shown for what the screen does.

Found and recovered. The first screen a controller reads, on sample data.
In the sample, rates and tiers make up over half of what is found
Rate above contract: 29%Volume tier or rebate: 26%Markup on pass-through: 14%Billed more than delivered: 12%Expenses and fees outside contract: 10%Duplicate invoice: 9%
$0.84Mfound
  • Rate above contract29%
  • Volume tier or rebate26%
  • Markup on pass-through14%
  • Billed more than delivered12%
  • Expenses and fees outside contract10%
  • Duplicate invoice9%

Fictional example from this guide · Last 30 days on sample data. Expense and fee categories combined here.

Show the numbers
PartValue
Rate above contract29%
Volume tier or rebate26%
Markup on pass-through14%
Billed more than delivered12%
Expenses and fees outside contract10%
Duplicate invoice9%
About two in three found dollars end as money kept or credited in the sample
Found$840K
A person agreed$792K
Letter sent$731K
Supplier agreed$604K
Credited or short-paid$548K

Fictional example from this guide · Last 30 days on sample data. Your own funnel is the number to measure.

Show the numbers
StageCount
Found$840K
A person agreed$792K
Letter sent$731K
Supplier agreed$604K
Credited or short-paid$548K
In the sample, one CRO's findings spread across most checks, while the carrier's cluster in rates and fees

Findings by supplier and type, last 90 days

None1 to 34 to 89 or more
RateTier or rebatePass-throughDeliveredDuplicateExpensesFeesQuillon Clinical Research9 or more4 to 89 or more9 or moreNone4 to 81 to 3Alder Peak Bioservices1 to 34 to 8None1 to 31 to 3None1 to 3Sorrelby Data Systems4 to 81 to 3None4 to 8NoneNone1 to 3Holmbrae Logistics9 or more1 to 3None1 to 31 to 3None4 to 8Kelbrook Lab Supplies9 or moreNoneNone1 to 31 to 3None4 to 8Bellwick Creative1 to 3None1 to 31 to 3None1 to 34 to 8Calderwyn Analytical LabsNoneNoneNone1 to 31 to 3NoneNonePellfield Facilities Services1 to 3NoneNoneNoneNoneNone1 to 3

Fictional example from this guide · Sample data about fictional suppliers. It describes no real company.

Show the numbers
RateTier or rebatePass-throughDeliveredDuplicateExpensesFees
Quillon Clinical Research9 or more4 to 89 or more9 or moreNone4 to 81 to 3
Alder Peak Bioservices1 to 34 to 8None1 to 31 to 3None1 to 3
Sorrelby Data Systems4 to 81 to 3None4 to 8NoneNone1 to 3
Holmbrae Logistics9 or more1 to 3None1 to 31 to 3None4 to 8
Kelbrook Lab Supplies9 or moreNoneNone1 to 31 to 3None4 to 8
Bellwick Creative1 to 3None1 to 31 to 3None1 to 34 to 8
Calderwyn Analytical LabsNoneNoneNone1 to 31 to 3NoneNone
Pellfield Facilities Services1 to 3NoneNoneNoneNoneNone1 to 3
Leakage by supplier. Size shows spend and color shows the share found above contract. A category manager can use this before a renewal.
17 · Who checks, who signs

Who can send a recovery claim: seven agents check and draft, and people co-sign at $10,000 and $100,000

In shortSix specialist AI agents check each invoice and one drafts the letter. None changes an amount in your ERP or sends anything by itself. A person decides each finding, accepting one takes a reason, and supplier letters are approved and co-signed by amount. Controls like these support your own compliance program; the product is never "compliant" or "certified" on your behalf.

Invoice reader

Reads PDF and e-invoices: header, lines, quantities, rates, tax and payment terms. Cites each field.

Never changes an amount or guesses an unreadable field. Low-confidence fields go to a person.

Contract terms librarian

Finds the agreement, SOWs, amendments, rate cards and rebate schedules, and keeps a terms sheet with clauses.

Never uses a draft or unsigned proposal.

Three-way matcher

Matches lines to the PO, the receipt or service entry, the visit log and the active-site list.

Never takes quantities from the invoice it is testing.

Rate and tier checker

Checks every line's arithmetic: rate, cap, tier, discount and index surcharge.

Never reports a finding without its line, its clause and the sum in full.

Pass-through and expense checker

Checks pass-through costs against receipts, markups, travel class and fees outside the contract.

Never treats a missing receipt as a finding. A missing receipt is a question.

Duplicate and terms sentinel

Looks back 24 months for duplicates, and compares the invoice's payment terms with the contract's.

Never cancels a paid invoice. It blocks a duplicate before payment.

Dispute letter writer

Drafts a courteous claim from items a person disputed, citing each clause.

Never sends. A person approves every supplier letter.

