How to Measure AP Leakage at a Services Firm

Accounts payable leakage is money a company pays out that it never owed: duplicate invoices, overbilled rates, work billed above the contract ceiling, and payments to unverified or fraudulent accounts. You can measure it before hiring an outside audit by sampling recent paid invoices, checking each line against the agreement behind it, and expressing what you find as a percentage of total disbursements. The baseline is high enough to matter: APQC benchmarking data shows even top-performing finance teams pay about 0.8% of disbursements in duplicate or erroneous payments, and the median organization sits near 1.5%.

For a services firm running $8M through accounts payable a year, 1.5% is $120,000 leaving the building for nothing. Most of it is recoverable, and much of it is preventable. This is a guide to putting a real number on your own leakage, using invoices you have already paid, before you commit to a recovery audit or a new tool.

What is accounts payable leakage, in plain terms?

Accounts payable leakage is the gap between what you should have paid and what you actually paid. It is not the same as fraud, though fraud is part of it. Leakage covers four things a services firm sees constantly:

• Duplicate payments. The same invoice paid twice, often because it arrived once by email and once as a PDF re-send, or because a contractor re-billed a line that was already settled.
• Rate-card violations. A subcontractor bills a senior rate for junior work, or applies this year's rate to last year's signed rate card.
• Scope and ceiling breaches. Time-and-materials (T&M) hours that push past the not-to-exceed figure in the statement of work (SOW), or line items for work outside the agreed scope.
• Fraud and payment diversion. A changed bank account, a payee that does not match the contracting entity, an amount parked just under an approval threshold, or an invoice citing a purchase order (PO) that does not exist.

Leakage is quiet by design. Each item looks plausible on its own. The invoice total often matches the PO, so a PO-only check waves it through. The money leaks at the line level, and at the line level almost nobody is reading.

Where does leakage usually start at a services firm?

At a services firm, leakage starts where the buying does not use purchase orders. Agencies, IT services providers, and consultancies pay subcontractors on master service agreements (MSAs), SOWs, rate cards, and T&M terms. There is no clean PO to match against for most of the spend, so the control that manufacturing relies on simply is not there.

Three patterns account for most of it:

1. T&M padding. Hours are the unit of billing and the hardest thing to verify after the fact. An extra half-day per person per week is invisible in any single invoice and material across a quarter.
2. Rate drift. A contractor's rates are agreed once, in a document nobody reopens at invoice time. When a rate quietly rises or the wrong tier is applied, the only place to catch it is the rate card itself.
3. Duplicate and near-duplicate bills. The same work re-billed under a slightly different invoice number or reference. APQC's data on duplicate and erroneous disbursements is the reason this belongs on every leakage estimate: it is common enough that assuming zero is the wrong starting point.

Fraud sits underneath all three. The ACFE's 2024 Report to the Nations estimates a typical organization loses 5% of revenue to occupational fraud each year, with asset misappropriation, which includes billing schemes, present in 86% of cases at a median loss of $120,000. Smaller organizations are not exempt: the same report found companies with fewer than 100 employees had a median fraud loss of $141,000, higher than most mid-size bands, because they run leaner controls.

How do you estimate AP leakage without hiring an outside audit?

You can produce a defensible internal estimate in a day or two with a sample of invoices you have already paid. The method is a scaled-down version of what recovery-audit firms do, run on your own data.

Step 1 - Pull the sample. Take 100 to 200 paid subcontractor and T&M invoices from the last one or two quarters. Random is better than convenient; do not just pick the big ones.

Step 2 - Match each line to its agreement, not its PO. For every line, find the governing document: the rate card for the rate, the SOW for scope and the ceiling, the MSA for terms. Ask four questions per invoice:

• Was this exact invoice (or its line items) paid before?
• Does every rate match the signed rate card and tier?
• Do cumulative charges stay under the SOW ceiling?
• Is the payee and its bank detail the one on the contract?

Step 3 - Tag and total the exceptions. Record the dollar value of every discrepancy and the category. Sum the errors, then divide by the total value of the sample. That percentage is your sampled leakage rate.

