An invoice lands in your inbox for $14,200 from a vendor you half-recognize. There is no purchase order attached. Nobody told you this was coming. Somebody in operations approved the work weeks ago over email, the job is done, and now the bill is yours to deal with. If you are a Controller or AP Manager at a company with 100 to 1,000 employees, this is not a rare event. It is a Tuesday.

Most guidance on this treats a no-PO invoice as a routing question: where does the paperwork go next. That misses the real problem. A surprise invoice is a spend decision handed to finance after the commitment was already made, with no budget check and no approval behind it.

This playbook gives you what the other guides skip: a decision tree for the invoice on your desk right now, the exact words to tell a vendor who is chasing payment, a scorecard to grade your own non-PO rate, and a starter list of what is allowed to skip a PO. Then it shows you how to stop the next one from arriving.

ProcureDesk is a procurement and AP automation platform built for mid-market finance teams, and it exists to move that decision upstream, before the vendor is ever contacted.

What is a non-PO invoice (and why it lands on your desk)

A non-PO invoice arrives with no purchase order behind it, so there is nothing to match it against. The usual sources are utilities, rent, subscriptions, one-off services, and urgent buys someone made directly without raising a request first. Some of these are fine. Some are a control gap wearing a disguise.

The reason it becomes your problem is timing. With a PO, the spend is reviewed and approved before the vendor does the work. With a non-PO invoice, the work is done, the vendor expects payment, and finance is the last stop instead of the first. You are being asked to bless a purchase you never saw.

PO vs non-PO invoice: what is the difference?

A PO invoice references a purchase order that was approved before the order was placed, so it can be matched three ways against the PO and the goods receipt. A non-PO invoice has no approval behind it, so it needs manual verification and sign-off before payment. The difference is not the paperwork. It is whether the spend was approved before it happened or after.

What is an example of a non-PO invoice?

A marketing manager hires a freelance designer over email, the work gets done, and a $3,000 invoice lands in accounts payable with no PO attached. AP never saw a request, there is no budget check on file, and the amount has to be verified and approved after the fact. That is a textbook non-PO invoice.

Is it okay to pay a non-PO invoice?

Yes, if company policy allows it for that category and you verify and approve it first. Paying one with no verification is unauthorized spend, and it is how companies pay for work never delivered or pay twice. Confirm receipt, check the amount, then get the budget owner to sign off.

Who approves a non-PO invoice?

The person who owns the vendor relationship or the budget the spend hits, not accounts payable. AP verifies the invoice; the budget owner authorizes the spend after the fact. Apply your dollar thresholds on top so larger amounts get a higher approver.

What is a cover PO, and should you create one?

A cover PO is a purchase order raised after the fact so a non-PO invoice has something to match against. It is a reasonable cleanup step for a legitimate one-off, but it is not a substitute for approval before the spend. If you are creating cover POs often, the real fix is upstream.

The playbook: what to do the minute a no-PO invoice arrives

Work these steps in order. Do not skip the early ones because the vendor is chasing payment. Speed is how duplicate and fraudulent invoices get paid.

1. Hold it. Do not pay on arrival. Put it in a defined “needs review” state, not the payment run. Nothing about a missing PO should move faster than a matched invoice.
2. Verify it is real. Confirm the goods or services were actually received. Check the amount, the vendor bank details, and whether this invoice number was already paid. This is your fraud and duplicate-payment check, and it matters most exactly when there is no PO to lean on.
3. Find the owner and get retroactive approval. Route the invoice to the person who owns that vendor relationship or budget. They confirm they authorized the spend and it fits their budget. No owner, no approval.
4. Decide: allowed exception or process failure. If the vendor is on your approved no-PO list (rent, utilities, taxes), code it and move on. If it is not, it is a purchase that skipped the process. Flag it to fix upstream, do not just pay and forget.
5. Log the exception and code it. Record why this invoice had no PO, who approved it, and against which budget. That log is your audit trail and your data for step one of prevention: knowing how often this happens.

The first two steps protect the company from paying for something it never got or paying twice. The last three decide whether this was a reasonable exception or a leak you need to close.

What to say to a vendor chasing payment

You do not have to choose between paying blind and stonewalling a vendor who wants their money. Hold the payment and use language like this:

That protects the payment, keeps the relationship intact, and trains the vendor to bring you a PO next time. Most guides tell you to “route it for approval.” Almost none give you the words to hold the line without burning the vendor.

Where a purchase order actually belongs in the flow

The whole point of a purchase order is that the approval happens before the spend, not after. When the PO comes first, the invoice has something to match against and finance never gets surprised. When it does not, every step above is you doing that approval work in reverse, under time pressure, after the money is already owed.

How common is this? Measure your non-PO rate

Here is a benchmark to check yourself against. In ProcureDesk customer conversations, a common pattern is that roughly a quarter of invoices in a mid-market AP process arrive with no PO and get approved over email. As one finance leader described their own process:

Treat 25% as a common range, not a universal number. Some teams run at 10%, some at 40%. The point is to measure yours. Your non-PO rate is the inverse of your PO coverage rate, the share of spend that goes through an approved PO before money is committed. If you cannot state your number, that is the first thing to fix.