Priya, Omar, Dana, Lena and Sam: who works Thursday's payment run

Fictional, from the sample data
PR

Priya Ranvelle · payables audit lead

Decides every held invoice before Thursday's 2:00 pm run, and approves letters.

"Show me the line, the clause and the receipt. I'll decide in a minute."
OH

Omar Haddad · category manager, clinical and manufacturing

Owns CRO and contract manufacturer (CDMO) contracts, and co-signs claims over $10,000.

"I negotiated that rate card. I want it billed."
DO

Dana Okafor · finance controller

Sets hold rules, and co-signs claims over $100,000.

"Withhold in good faith, pay the rest on time."
LO

Lena Ortiz · accounts payable specialist

Releases clean invoices and answers suppliers.

"Clean ones should never wait for me."
SP

Sam Patel · internal audit

Tests payment controls each quarter from the audit trail.

"Every line checked beats any sample I could pull."

Accepting a finding takes a reason, and hold rules are your settings

A person may accept a difference: a change order not yet filed, an approved exception, a credit already given. The reason goes on the audit trail, and the sample keeps that trail for seven years, a setting to match your own policy. The payment run, the hold threshold ($250 in the sample, below which the invoice is paid and the amount claimed back later), the rounding tolerance, automatic release of clean invoices, approvers by amount, and each check are settings. Changes go on the audit trail too.

Accept with a reason. A person can overrule the finding, and the reason is kept.
Hold rules and approvals. Your payment controls, set once and changed on the record.

Contracts and visit logs in, cited claims and a credit note tracker out

From your finance systems

  • Invoices by e-invoice network, EDI, PDF or email
  • POs, goods receipts, service entries and payments, read-only
  • Rebate schedules and supplier records

From contract and delivery records

  • Agreements, SOWs, amendments and rate cards
  • Visit logs and active sites from the trial system
  • Receipts, shipment files, seat reports and batch registers
Agents read and check, people decide and sign Every line beside its clause and its evidence, on one screen

Outputs

  • Line audit: invoice, contract, rate card and PO side by side
  • Recovery claims with each clause cited
  • Tracker from finding to credit note
  • Leakage by supplier and finding type
  • Audit trail for payment-control testing

What changes for the team

  • Clean invoices go straight to the run
  • A person sees the exceptions, with evidence
  • Omar sees how his contract is billed

Built for enterprise payables. Roles and separation of duties, maker-checker sign-off by amount, a full audit trail, exports of exceptions, and connections by category: ERP, e-invoicing network, email, contract system, clinical trial system. Connections read; a short-pay posts only after a person approves it. Botminds is SOC 2 Type II audited, and manages information security to ISO 27001.

The design targets, and an estimate of hours on one contested invoice

The solution's design targets, measured in each live deployment, are about 4 minutes from arrival to a verdict on every line, 96% of invoices released clean, and 1.4% of audited spend found above contract. These are goals, with no customer's results behind them. The sample's 30-day screen above shows 1.2%. Your rate depends on your contracts and suppliers.

The product team's estimate: one contested CRO invoice drops from about 10 hours to 1.2

Hours for one monthly CRO invoice with findings

By handWith the solution
Finding the agreement, amendment and rate card2 hours0.1 hours
Checking rates, caps and tiers2 hours0.2 hours
Following the claim to its credit note2 hours0.5 hours
Matching visits, sites and receipts1.5 hours0.1 hours
Writing the dispute letter1.5 hours0.2 hours
Checking pass-throughs, fees and travel1 hour0.1 hours

Illustrative · replace with your own numbers · The product team's estimate, with no measured benchmark behind it. Time your own in a pilot.

Show the numbers
By handWith the solution
Finding the agreement, amendment and rate card2 hours0.1 hours
Checking rates, caps and tiers2 hours0.2 hours
Following the claim to its credit note2 hours0.5 hours
Matching visits, sites and receipts1.5 hours0.1 hours
Writing the dispute letter1.5 hours0.2 hours
Checking pass-throughs, fees and travel1 hour0.1 hours
Part C · Ready to automate?

Automating your supplier invoice audit: what it could return against a recovery firm's fee, and how to test it first

Written to you, the person who answers for what your company pays its suppliers: what overcharges cost, what automation could return, how ready you are, and how to run a measured first step.

18 · What overcharges cost

Money paid above contract, claims that age, hours nobody tracks: the price of unchecked supplier invoices

In shortWe found no reliable published rate of supplier overbilling for life sciences. What you can see is that wrong payments exist at well-run organizations, that claims lose value with age, and that a dispute can grow large. The useful number is your own, and you can find it in a week on one supplier.

