New 2026 AP Survey: 77% of Teams Still Hand-Key Invoices

A new 2026 survey from the Institute of Financial Operations & Leadership (IFOL), sponsored by SAP Concur, found that 77% of organizations still manually enter invoices into their accounting systems, and only 7% describe their AP function as fully automated. The gap between "we have some automation" and "we don't touch invoices" is exactly where overbilling and fraud slip through.

How Many AP Teams Still Enter Invoices by Hand in 2026?

Three out of four. The IFOL 2026 Accounts Payable Automation Trends report puts hand-keying at 77%, up from 66% a year earlier, even as AP budgets for automation and AI keep growing. Only 7% of organizations call their AP function fully automated. If your team is still retyping vendor, amount, and invoice number into your accounting system by hand, you are the majority, not the exception.

That doesn't mean nothing has changed. Among organizations already using AI in AP, the same report found the three most common applications are invoice data capture and entry (58%), invoice matching and approvals (49%), and duplicate or fraud detection (40%). Capture leads matching, and matching leads fraud detection. That order matters for what comes next.

Why Does Manual Entry Persist Even as Automation Budgets Grow?

Because most teams automated the easy, visible part first: getting an invoice off a PDF and into a bill. That's capture, and it's the 58% figure above. Capture tools read the invoice and populate fields. They don't check whether the amount is right, whether the vendor is who they say they are, or whether the work billed matches what was actually agreed.

A separate PYMNTS Intelligence survey published this fall found the same pattern one layer down in payments: 70% of payment-heavy firms plan to add or expand automated payment matching within 12 months, and 59% plan to add or expand AI-based fraud detection over the same period. Both are described as something teams plan to add, not something most already have. Fraud detection and full matching are still treated as a future upgrade rather than a standard, built-in feature of AP software, and that's the real story behind the 77% number: budgets are growing, but they're going toward entry speed first and verification depth second, if at all.

What Does "Expanding AI Fraud Detection" Actually Mean?

It depends which fraud signals the tool actually checks, and that's the detail a trade-press headline never spells out. At minimum, "fraud detection" worth the name should catch:

• A vendor's bank account changing between invoices, without a verified reason.
• A payee name that doesn't match the name on file or the contract.
• An invoice amount parked just under an approval threshold.
• An invoice citing a purchase order number that doesn't exist.

A tool that only flags duplicate invoice numbers is doing a narrower job than "fraud detection" implies. Why Only 18% of Firms Continuously Revalidate Vendor Bank Details looks at the specific gap in bank-detail checks, which is one of the most common ways a legitimate-looking invoice turns into a wire sent to the wrong account.

Is Automated Data Entry the Same as Automated Verification?

No, and conflating the two is the single most common way a finance team overstates how covered they are. Automated data entry answers one question: did the invoice get into the system correctly? Automated verification answers a harder one: should this invoice be paid at all?

A tool can be excellent at the first and silent on the second. It will read a padded subcontractor invoice perfectly, post it accurately, and never notice that the hours billed exceed what the statement of work allows. What Should an Invoice Matching Solution Actually Catch Before You Pay? walks through the checks a matching tool needs to run before "matched" means anything.

Where Do Rate-Card and SOW Checks Fit Into "Payment Matching"?

This is the part most AP automation still skips, and it's the specific gap Quittance is built to close. Classic matching checks an invoice against a purchase order, maybe a goods receipt. That's useful, but most services firms running on subcontractor and time-and-materials (T&M) work don't issue a PO for most of what they buy - they work off a master services agreement (MSA), a statement of work (SOW), and a rate card.

An invoice can match the PO on the dollar amount and still be wrong, because the PO was never the real contract. The rate card says a senior consultant bills at $185/hour; the invoice bills $225. The SOW caps the engagement at 160 hours this month; the invoice bills 190. Neither of those is a duplicate, and neither trips a standard 3-way match. How Does Three-Way Invoice Matching Work, and Where Does It Fall Short? covers exactly where the PO-only approach stops seeing the problem. Checking Contractor Hours Against the SOW Before You Pay goes through what checking hours against the actual SOW looks like in practice.

