Invoice risk score: which signals matter and how to use them

A controller with 300 invoices per month cannot look at all 300 at the same level. The operational question is not “is this invoice correct?”. It is “where do I look first?”.

A risk indication answers that. It turns scattered signals into something you can sort by. This article explains which signals are worth considering, how to read them and what to ask of any tool that shows them.

What an invoice risk score is

A risk score is an aggregator. It takes objective signals about the invoice, applies a logic and returns a value on a fixed scale: a number, or simply a level such as low, medium or high.

• Low: no relevant signals. The invoice can be approved by a person without a detailed review.
• Medium: one or more signals worth checking before approval.
• High: several signals, or one very strong one. Not approved without an explicit justification.

The score does not decide payment. It sorts. When 50 invoices come in on Monday, the high-risk ones are looked at first.

In ininvoice, what exists today is a low, medium or high risk level per case, derived from the matching verdict, with the reason shown on the case. It is not a 0-100 score, and a person always approves the invoice.

Signals worth considering

These are the signals AP teams usually look at, ordered here by their typical financial impact:

1. Potential duplicate. Another invoice from the same supplier with the same number, or the same amount and date. The most expensive signal: a duplicate paid twice is a direct loss.
2. Price or quantity variance out of tolerance. Line-by-line cross-check against the PO. Details in price variance calculation.
3. New supplier. First invoice from a tax ID you have not dealt with before.
4. Amount outside the usual range. An invoice far from what this supplier usually invoices.
5. No linked PO. Nothing to cross-check against: three-way matching is not possible.
6. Inconsistent date. Invoice dated before the PO, or dates that do not fit the delivery.
7. Changed payment details. IBAN, tax ID or address different from the last invoice. The classic impersonation fraud signal.

How signals combine

• Signals with direct financial impact (duplicate, changed payment details) deserve more weight than context ones (new supplier, no PO).
• Two signals pointing to the same risk do not double it.
• Mental rule: one strong signal alone raises the risk, several weak ones together also do.

Three example invoices: low, medium and high

Invoice A — low risk

Signal	State
Supplier	Recurring, 14 prior invoices
Linked PO	Yes, formal PO
Price/quantity variance	Zero on all lines
Amount (EUR 1,245)	Within the usual range
Duplicate	No
Payment data	IBAN matches the last invoice

Low risk. It is ready for a person to approve; the controller doesn’t need to look at it in detail.

Invoice B — medium risk

Signal	State
Supplier	Recurring
Linked PO	Yes
Price variance	+4.2% on one line (out of tolerance)
Amount (EUR 3,850)	Within the usual range
Duplicate	No
Payment data	IBAN matches

Medium risk. One actionable signal. The invoice is held with the signal visible for the responsible buyer to decide, and it is not approved until there is a justification or a supplier correction.

Invoice C — high risk

Signal	State
Supplier	New, first invoice
Linked PO	No
Price/quantity variance	Not applicable (no PO)
Amount (EUR 12,400)	No history to compare
Duplicate	No
Payment data	Foreign IBAN, newly registered e-mail domain

High risk. Three strong signals: new supplier, no PO, atypical payment data. The invoice goes to the top of the queue, and the controller calls the supplier through a verified channel, not via the received e-mail. It is the pattern described in supplier invoice fraud.

Risk as a human queue prioritiser

A risk indication does not replace human judgement. It assigns attention. Without it, the queue is reviewed in order of arrival; with it, by risk.

• Low: reviewed quickly and approved by a person.
• Medium: where most review time goes, because most real exceptions live here.
• High: usually a small share of volume, but where most of the financial risk sits.

Risk and fraud detection

Several of these signals are classic fraud signals: changed payment details, a recent e-mail domain, a new supplier with a high amount. The combination is the typical pattern of BEC (business email compromise).

A risk score is not a fraud detector on its own, but it systematically raises invoices with a suspicious profile. Patterns and countermeasures in how to detect invoice fraud.

What makes a risk score auditor-defensible

• Declared rule. The signals and their logic are documented, so an auditor can follow how the result was reached.
• Traceability. Each invoice keeps the reason for its risk level and the human decision, with user and date.
• Human decision. The score suggests; a person decides, and departing from the suggestion should be justified.

That triad — declared rule, traceability, human decision — sets a defensible score apart from a black box the auditor rejects. It fits frameworks such as COSO and GDPR art. 22, as long as there is meaningful human intervention.

How to reduce the share of risky invoices

• Formalise POs for recurring suppliers. Without a PO there is nothing to cross-check against.
• Validate suppliers before the first invoice. Tax ID, IBAN and tax data verified.
• Clean line descriptions. Better invoice/PO match means fewer false variances.
• Confirm IBAN changes through a verified channel. A call to a phone number you already have, not an e-mail.

End-to-end flow at touchless AP processing, document cross-check at a three-way match on every line, reconciliation at matching delivery notes to invoices.

FAQ

Does the score replace the human approver?

No. It suggests priority and the level of review. Approval is always made by a person, with a traceable justification when departing from the suggestion.

Number or level?

Either can work, as long as each level has a clear meaning and the reason is visible. In ininvoice each case has a low, medium or high risk level derived from the matching verdict, with its reason.

What if we have little invoice history?

The signals that do not depend on history (variance, no PO, dates, payment data) work from the first invoice. Those that do (usual amount range, new supplier) need some history.

Is it GDPR-compliant if it affects payments?

A score used as decision support, with the final decision made by a person, is not a solely automated decision in the sense of GDPR art. 22.

Can I see why an invoice has a given risk?

You should be able to. In ininvoice the case shows the reason for its risk level. Without the reason, the score is not defensible.

How do I know there is no bias against certain suppliers?

Use objective signals (amounts, dates, IBAN, presence of a PO) and no proxy identity variables, and review periodically how risk levels are distributed by supplier.

Three things to remember

1. A risk score is a prioritiser, not a decider. It sorts the queue; a person still approves.
2. It combines objective signals ranked by financial impact. Duplicates and changed payment details weigh most.
3. It is auditor-defensible when the rule is declared, the reason is visible and a person decides. Not a black box.

If you want to see it on your queue, see it working on your data. Pricing is tailored: a proposal in 48 hours, once we have seen your invoices.

Related content

• Touchless AP benchmarks by sector
• Three-way matching: tolerances and exceptions
• Delivery note vs invoice: the cross-check
• Price variance invoice vs PO
• Supplier invoice fraud
• How to detect duplicate invoices