Step 4 - Scale it, carefully. Apply the sampled rate to your total annual AP disbursements for a first-order estimate. State it as a range, not a point. If your sample shows 1.2% and the APQC benchmark range runs 0.8% to roughly 1.5% for duplicates and errors alone, before rate and scope issues, you have a credible, sourced band to bring to the CFO.

The result is not audit-grade, and it should not claim to be. It is enough to answer the only question that matters at this stage: is leakage big enough to act on? For most services firms, the honest answer is yes.

What's the difference between catching leakage and recovering it later?

Recovery is finding the money after it has gone. Recovery-audit firms such as PRGX and apexanalytix comb through historical payments, identify overpayments, and claw them back, usually for a share of what they recover. It works, and for a large back-catalogue it is worth doing once.

But recovery has three costs the estimate above makes visible. You have already lost the use of the cash for months. Some of it is never returned, because the counterparty is gone or disputes it. And the same errors keep happening, because a backward-looking audit changes nothing about tomorrow's invoice.

Catching leakage means checking the invoice against the whole agreement before it is paid, so the duplicate, the wrong rate, or the ceiling breach is flagged while the money is still yours. The difference is timing, and timing is most of the value. A flag that names the exact clause it violates also gives your team the dispute already half-written, instead of a nine-day email chain three months after the fact.

This is the shift worth planning for: from measuring leakage once, to gating it every time. Agreement-aware accounts payable automation applies that check at the line level on every invoice, matching against the contract, SOW, and rate card rather than the PO alone, and holding anything it cannot verify.

What should a CFO ask to see before trusting the number?

A leakage figure is only as good as the work behind it. Before you act on an internal estimate or a vendor's demo, a CFO should ask five things:

1. What was the sample, and was it random? A cherry-picked sample of clean invoices understates leakage; a sample of only disputes overstates it.
2. What did each flag check against? "Matched the PO" is not enough for T&M and SOW spend. The check has to reach the rate card and the ceiling.
3. Can every flag cite its reason? A number you cannot explain line by line will not survive an audit or a supplier's pushback. Each exception should point to the specific clause or prior invoice behind it.
4. Is there a complete, exportable audit trail? You need to reproduce the estimate and show the working, not just the total.
5. What happens to an invoice the system cannot verify? The right answer is that it is held for a person, not auto-paid. A control that pays what it cannot verify is not a control.

Those five questions separate a credible leakage program from a spreadsheet guess. They also happen to be the design test for any tool you let near your accounts payable.

FAQ: measuring and stopping AP leakage

What is a normal AP leakage rate? There is no single "normal," but published benchmarks give a floor. APQC data shows top-performing finance teams still pay about 0.8% of disbursements as duplicate or erroneous payments, with the median near 1.5%, before rate-card and scope leakage are counted. Treat anything at or below 0.8% as strong, not as zero.

How is leakage different from fraud? Fraud is deliberate; leakage includes both deliberate and accidental overpayment. Most leakage at a services firm is error, not crime, but the ACFE reports that occupational fraud costs a typical organization around 5% of revenue a year, so a real estimate has to account for both.

Can I measure leakage without buying software? Yes. Sample 100 to 200 paid invoices, check each line against its agreement, total the exceptions, and divide by the sample value. It is manual and it will take a day or two, but it produces a defensible range.

Why isn't matching the purchase order enough? Because most services spend has no PO, and even when it does, the PO carries a total, not the rate card, the tier, or the SOW ceiling. An invoice can match the PO total exactly and still overbill the rate. The cost of processing each invoice is low, but the cost of not reading it against the agreement is the leakage itself.

Should we run a recovery audit or prevent leakage going forward? Both, in order. Run one recovery pass on the back-catalogue to reclaim what you can, then move the check to before payment so the same errors stop recurring.

Putting a number on your own leakage

Measuring accounts payable leakage is not a research project. Pull a sample, check each line against the agreement behind it, and you will have a sourced range within a couple of days. The harder step is moving from measuring it once to catching it every time, before the money leaves.

If you want to see what agreement-level checking flags on your real invoices, run a low-risk pilot on a sample of your own spend. It is the fastest way to turn an estimate into a list of specific invoices, each with the clause behind the flag. For more on catching overbilling and fraud before payment, see the Quittance blog.