A large share of company purchasing never passes through procurement. The Hackett Group puts off-contract indirect spend at 29%, and finance usually sees those purchases for the first time when the invoice lands. By then the price was not the negotiated rate, no one approved the order, and the close runs one exception longer.
This is written for Controllers and CFOs at companies with 100 to 1,000 employees, where one or two people handle AP and there is no room for surprise invoices. If that is your team, off-catalog buying is the quiet source of most of your month-end cleanup, and punchout procurement is one of the cleaner ways to close it.
Most articles on punchout explain how the technology works. This one treats punchout as a control for off-catalog spend, and it uses current data to show what that spend costs and why the usual fixes fail. ProcureDesk, a procurement and AP automation platform for mid-market finance teams, treats punchout as exactly that control.
Table of Contents
Key takeaways
- Off-contract buying runs at 29% of indirect spend, and most of it reaches finance only as a surprise invoice.
- Maverick spend costs 5% to 16% of negotiated savings every year, per Suplari.
- The fix the research agrees on is to make the compliant path the quickest path, enforced at the point of purchase.
- Punchout does that: buyers shop approved vendor catalogs inside your system, and every cart routes through approval before the PO.
- ProcureDesk ships with 200+ punchout catalogs and is built for the 100 to 1,000 employee range.
What off-catalog spending costs your team
Off-catalog buying, also called maverick or rogue spend, is any purchase made outside approved vendors, channels, or negotiated terms. It is more common than most finance leaders expect, and the cost is real.
The numbers, from current procurement research:
- 29% of indirect spend is off-contract (Hackett Group).
- A typical procurement team runs about 10% maverick spend; a world-class one holds it near 5% (Hackett Group).
- Maverick spend costs 5% to 16% of negotiated savings a year. On $500M of spend, that is $15M to $55M (Suplari).
For a Controller, the cost shows up as work, not just leakage. Suplari’s breakdown of where off-catalog spend comes from reads like a list of your exceptions:
- Unapproved suppliers, cited by 74% as a primary driver
- Buying from approved suppliers but bypassing the purchasing system, 68%
- Purchases in unapproved categories, 43%
- Off-contract pricing, 34%
Every one of those becomes a non-PO invoice that someone on your team has to research, match by hand, and code before it can be paid. You can size your own exposure with our ROI calculator.
Why employees buy off-catalog
The reason is rarely bad intent. People buy off-catalog because, in the moment, it is the fastest way to get what they need. The approved process loses to the convenience when:
- Filing a request and waiting for a vendor lookup takes longer than opening a website.
- The approved vendor is harder to reach than a personal account.
- No one is enforcing the policy at the moment of purchase.
This is why the research converges on one fix: make the compliant path the quickest one, through guided buying and enforcement at the point of purchase, not after it. You do not win on policy memos. You win by making the approved way the path of least resistance. That is what punchout does.
What is punchout procurement
Punchout procurement is a live connection between your purchasing system and a supplier’s website. Your team shops the vendor’s real catalog at your negotiated prices, then the cart returns to your system as a purchase request instead of checking out on the vendor’s site. The connection runs on a protocol called cXML, the standard most suppliers and purchasing systems use to pass cart data back and forth. ProcureDesk maintains these connections as part of its integrations and punchout catalog network.
How punchout turns buying into a control
A purchase can take one of two paths.
Without punchout, the first control point is the invoice, which is the worst place to find a problem. With punchout, the order starts inside your system and routes through approval and a budget check before the PO is issued. The five steps:
- A buyer opens an approved vendor from inside your purchasing system.
- The supplier site opens within your system, already showing your contract pricing.
- The buyer adds items to the cart the way they would on any site.
- At checkout, the cart returns to your system as a purchase request, not an order.
- The request routes through approval and budget rules. Once approved, the system issues the PO.
For the Controller, the win is direct:
- The non-PO invoice disappears, because every order arrives with a PO attached.
- 3-way matching has a PO, a receipt, and an invoice to match.
- Pricing is the negotiated rate, not whatever the buyer found.
See how the approval step works in our AP invoice approval process.
Before you switch punchout on, set your rules with the Purchasing Policy Template, so the system enforces a policy you have already agreed on.
The three ways to buy from vendors
There are three ways a team buys, and they are not equal on control.
- Manual ordering: staff buy on vendor sites or by phone, then submit receipts. No price enforcement, no approval before the spend.