2%

of annual disbursements (payments out) were duplicate or erroneous at bottom performers, against 0.8% at the top, in APQC's cross-industry benchmark.30

APQC via CFO.com · March 2020
24 in 100

dollars of valid claims had come back when one Texas recovery audit contract ended.3

Texas Comptroller · January 2023
$7.1M

is what one biotech alleged a CRO overbilled, on $25.5 million invoiced. Those are allegations in a pleading, with no finding.27

Delaware Superior Court · 2021
In this example, overcharges stopped outweigh hours saved, and both outweigh a recovery firm's net

An example company with $120 million a year of audited supplier spend, a year's value

Overcharges kept or credited$390K
Hours saved, valued$200.6K
Recovery firm's net, after its fee$90K

Illustrative · replace with your own numbers · The calculator's starting inputs in section 19. All are examples. A clean supplier base shrinks the first bar; the third uses one vendor's 0.1% and the middle of its 20% to 30% fee range.

Show the numbers
ItemValue
Overcharges kept or credited$390K
Hours saved, valued$200.6K
Recovery firm's net, after its fee$90K

Overcharges, rebates, duplicates and three more: finding your own figures in a week

CostWhere it hidesHow to find your number in a week
Overcharges paidLines that passed on totalRe-check twelve months of one CRO's invoices against the signed contract and rate card.
Missed rebates and tiersClauses that fire once a yearList every contract with a rebate or tier, and look for the credit note.
Duplicates"-R" or corrected invoices, new invoice numbersMatch paid invoices by supplier, amount and service date over 24 months.
Agreed claims never creditedEmail threads and spreadsheetsTake last year's disputes and find the credit note for each.
Early paymentInvoices asking for shorter terms than the contract givesCompare invoice terms with contract terms for your top 20 suppliers.
Hours per contested invoiceAcross payables, category and study teamsAsk each person to log one contested invoice from start to finish.

Supplier trust and sites paid on time: what stays off the calculator

Your negotiators' workA rate negotiated and then not billed is a saving that exists only in a slide.
Supplier trustA short, cited letter early is easier to accept than a large claim years later.
Sites paid on timeA narrow dispute keeps visit money moving. A 2017 white paper says about 40% of sites, in US research, call slow payment a primary operating concern.23
An early warning on a studyVisits billed and not done may also be a question for clinical operations.
Your auditors' timeEvidence of who checked and decided, on every line, is easier to test than a sample.
19 · Line audit or recovery firm

Line audit or recovery firm: compare what each returns on your supplier spend

In shortReturn comes from overcharges kept before they leave, hours your people get back, and whatever you would otherwise have shared with a recovery firm. Use your own inputs. The share billed above contract has no public benchmark for life sciences, so re-check one supplier to replace our example.

Where invoice leakage can be stopped: five formulas

Rates and tiers

Billed at what was signed

Rate card compliance, caps and tiers checked on every line.

spend × share above contract × share kept
Delivered

Only what happened

Visits, sites, seats and batches from the delivery record.

(units billed − units delivered) × unit price
Duplicates

Stopped before the run

A 24-month look-back on every new invoice.

duplicate invoices × their amounts
Follow-through

Every claim to a credit note

Credit note tracking, so agreed money comes back.

agreed claims × share credited
People

Hours on exceptions only

Clean invoices pass, and contested ones arrive with evidence.

contested invoices × hours saved × loaded cost

Invoice audit calculator: overcharges, hours and a recovery firm's net on your spend

Every input marked illustrative is an assumption. Replace it with your own.

Your spend
Your invoices
A recovery firm, for comparison
Illustrative yearly value
Found above contract$0
Kept or credited$0
Hours freed0
Hours saved, valued$0
A recovery firm's net to you, for comparison$0
Yearly value, kept plus hours$0

Found = spend × share above contract. Kept = found × share kept. Hours freed = invoices × share needing a person × (hours today − hours with automation). Recovery firm's net = spend × its rate × (1 − its fee). Software and setup costs are yours to subtract. A recovery firm can still add value on older years.

We know of no independent public rate for overbilling in life sciences, so 0.5% is only an example. It sits between the 0.1% one recovery vendor gives29 and the 2% in APQC's bottom group,30 which measure other things. The 65% comes from the funnel on this guide's sample screen. Hours come from the product team's estimate. The 0.1% and the fee are apexanalytix's own figures from April 2025.29

20 · Score your payables team

Contracts on file, delivery data in reach, a written withholding rule: scoring your payables team for a line audit

In shortEight scored questions, each from 0 to 2, and a ninth for reflection. The meter adds up your score as you go, and each question says why it matters and what a strong answer sounds like. Nothing you choose leaves this page.

1
Spend and supplier mix

How much of your supplier spend sits under contracts with rates, tiers or caps?

Why it mattersA line audit needs a term to test against. A one-off purchase with a PO price gets little from it.
A strong answer"Most of it: CROs, CDMOs, labs and logistics, all under master agreements."
2
Signed contracts and rate cards

Can you find every signed agreement, amendment and rate card for your top 20 suppliers?

