5 Contract Clauses Every CFO Should Read Before Approving a Supplier Invoice

That is not a criticism. It is how approval works in most organizations. The invoice arrives, someone checks that the quantities look right, that the arithmetic holds, that the purchase order exists, and that the budget owner is willing to sign. The invoice is then paid. At no point does anyone open the agreement that defines what the supplier was allowed to charge in the first place.

The contract lives somewhere else. It was negotiated by a different team, signed years ago, amended by email, and filed in a folder the approver has no reason to visit. The invoice, meanwhile, is checked against itself.

This gap is where overpayments live. Not in dramatic fraud, but in small, legitimate-looking line items that no longer match what was agreed. The good news is that you do not need to read every contract cover to cover to close it. Five clauses do most of the work.

1. The rate schedule

Somewhere in every services agreement there is a page that says what things cost: hourly or daily rates by role, unit prices, volume tiers, sometimes an indexation formula that allows prices to rise with inflation. It is usually an appendix, often called Schedule A or a rate card, and it is the single most important page for anyone approving invoices.

It is also the page most likely to be out of date. Rates change. A supplier proposes an increase, a manager agrees by email, the invoice reflects the new rate, and the signed schedule still shows the old one. Six months later nobody can say with confidence which number is the agreed one. This is one of the most common patterns behind supplier overbilling.

What to look for: the current rates, the mechanism by which they may change, and who on your side is authorized to accept a change. If the clause says rate changes require written agreement from both parties, an email from a project manager does not meet that standard, whatever the invoice says.

2. Term, expiry and renewal

Every agreement has an end date, and most statements of work have a shorter one. Work rarely stops on that date. Projects overrun, teams stay on, and invoices keep arriving with the same reference number as before.

The problem is not that the work continued. The problem is that nothing authorizes the spend. An expired statement of work is not a contract; it is a historical document. Any invoice issued against it is, strictly, an invoice for work nobody agreed to buy.

Renewal clauses deserve the same attention in the opposite direction. Automatic renewal is convenient until it renews a service you stopped using, or renews at a rate the clause allowed the supplier to adjust without asking.

What to look for: the end date of the master agreement and of each active statement of work, the notice period for termination, and whether renewal is automatic. Then put those dates next to the invoice date.

3. Scope and change control

The scope clause describes what you are buying. The change control clause describes how that can be altered. Together they determine whether a line item belongs on the invoice at all.

In practice, scope drifts. A supplier is asked to do something adjacent to the original work, does it, and bills for it. Everyone involved acted in good faith. But the invoice now contains a line that maps to no deliverable in any signed document, and the person approving it has no way to know, because the scope lives in the contract and the invoice does not reference it.

Change control clauses exist precisely for this. They typically require a written change order, signed by both parties, before new work is billable. When that process is skipped, the invoice is the first and only record of the agreement, which is the wrong way round.

4. Audit rights and record retention

This is the clause nobody reads until they need it, at which point it is too late.

An audit rights clause gives you the right to inspect the supplier's records that support an invoice: timesheets, subcontractor bills, expense receipts. A record retention clause says how long those records must be kept. Without both, you can suspect an overcharge but you cannot prove it, because the evidence is on the supplier's side and you have no entitlement to see it.

Two things go wrong here. The first is that the clause is missing or weak: a vague "reasonable access" provision with no timeframe and no obligation to cooperate. The second is quieter: the clause was fine in the original agreement, and an amendment later shortened the retention period or narrowed the scope. Few people read amendments for what they take away.

5. Caps, payment terms and expenses

The last clause is actually a family of commercial terms, and its defining feature is that each individual invoice can comply while the relationship as a whole does not.

A not-to-exceed cap is the clearest example. Each invoice is within the agreed rates and scope, yet the sum of invoices has passed the ceiling the contract set for the year. Nobody notices because nobody is adding them up against the contract; they are only comparing each invoice to its purchase order.

Payment terms carry their own leakage: early payment discounts never claimed, late fees applied where the contract allowed none, expense policies that exclude certain costs the invoice nevertheless includes.

Why these clauses go unread

It would be easy to conclude that someone is not doing their job. That is almost never the case.

The approver is checking what they can see. The contract is in another system, owned by another function, written in language that assumes a legal reader. There may be several of them: a master agreement, multiple statements of work, a chain of amendments, each changing one paragraph of the last. Reading them all against every invoice, every month, for every supplier, is not a reasonable expectation of any person.

So organizations sample. Once a year, someone pulls a handful of invoices and traces them properly. That is a sound control for what it covers. It simply covers very little, and it covers it long after the money has left. We looked at what that costs in why manual contract reviews are still costing companies millions.

Reading the contract and the invoice together

The alternative is not more people reading more documents. It is changing what gets compared to what.

Each of the five clauses above produces a small number of facts: a rate, a date, a scope, a right, a limit. Each invoice line produces a small number of facts: a rate, a date, a description, an amount. Putting those side by side, for every invoice rather than a sample, is a matching problem, and matching problems can be done consistently and at scale.

This is what Sada Forensic is built to do. It reads the master agreement, the statements of work, the amendments and the invoices together; identifies where an invoice line disagrees with a current term; and shows the reviewer the exact clause and the exact line, next to each other, so the finding can be checked in seconds and defended later. The reviewer still decides what to do. They simply start from the evidence rather than searching for it. Request a demo.

A short test for your next approvals meeting

You do not need a system to start. Take one supplier, pick the most recent invoice, and ask five questions:

1. 01Which document holds the current rates, and does this invoice use them?
2. 02Was the agreement in force on the invoice date?
3. 03Does every line map to a signed deliverable?
4. 04If we disputed this, could we see the records?
5. 05Where are we against the annual cap?

If your team can answer all five quickly, with documents to hand, your controls are in better shape than most. If any answer begins with "I'd have to check", that is where the next overpayment is already sitting. For a full framework, see how to conduct an assurance audit.