- Hosted catalog: you upload a vendor’s item list and maintain it yourself. Fine for small, stable catalogs. Hard to keep current.
- Punchout: the vendor hosts and updates the catalog while you shop it live inside your system. Best for large, fast-changing catalogs like Grainger or Amazon Business.
Punchout vs corporate cards for spend control
Card-first tools like Ramp and Brex are pitched as spend control, but they control the card after it is swiped. That is a different moment than punchout, which controls the purchase before the commitment is made. A corporate card:
- Does not carry your negotiated catalog pricing.
- Does not route a request for approval before the buy.
- Does not support 3-way matching against a PO and a receipt.
For software and travel, a card is fine. For physical goods bought from established vendors, a card alone leaves you reconciling after the money is gone, which is the exact problem off-catalog buying creates.
How ProcureDesk handles punchout
ProcureDesk is a procurement and AP automation platform built for mid-market finance teams at companies with 100 to 1,000 employees. It ships with 200+ punchout catalog integrations, so your team shops familiar vendor sites and every cart comes back as an approval-routed purchase request. Implementation runs in 2 to 4 weeks, set up for you, so the control is in place the first week your team starts buying.
It fits a specific size:
- Built for 100 to 1,000 employees, where one to three people handle AP and procurement.
- Enterprise suites are heavier than that team needs.
- Basic SMB purchase-order tools are too light to enforce rules at the point of purchase.
In our onboarding work with 200+ mid-market companies, the single biggest source of surprise invoices is off-catalog buying with no PO behind it. Punchout removes that at the source, because the order cannot reach AP without first passing approval and a budget check.
Catalogs include Amazon Business, Grainger, Staples, CDW, McMaster-Carr, Thermo Fisher Scientific, and VWR, which is why biotech and manufacturing customers route lab and shop-floor orders through punchout while finance keeps every purchase inside the rules.
See the 200+ punchout integrations and the approval flow in a short walkthrough.
Request a demo and watch it run on your own categories.
Read a summarized version with:
Frequently asked questions
What is punchout procurement?
Punchout procurement is a live link between your purchasing system and a supplier’s website. Buyers shop the vendor’s catalog at negotiated prices, and the cart returns as a purchase request for approval instead of being ordered directly. The order then routes through your budget and approval rules before any PO reaches the vendor.
How does punchout reduce off-catalog (maverick) spend?
It makes the compliant path the quickest one. Buyers get the familiar website experience inside a system that still enforces approval and budget rules, so there is little reason to buy around the process. Research on maverick spend points to this exact fix: enforce at the point of purchase rather than after the invoice arrives.
What is the difference between a punchout catalog and a hosted catalog?
With a hosted catalog, you upload a vendor’s item list into your system and maintain it yourself. That works for small, stable catalogs. Punchout has the vendor host and update the catalog while you shop it live, which fits large, fast-changing catalogs like Grainger or Amazon Business where prices and stock move constantly.
What is the difference between Level 1 and Level 2 punchout?
Level 1 sends the buyer to the supplier’s full storefront to search and shop. Level 2 lets the buyer search specific product categories from inside the purchasing system before punching out to the vendor site. Level 2 takes more setup from the supplier but is faster for buyers who already know what they need.
Does punchout work with QuickBooks and NetSuite?
Punchout sits in your purchasing system, which then syncs the approved PO and invoice to your accounting software. ProcureDesk connects to QuickBooks, Sage Intacct, NetSuite, Microsoft Business Central, and Xero, so a punchout order flows through approval and lands in your books without anyone re-keying it.
What is cXML in punchout?
cXML, or Commerce eXtensible Markup Language, is the standard format suppliers and purchasing systems use to exchange punchout data. It carries the punchout setup request, the buyer’s authentication, and the cart contents back to your system. A few suppliers use OCI instead, but cXML is the common standard across most B2B vendors.
Is punchout only for large enterprises?
No. Punchout is widely used by mid-market finance teams at companies with 100 to 1,000 employees, especially those buying physical goods from established vendors. The value is the same at this size: orders start at negotiated prices and route through approval before any commitment is made.
Conclusion
Off-catalog spending is a design problem more than a discipline problem. As long as buying around procurement is faster than buying through it, people will. Punchout flips that by putting the contract-priced catalog inside the system that already enforces approval, so the quick way and the controlled way become the same action.
For a Controller or CFO at a company with 100 to 1,000 employees, that is one of the cleaner ways to stop surprise invoices before they start.