Why it mattersMissing paper is the first thing a line audit exposes, and a claim with no signed clause goes nowhere.
A strong answer"All in one contract system, with amendments filed the week they are signed."
3
Delivery records for billed quantities

Can you get visit logs, active sites, seat reports and receipts without emailing someone?

Why it mattersA rate check needs a contract. A quantity check needs what actually happened.
A strong answer"Read access to the trial system's visit log, and receipts arrive with each invoice."
4
How invoices reach you

Do invoices arrive in a form you can read reliably?

Why it mattersStructured invoices reduce reading risk. Mixed PDFs are workable with citations and a person for low-confidence fields.
A strong answer"A network for large suppliers, and clean PDFs by email for the rest."
5
Who decides a dispute

Is one person accountable for each dispute decision, with co-signers by amount?

Why it mattersA finding with no owner ages. Software can draft, and a named person must decide.
A strong answer"The audit lead decides, the category manager co-signs over a set amount, and the controller above that."
6
Your withholding rule

Have legal and finance agreed how and when you may short-pay, by supplier type?

Why it mattersAutomation makes withholding easy. Your contract decides whether it is allowed, and investigator funds may need special care.
A strong answer"A written hold threshold, a notice template per contract type, and a rule protecting site payments."
7
Following claims to a credit note

Could you list every open supplier claim and its stage today?

Why it mattersA finding only becomes money at the credit note. In one public audit, about a quarter of valid claim dollars had come back when the contract ended.3
A strong answer"Yes, by stage, with each one matched to its credit note in the ERP."
8
Internal audit's view

Has internal audit agreed what evidence a new check must leave for control testing?

Why it mattersIf this becomes a key control over payments, it gets tested.6 Decide the evidence before go-live.
A strong answer"Internal audit defined the fields: who checked, what was cited, who decided, who co-signed."
9
The invoice a supplier queries · for reflection

If your largest CRO called tomorrow to query a $5,000 short-pay, what would have to be true for you to show the line, the clause, the evidence and the decision in under a minute?

Why it mattersYour answer lists the gaps. Each gap is a candidate job for software: reading, matching, adding up or writing down.
A strong answerA short, specific list: "every rate tied to its clause, visits from the log, and a name and reason on every decision."
0–6

Explore

Re-check one large supplier by hand for twelve months. Get its contracts together, write your withholding rule, and name a decision owner. Your own rate tells you whether to go further.

7–11

Ready to pilot

Run a measured pilot on two suppliers over one past year, then live on new invoices. Your people decide every finding, and nothing goes to a supplier without approval.

12–16

Ready to implement

Plan every category: contracts and rate cards, system connections, hold rules as settings, approvers by amount, the evidence internal audit wants, and how your recovery firm fits.

21 · Questions that prove it

Show me the clause, show me the sum: what invoice audit software and recovery firms should prove on your contract

In shortAsk to see it on your own contract, with an invoice you already know is wrong. The questions below are about citation, arithmetic, who decides, follow-through and what happens to your data. Ask us too. A good answer is shown on your own documents.

A

Finding the clause and showing the sum

A1

Show me a rate on the terms sheet. Where is its clause?

Why it mattersA language model can be confidently wrong, so each value needs a source you can open.
Strong answer · warning sign
One click to the passage, on my contract.
"It's accurate. Trust the rate card."
A2

What does it do with an unsigned proposal or a conflicting amendment?

Why it mattersA draft rate looks exactly like a signed one on the page.
Strong answer · warning sign
Latest signed version wins, and a conflict goes to a person.
It takes the most recent document.
A3

Who does the arithmetic: the model or plain code?

Why it mattersThe same inputs must give the same answer, every time.
Strong answer · warning sign
Code, with the sum on the screen.
"The AI calculates it."
A4

What stops text hidden in an invoice from changing the result?

Why it mattersSuppliers write invoices. OWASP lists indirect prompt injection among the top language model risks.39
Strong answer · warning sign
Invoice text is treated as data, and you can test it.
"Our model wouldn't fall for that."
B

Decisions, letters and money

B1

Can anything reach a supplier, or change an amount in the ERP, without a person?

Why it mattersA wrong claim costs you trust, and a wrong short-pay may breach your contract.
Strong answer · warning sign
No. Read-only connections, with approval by amount.
"You can turn on auto-dispute."
B2

What happens when my person disagrees with a finding?

Why it mattersMany differences have good reasons, and those reasons are the evidence internal audit wants.
Strong answer · warning sign
Accept with a reason, on the trail.
It dismisses the flag and the reason is lost.
B3

How do you follow a claim to its credit note?

Why it mattersFindings are cheap. In one public audit, $205,475 of $840,613 had come back at contract end.3
Strong answer · warning sign
Stages, reminders, and a match to the credit note.
"We export a list of findings."
B4

Are your recovery figures yours or a customer's, and from what date?

