Ask a finance team why their purchase-price tolerance is set where it is. In most organisations the honest answer is that somebody picked it, years ago, to stop a queue from building up.
That is not a scandal. It is just an untested control and untested controls tend to fail in one of two directions.
Set it too tight and the control stops working
This is the counter-intuitive one. A 0.5% tolerance sounds rigorous. What it produces is forty held invoices a week, a reviewer who clears them in batches to get through the queue and a rubber stamp where a control used to be.
A control that is always triggered carries no information. If everything is an exception, nothing is. You have not tightened anything — you have moved the real decision from a documented rule to an undocumented habit and made it invisible to your auditor in the process.
Set it too loose and you are buying errors
The other direction is easier to see and harder to defend. At 5% on a supplier you spend AED 4 million a year with, you have authorised AED 200,000 of price movement to pass without anyone looking. Not fraud — mostly just uncorrected price rises, missed rebates and the supplier quietly repricing after a contract lapsed.
That number is usually a surprise when you calculate it. It is worth calculating.
How to set it deliberately
The tolerance should not be one number. It should fall out of three things you can actually measure.
1. What variance does this supplier genuinely produce? Pull the last two hundred invoices and plot the difference against the PO. You will usually see a tight cluster from rounding and unit conversion and a scatter of real errors well outside it. The cluster tells you the noise floor. Set the tolerance at the edge of the cluster, not at a round number that felt sensible.
2. What does a review cost and what does a miss cost? If a held invoice takes four minutes to clear and the average error is AED 900, you can afford to hold a lot of invoices. If it takes forty minutes and the average error is AED 30, you cannot. The tolerance is an economic decision and should be defended as one.
3. Is the variance one-directional? Suppliers over-billing by 1.5% and under-billing by 1.5% are not the same risk. A symmetric tolerance on an asymmetric pattern is a gift to whoever noticed first.
The answer is usually per-supplier, not per-company
Most tolerances are set once, company-wide, because that is what was feasible when a person had to apply them. That constraint is gone. A rule engine can hold a different tolerance for the steel supplier who prices in tonnes than for the stationery supplier whose prices have not moved in three years and it applies both without fatigue.
Once tolerance becomes per-supplier, the queue shrinks and the exceptions that remain are real. Which is the only state in which anyone reviews them properly.
One thing to check this week
Take last quarter’s held invoices and sort by outcome. What proportion were released unchanged? If it is above about 80%, your tolerance is not protecting you — it is generating work and training your team to approve without looking. That is worse than no control, because it is a control you believe in.