The matching ladder: what each level actually checks

Match type	What it checks	What it misses
2-way match	Invoice vs. purchase order	Whether goods or hours were actually delivered
3-way match	Invoice vs. PO vs. goods receipt / hours log	Whether the PO itself reflects the real contract terms
4-way match	Adds a quality or inspection step	Still stops at the PO, not the underlying agreement
Agreement-level matching	Invoice vs. the whole agreement - contract, SOW, rate card	Nothing an MSA or SOW defines, by design

What Is Invoice Matching Software? 2-Way, 3-Way, 4-Way Explained goes deeper on the first three rows if your team is deciding which tier it needs.

What Should an AP Manager Take From a Trade-Press Survey Like This?

Treat the headline number as a floor, not a scorecard. "77% still hand-key invoices" tells you where the industry sits on data entry. It tells you nothing about whether the 23% who've automated entry are also catching rate-card violations, scope creep, or a changed bank account. A team can clear the "we're automated" bar on LinkedIn and still pay a fake invoice, because entry speed and verification depth are different projects with different payoffs.

For a finance leader, the honest read is: automation that only speeds up entry reduces the busywork but not the risk. Automation that checks the whole agreement reduces both. If your invoice volume is high enough to justify a dedicated tool - automation's return on investment weakens below roughly 200 invoices a month, and under that, a sharper manual checklist or an experienced hire may genuinely be the better call - ask any vendor exactly which of the two jobs their "automation" or "AI fraud detection" is doing before you count your shop as covered.

The frame that holds up under those numbers isn't "this software replaces your AP person." A human still approves every payment; what agreement-level checks do is absorb the comparison work before you'd otherwise need to add headcount to keep up with invoice volume. New Data: Manual AP Teams Lose Money to Fraud Twice as Often has more on what gets missed when that comparison work stays manual.

A Short Checklist: Is Your AP Process Ahead of or Behind the 2026 Benchmark?

• Do invoices get entered into your accounting system without someone retyping them? If not, you're in the 77% majority - not a crisis, but a known starting point.
• Does your matching check a purchase order, or does it check the actual contract, SOW, and rate card behind that PO?
• Does your fraud check look for a changed bank account and a payee mismatch, or only duplicate invoice numbers?
• Can you produce, in minutes, the clause that justifies a flagged invoice - the rate, the hours cap, the scope line?
• Does anything you process post automatically to your books, or does a person approve every payment? APQC's Open Standards Benchmarking research puts the median organization's duplicate or erroneous payments at 1.5% of all disbursements - a number manual review alone consistently misses, which is one reason "a person checks it" and "nothing gets overpaid" are not the same claim.

Frequently Asked Questions

What's the difference between 3-way matching and agreement-level matching? A 3-way match compares an invoice to a purchase order and a goods receipt or hours log. Agreement-level matching compares the invoice to the underlying contract, SOW, and rate card directly, which catches rate-card violations and scope overruns that a PO-only match never sees because the PO doesn't carry those terms.

Does "expanding AI fraud detection" mean a tool checks for fake invoices? It depends on the tool. At minimum, real fraud detection should check for a changed vendor bank account, a payee name mismatch, an amount parked just under an approval threshold, and an invoice citing a purchase order that doesn't exist. A tool that only flags duplicate invoice numbers is doing a narrower job than the phrase implies.

How many invoices a month does it take before AP automation pays off? Automation's return on investment weakens below roughly 200 invoices a month. Below that volume, a tighter manual checklist, better vendor-master controls, or an experienced hire can be the more cost-effective answer; above it, the hours lost to manual checking and the overbilling that slips through both start to add up.

Can an AP team be "automated" and still get overbilled? Yes. Automating invoice data entry speeds up getting invoices into the books; it does not, by itself, check whether the billed amount matches the contract. A team can have high automation on capture and still miss a rate-card violation or padded hours, because that check requires comparing the invoice to the agreement, not just reading the invoice accurately.

Why don't most AP tools check the SOW or rate card? Most AP automation was built around the purchase order as the source of truth, which works for goods procurement but not for contract-governed services work, where most invoices never have a PO at all. Checking a rate card or SOW requires reading and structuring agreement terms, not just OCR-ing an invoice, which is a different and newer capability than classic PO matching.

If you want to see where your own process sits against checks like these, Quittance's blog covers the specific gaps between PO matching and agreement-level verification in more detail.