Why it mattersPublished rates range from 0.05% to 11% for different things.
Strong answer · warning sign
Named method, labeled target, your own sample.
One round number with no definition.
B5

For a recovery firm: what is your fee on amounts my team finds itself?

Why it mattersContingency fees are a share of recoveries. Check the scope before an in-house check starts.29,4
Strong answer · warning sign
None. Fees apply only to claims you found.
"All recoveries in the audit period."
C

Systems, security and trial data

C1

What does the visit log feed carry? Could it reveal a treatment arm or patient data?

Why it mattersFinance needs counts by site and month. Nothing more should flow.
Strong answer · warning sign
Visit counts only, field by field, read-only.
"We connect to the whole trial system."
C2

What independent security audit can you show?

Why it mattersThis data holds your prices and your supplier relationships.
Strong answer · warning sign
A current SOC 2 Type II report and ISO 27001-managed security.
"We're GxP certified," or "compliant": no vendor can hold that for you.
C3

Who can see rate cards, and does any of my data train a shared model?

Why it mattersNegotiated rates are among your most sensitive commercial facts.
Strong answer · warning sign
Role-based access, and a written no-training term.
Vague terms, or a promise with no contract clause.
22 · A first pilot

Two suppliers, twelve weeks and the credit notes to prove it: piloting an invoice audit

In shortStart with a CRO and one everyday supplier. Re-check a past year against what your people already paid and disputed, then run live on new invoices with your existing process still in place. Measure the found rate, the upheld rate and the money actually returned. Then decide.

Twelve weeks, from a baseline to a decision on real invoices
Your teamWith the vendor
Pick suppliers, write the withholding rule
Load contracts, rate cards and amendments
Re-check one past year, compare with what you paid
Live on new invoices, parallel with today's process
Send first letters, approved by your people
Measure, and decide
Week 04812

Illustrative · replace with your own numbers

Show the numbers
ActivityFromTo
Pick suppliers, write the withholding rule02
Load contracts, rate cards and amendments14
Re-check one past year, compare with what you paid37
Live on new invoices, parallel with today's process611
Send first letters, approved by your people711
Measure, and decide1012
Start where contracts are dense and spend is large: CROs and CDMOs first
Annual spend →
Totals only
Start here
Leave for later
A rule or two
CRO servicesCDMO workCold chainRenewalsLab suppliesAgencies
How many terms the contract has to check →

Illustrative · replace with your own numbers · An example ordering. Plot your own categories.

Show the numbers
ItemHow many terms the contract has to check (0–1)Annual spend (0–1)
CRO services0.800.72
CDMO work0.800.60
Cold chain0.800.28
Renewals0.800.14
Lab supplies0.120.28
Agencies0.120.14

Measuring a line audit pilot: found, upheld and returned

MeasureHowWhat good looks like
Found rateAmount found ÷ audited spendYour number, by supplier and type
Upheld rateFindings your people dispute ÷ findings shownHigh enough that reviewers trust the queue
MissesKnown errors planted or found by hand that the check missedEach explained, and few
Reading accuracySample of lines read against the sourceMeasured on your invoices, with low-confidence fields routed to a person
Money returnedShort-paid plus credit notes ÷ foundTracked to the credit note
TimeHours per contested invoice, arrival to decisionLogged before and during
Payment timingUndisputed amounts paid on the contract's dateNo new late-payment interest
Deeper questions for a working session: contracts, suppliers and controls
D

Contract edge cases

D1

How do you handle a change agreed by email and not yet signed?

Why it mattersReal agreements say an amendment binds only when signed.5 People still agree by email.
Strong answer · warning sign
Flags it for a person to accept with a reason.
It treats the email as the contract.
D2

What happens when a clause contradicts itself, like "one and a half percent (0.5%)"?2

Why it mattersContracts contain errors, and a reader must not pick one quietly.
Strong answer · warning sign
It marks the conflict and asks.
It takes the figure in brackets.
D3

Can it read an index-linked clause each month, and show the index reading it used?

Why it mattersCPI-U and diesel both moved sharply in 2026.37,20
Strong answer · warning sign
Index, month and value on the finding.
A fixed percent loaded at setup.
E

Suppliers and controls

E1

Can I protect site payments from a hold on the same invoice?

Why it mattersSites run on thin cash.23
Strong answer · warning sign
Disputes are line by line, and the rest pays.
It holds the whole invoice.
E2

What can internal audit test, and what can an external auditor see?

Why it mattersAuditors have their own rules on technology-assisted analysis.44
Strong answer · warning sign
A full export of checks, citations and decisions.
"It's all in the dashboard."
23 · Withholding, claims, AI

Can you withhold payment? How far back can you claim? Common supplier invoice audit questions

In shortEach answer stands alone, in plain words, with the detail in the sections above.

What is a supplier invoice audit?

