A two way match in accounts payable checks the invoice against the order, and the reason it exists is services. A business that only bought physical goods could three way match everything. Real businesses buy consultancy, software, maintenance, marketing and professional advice, none of which arrives on a pallet or gets receipted by a warehouse. For that spend the goods receipt is missing, and the honest question is not whether to drop to a two way match but what replaces the third document. This page is about that replacement: how to evidence that a service was delivered, who is in a position to say so, and how to record it without inventing a receipting process nobody needs.
The missing document is confirmation of delivery
For goods it is the receipt. For services it is the person who commissioned the work confirming they got it. That confirmation is the control, and the only real question is whether it is recorded or assumed.
Who can honestly confirm it
The person who asked for the work and would notice if it had not happened. Not finance, who cannot know, and not the supplier. That is also the person best placed to notice a service quietly degrading while the invoice stays the same.
Recording it without a receipting process
In most small teams the approval IS the confirmation, provided the approver understands that is what they are asserting. Making that explicit costs nothing and turns a signature into evidence, which is what an auditor is looking for.
Questions people ask about two way match accounts payable
Is approval enough on its own?
For services with a clear scope and a named approver, usually. For large or long-running engagements a milestone or deliverable record is stronger, because approval a year into a retainer is a habit rather than a check.
What about recurring subscriptions?
They are the easiest to overpay for, because nobody re-confirms a service they stopped using. A periodic review of recurring spend catches more money than tightening matching on one-off invoices.
Does this weaken our controls?
Only if it is undeclared. A two way match with recorded delivery confirmation, applied consistently to services, is a coherent control. An unwritten mixture is the weakness.