Score yourself: the non-PO rate scorecard

Count your non-PO invoices for one month, divide by total invoices, and find your zone.

What non-PO invoices actually cost

The invoice being legitimate does not make it free. Every no-PO invoice carries a tax:

• No budget tie-back before the spend. The money is committed before anyone checks it against a budget. You find out what you spent by paying for it.
• Heavy manual follow-up. Someone chases the owner, confirms receipt, and reconstructs the approval by email. That is finance labor spent on cleanup, not close.
• A weak audit trail. An email “yes” is not an approval workflow. At audit time, “the department head approved it in a thread somewhere” is not an answer you want to give.
• Duplicate and fraud exposure. No PO means no automatic check that you are paying a real, unique, unpaid invoice. That is the gap 3-way matching is built to close.

The line between an allowed exception and a leak

Not every non-PO invoice is a failure. The trick is deciding in advance which ones are allowed, so your team is not making that call invoice by invoice.

Keep a short, approved list of vendor categories that are allowed to bill without a PO. Rent, utilities, and taxes are the usual ones. These are predictable, recurring, and hard to route through a normal requisition. Everything else is treated as a process gap to fix, not a permanent exception. Pair that list with clear invoice approval thresholds so a non-PO invoice still gets sign-off scaled to its dollar amount.

Here is a starter list you can adapt. The rule: if it is not on the list, it gets a PO.

Add one rule on top of the list: every non-PO invoice must carry a short business justification and a named approver. That single field is what turns an allowed exception into an audit trail instead of a blind spot.

Most tools in this space, Tipalti and Bill.com included, will route a non-PO invoice for approval after it lands. That helps you process the exception. It does not stop the exception from arriving. The fix for that is upstream, at the point of request.

How to stop getting surprise invoices

Handling the invoice on your desk is triage. The real win is a smaller pile next month. Three moves do most of the work.

1. Make the compliant path the fast path. Give people a quick way to raise a request for urgent or recurring buys, so “doing it right” is not slower than emailing a vendor directly. A light PO workflow beats a strict one nobody uses.
2. Route routine buying through catalogs. Off-catalog purchasing with no PO is the top source of surprise invoices. Moving routine spend to punchout catalogs attaches a PO from the first click.
3. Enforce no-PO-no-pay for everything off the approved list. Once the fast path exists, hold non-PO invoices that are not on your allowed list. This is the systemic version of the playbook above, covered in depth in eliminating surprise invoices. Multi-entity teams should also see how this works across branches and locations.

How does ProcureDesk stop the surprise invoice?

ProcureDesk is built for mid-market finance teams at companies with 100 to 1,000 employees, and it sits before the invoice, not after it. If you are an enterprise team on Coupa or SAP, this is lighter than you need. If you are a 20-person startup, it is more control than you need yet.

Every purchase starts as a request that becomes an approved PO, so there is always a record for the invoice to match against. When the invoice arrives, automated 3-way matching checks it against the PO and the goods receipt, and anything without a match is held instead of paid.

Two pieces matter for cutting surprise invoices specifically. ProcureDesk supports 200-plus punchout catalogs, including Amazon Business, Grainger, Thermo Fisher, and McMaster-Carr, so routine buying carries a PO from the start instead of landing later as a non-PO invoice. And approval routing with dollar thresholds means the right person signs off before the vendor is contacted, not weeks after.

ProcureDesk deploys alongside QuickBooks, Sage Intacct, NetSuite, Microsoft Business Central, and Xero. It does not replace your accounting system. Coast Flight, an aviation customer, cut invoice processing time by 30% after moving off manual invoice handling. Implementation is done for you, and most mid-market teams go live in two to four weeks. Customers routinely reduce invoices arriving without a PO by 90% or more.

Can you pay an invoice that has no purchase order?

Yes, but only after you verify it and get it approved. Confirm the goods or services were received, check the amount and vendor details, and route it to the budget owner for retroactive sign-off. Paying a non-PO invoice on arrival, with no verification, is how companies pay for work never delivered, or pay the same invoice twice.

Should every purchase have a purchase order?

Not literally every one. Predictable, recurring bills like rent, utilities, and taxes are reasonable no-PO exceptions if you list them in advance. The goal is not a PO for the coffee fund. It is that any real purchase decision gets reviewed against a budget before the money is committed, so finance is not finding out what was spent by paying the bill.

Getting started

If you are a finance team of one to three people carrying a growing invoice volume, you cannot enforce this by memory. Start by measuring your non-PO rate for one month. Build a short approved list of vendors allowed to bill without a PO. Then give people a fast way to raise a request so the compliant path is the quick one, and hold everything off the list. That sequence turns surprise invoices from a recurring fire drill into a rare, logged exception.

Track four numbers each month so you know the controls are working: the count of non-PO invoices, their total value, their share of all invoices, and the average time to approve them. When those numbers fall, your process is holding. When they climb, a vendor or a department has found a way around the PO, and you know where to look.

If a meaningful share of your invoices still arrives with no PO and gets approved over email, the controls in this playbook are worth 20 minutes of your time.