A supplier invoice audit compares each line of a supplier's invoice with the contract, the rate card, the purchase order and the record of what was delivered, to find what was billed above the agreed terms. When the audit runs before payment, the disputed amount can be withheld. When it runs after payment, the difference becomes a recovery claim.

How is an invoice audit different from a three-way match?

A three-way match checks that an invoice, a purchase order and a receipt agree with each other, usually on quantity and total. An invoice audit checks whether each line follows the contract: rate, cap, tier, delivered quantity, fees and payment terms. On services billed against a blanket purchase order, a match can pass an invoice whose lines are wrong.

What is an accounts payable recovery audit?

A recovery audit reviews invoices already paid, looking for overpayments such as duplicates, missed discounts and rebates, pricing errors and unapplied credits. Firms that do this work are mostly paid a share of what they recover. One such firm said in its 2019 annual report that claims were historically audited months and in some cases years after the original transaction.

How much does a recovery audit cost, and how much does it recover?

Most recovery firms work on contingency. One vendor, apexanalytix, wrote in April 2025 that fees are often 20% to 30% of recoveries and that typical recovery is about 0.1% of spend. Those are the vendor's own figures. A Texas state audit reported much less: $840,613 of valid claims on $54 billion of eligible vendor spend.

What does a CRO invoice review check?

A CRO invoice review checks each line against the master services agreement, the statement of work and its amendments, and the signed rate card. Take quantities from delivery records such as the visit log and active-site list, and compare pass-through costs with third-party receipts. Look for rates above the card, visits billed and not completed, missed tiers and markups on costs meant to be at cost.

What are pass-through costs in a CRO contract?

Pass-through costs are expenses a CRO pays to third parties and bills on to the sponsor, such as lab kits, investigator payments and travel. One change order we read bills them at actual cost and requires written approval above stated amounts; another contract reimburses only costs the sponsor approved in advance. A pass-through cost review compares each one with its third-party receipt. They can be a large share of a CRO's bill: one public CRO's reimbursed costs equaled 41% of its 2025 revenue.

Can you withhold payment on a disputed invoice?

Usually, if your contract allows it and you follow what it says, which normally means written notice of the disputed items and paying the undisputed part on time. For goods in the US, the Uniform Commercial Code lets a buyer who notifies the seller deduct damages from price still due on the same contract. Take legal advice on your own agreement.

How far back can you claim a supplier overpayment?

It depends on your contract and the governing law. Under the Uniform Commercial Code, a claim on a sale of goods generally has four years from the breach, whether or not you knew, and a contract can shorten that to one year. Services contracts follow their own terms and other limitation rules, so check with counsel.

How common are duplicate or erroneous invoice payments?

APQC's cross-industry benchmark, reported in 2020, put duplicate or erroneous payments at 0.8% of annual disbursements for top performers and 2% for bottom performers. We found no public figure specific to life sciences. Matching your own paid invoices by supplier, amount and service date over 24 months gives you your own number.

Does Sarbanes-Oxley require invoice audits?

Section 404 requires management to assess internal control over financial reporting, and it does not mention invoices or line checks. Your payment controls may be among the controls you assess and test. Smaller reporting companies with revenue under $100 million need no auditor attestation on those controls, though management still assesses them.

Does ICH E6(R3) require checking CRO invoices?

No part of ICH E6(R3), the international good clinical practice guideline, that we read asks for it. The guideline says the sponsor keeps ultimate responsibility for activities transferred to service providers and should ensure appropriate oversight, and that the financial aspects of a trial are documented in an agreement. Visits billed and not done may still be worth raising with clinical operations as an oversight question.

Can AI audit supplier invoices?

AI can read invoices and contracts and find the matching clause, and plain code can do the arithmetic, which makes it practical to check every line. It can misread, and suppliers write the text it reads, so each value needs a citation and each finding needs a person's decision. FDA's January 2025 draft guidance sets aside AI for operational efficiencies that do not affect patient safety, drug quality or the reliability of results.

Should a person decide each recovery?

Yes. A difference on paper may be a signed change order not yet filed, an approved exception or a credit already given, and a wrong claim costs money and trust. In a well-run process, software proposes and cites, a named person disputes or accepts each finding, and supplier letters are approved and co-signed by amount.

24 · Cheat sheet

Supplier invoice audit cheat sheet: eight steps from signed contract to credit note, with rule dates and 14 terms

Print this page

In shortThe whole guide on one screen: the method, the rules as of November 2026, the readiness bands and the terms.

The method
  1. Find the signed contract, amendments and rate card. The latest signed version wins.
  2. Read each invoice line, and cite each value.
  3. Take quantities from the delivery record, never from the invoice.
  4. Do the sums for rate, cap, tier, delivered, markup, expenses, duplicates and terms.
  5. Show the difference with its clause and evidence. A person disputes or accepts it with a reason.
  6. Short-pay with written notice, and pay the rest on the contract's date.
  7. Approve letters by amount, then follow each to its credit note.
  8. Sweep paid invoices for rebates and tiers that only show when the year ends.

Readiness: score 0–2 on eight questions: 0–6 explore · 7–11 pilot · 12–16 implement.

As of November 2026: no rule we read requires line-by-line checks · ICH E6(R3) in effect in the EU from July 23, 2025 · EU 30-day payment regulation still awaits the Council · EU cross-border e-invoicing from July 1, 2030 · draft EU GMP Annex 22 is still a draft · FDA's January 2025 AI draft sets operational uses aside. Published leakage figures run from 0.05% to 11% and measure different things.

14 terms
Blanket PO
One purchase order with a large budget, drawn down over time.
Three-way match
Checking that an invoice, an order and a receipt agree.
Rate card
The signed list of prices by role or item.
Pass-through
A third-party cost billed on to you, often at cost.
Tier
A price that changes after a volume is reached.
Cap
A limit on how much a price may rise.
Change order
A signed change to scope or budget.
CRO
Contract research organization, a firm hired to run trial work.
CDMO
Contract development and manufacturing organization.
CTMS
Clinical trial management system, which holds site and monitoring records.
Short-pay
Paying the undisputed part, with notice of what is held.
Credit note
The supplier's document reducing what you owe.
Recovery audit
A review of paid invoices for overpayments, usually for a share.
Contingency fee
A fee paid as a share of what is recovered.
25 · Sources

Sources

Accessed November 2026. Regulatory status statements are as of November 2026. Vendor figures are the vendor's own, with their dates.

  1. Medpace Holdings, Inc., Form 10-K for the year ended December 31, 2025; auditor's report dated February 10, 2026. sec.gov
  2. RedHill Biopharma Ltd. and inVentiv Health Clinical, Change Order 5.1, effective February 26, 2016, Exhibit B Payment Schedule, filed with the SEC. sec.gov
  3. Texas Comptroller of Public Accounts, letter to the 88th Legislature on the overpayment recovery audit, January 23, 2023. fmx.cpa.texas.gov
  4. PRGX Global, Inc. (a recovery audit firm), Form 10-K for the year ended December 31, 2019. sec.gov
  5. AROG Pharmaceuticals, Inc. and DAVA Oncology, LP, CRO services agreement effective June 12, 2018, filed with the SEC, sections 1.3 and 2.1. sec.gov
  6. 15 U.S.C. 7262, management assessment of internal controls (Sarbanes-Oxley Act section 404), 2023 edition. govinfo.gov
  7. SEC, Accelerated Filer and Large Accelerated Filer Definitions, Release 34-88365, March 12, 2020. sec.gov
  8. 15 U.S.C. 78m(b)(2), books, records and internal accounting controls. law.cornell.edu
  9. ICH E6(R3) Good Clinical Practice, Step 4, January 6, 2025, sections 3.5, 3.6.6 and 3.6.9. database.ich.org
  10. European Medicines Agency, ICH E6 good clinical practice page, read November 3, 2026. ema.europa.eu
  11. FDA, E6(R3) Good Clinical Practice, final guidance, September 2025. fda.gov
  12. 21 CFR 312.52, transfer of obligations to a contract research organization, 2025 edition. govinfo.gov
  13. Uniform Commercial Code section 2-717, deduction of damages from the price. Model text; each state enacts its own. law.cornell.edu
  14. Uniform Commercial Code section 2-607(3)(a), notice of breach. law.cornell.edu
  15. Uniform Commercial Code section 2-725, limitation of actions. law.cornell.edu
  16. Directive 2011/7/EU on combating late payment in commercial transactions. publications.europa.eu
  17. European Parliament, Legislative Observatory, procedure 2023/0323(COD), read November 3, 2026. oeil.europarl.europa.eu
  18. ICISA (International Credit Insurance & Surety Association), Update on EU late payment regulation, June 2024. A trade body's report of the member states' letter of June 12, 2024. icisa.org
  19. Council Directive (EU) 2025/516 of March 11, 2025 (VAT rules for the digital age), Official Journal, March 25, 2025. publications.europa.eu
  20. Federal Reserve Bank of St. Louis, FRED, series CPIAUCNS (CPI-U, not seasonally adjusted; source: US Bureau of Labor Statistics), read November 3, 2026. Twelve-month changes computed by us; October 2025 has no reading. fred.stlouisfed.org
  21. Getz, Smith, Botto, Murphy, Dauchy, New Benchmarks on Protocol Amendment Practices, Ther Innov Regul Sci 2024;58(3):539-548. pubmed.ncbi.nlm.nih.gov
  22. Sertkaya, Wong, Jessup, Beleche (Eastern Research Group for HHS ASPE), Examination of Clinical Trial Costs and Barriers for Drug Development, July 25, 2014, Table 2. aspe.hhs.gov
  23. Society for Clinical Research Sites with Greenphire, Site Payments and Patient Reimbursements: A Global Perspective, white paper, April 2017. myscrs.org
  24. Association of Certified Fraud Examiners, Occupational Fraud 2026: A Report to the Nations: 2,402 cases in 143 countries. Copy on ACFE Mexico's site. acfe-mexico.com.mx
  25. Association for Financial Professionals, press release on the 2026 AFP Payments Fraud and Control Survey, April 14, 2026: 465 US treasury practitioners, surveyed January 2026, underwritten by Truist. financialprofessionals.org
  26. Association of Certified Fraud Examiners, The Fraud Tree, 2026 edition. acfe.com
  27. inVentiv Health Clinical, LLC v. Odonate Therapeutics, Inc., C.A. No. N19C-12-033 PRW CCLD, Delaware Superior Court, decided January 26, 2021, corrected February 18, 2021. A ruling on a motion to dismiss; the court took the allegations as pleaded. courts.delaware.gov
  28. Tony Ware, HHS contractor to settle self-reported False Claims allegations, Federal Times, March 15, 2017. The matter was reported as allegations and a settlement. federaltimes.com
  29. apexanalytix (a recovery audit vendor), How Much Does an Accounts Payable Recovery Audit Cost?, April 10, 2025. The vendor's own figures. apexanalytix.com
  30. Perry D. Wiggins (APQC), Metric of the Month: Detect and Prevent Duplicate or Erroneous Payments, CFO.com, March 3, 2020. cfo.com
  31. McKinsey & Company, Mitigating procurement value leakage with generative AI, April 9, 2025. We read the opening of the web page and excerpts of the report, not the full PDF, so we cite only the one client result and leave out the report's wider estimate. mckinsey.com
  32. World Commerce & Contracting and Deloitte, The ROI of Contracting Excellence, 2023: 9.2% of contract value in 2014, 8.6% now; data from 1,236 organizations, April 2021 to December 2022. deloitte.com
  33. World Commerce & Contracting with Ironclad (a contract software vendor), Closing the Procurement Value Gap, January 13, 2026. We read the summary pages only; they state no formula or sample, and the full report is for members. worldcc.com · info.worldcc.com
  34. Deloitte Belgium, E-invoicing and real-time compliance at EU level, January 29, 2026. deloitte.com
  35. EY Global Tax News, French Tax Authorities publish guidance on September 2026 e-invoicing mandate, July 27, 2026. globaltaxnews.ey.com
  36. Medius (an accounts payable software vendor), page on Ardent Partners' The State of ePayables in 2025: AP's Unfinished Journey. A vendor's summary; we did not read the full report. medius.com
  37. US Energy Information Administration, Gasoline and Diesel Fuel Update, read November 3, 2026: week of October 26, 2026. eia.gov
  38. FDA, Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products, draft guidance, January 2025. fda.gov
  39. OWASP Gen AI Security Project, LLM01:2025 Prompt Injection. genai.owasp.org
  40. European Commission and PIC/S, draft EU GMP Annex 22, Artificial Intelligence, consultation July 7 to October 7, 2025. A draft, not in force. picscheme.org
  41. European Commission, EudraLex Volume 4 page, read November 3, 2026: lists Annex 11 at its January 2011 revision and no Annex 22. health.ec.europa.eu
  42. European Medicines Agency, report of the multistakeholder workshop on AI guidance development for Annex 22, EMA/156789/2026, workshop June 30, 2026, file dated October 1, 2026. ema.europa.eu
  43. European Commission, regulatory framework for AI, on Regulation (EU) 2026/1744: in force July 27, 2026; Annex III to December 2, 2027; Annex I to August 2, 2028. digital-strategy.ec.europa.eu
  44. SEC, Order Granting Approval of Amendments on Technology-Assisted Analysis (PCAOB AS 1105, AS 2301), Release 34-100774, August 20, 2024. sec.gov
Next step

See it on your own invoices.

Explore the solution, or bring one supplier's last twelve months of invoices and its signed contracts, and we will lay every line beside its clause with you. Your people decide every finding.

botminds.ai The complete guide to supplier invoice audit · November 2026. Cobbleford Pharma, Quillon Clinical Research, Alder Peak Bioservices, Holmbrae Logistics, Kelbrook Lab Supplies, Sorrelby Data Systems, Bellwick Creative, Calderwyn Analytical Labs, Pellfield Facilities Services, Nettlegate Travel & Meetings, Veltrimab, Talvoren, Dravenzo and every other company, product, person, contract, invoice and figure in the example and the screens are fictional. They describe no real supplier, invoice or dispute. Companies named in Part A are named only for what their own filings, a court record or a published report says. Regulatory status is as of November 2026; check the sources before relying on it. This guide is general information and is not legal, audit or accounting advice.