A supplier sends a price on WhatsApp. The site manager forwards it to the owner. The owner replies with a thumbs up. Three weeks later the goods turn up, an invoice follows, and finance pays it because somebody remembers that the boss said yes. By then the message is buried under four hundred others.
That is how a lot of trading and contracting businesses in the UAE actually buy things. It works until it does not, and the failure is never dramatic. It is a delivery that came up short and got paid in full. It is an invoice paid twice because two people forwarded the same PDF. It is a price on the invoice that is not the price anyone agreed.
Procurement software fixes this with one idea, and the idea is called three-way matching. Three documents have to agree before anyone pays. Most buyers have never had that explained, so they end up comparing feature lists instead of asking whether the system actually enforces the check. This guide explains the check first, then the controls that sit around it, then the UAE rules that shape both, then what the whole thing costs. A procurement setup and configuration engagement with us starts from around AED 4,000 [19].
Three-way matching, explained properly
Three documents describe the same purchase. Each one is created by a different person at a different moment, and that is exactly why the comparison works.
- The purchase order. What was agreed: which supplier, which items, how many, at what unit price. Created before anything happens, once the request has been approved.
- The goods receipt. What actually arrived, counted at the door or the site against what the order said should arrive.
- The supplier invoice. What the supplier is asking to be paid, and for what.
The rule is that the invoice is not released for payment until all three agree on quantity, unit price and total, and until the invoice points at a purchase order that exists. Anything that does not agree goes into an exception queue where a person looks at it before money moves.
What the check catches
Paying for goods that never arrived. A supplier invoices for two hundred bags of cement. The receipt says one hundred and sixty arrived, because forty were short on the truck and the storekeeper wrote it down. Without the match, the invoice is paid in full and nobody chases the credit note. This is the most common quiet loss in the whole process, because short deliveries are normal and forgetting to chase them is also normal.
Paying twice. The supplier emails the invoice to the site manager and posts a copy to the office. Both reach finance in different weeks. Both look genuine, because both are genuine. A system that matches invoices to an order sees that this order has already been matched and holds the second one. A shared inbox and a memory do not.
Paying a price nobody agreed. The order was placed at one rate. The invoice arrives at another, because a quote expired, or a line was priced from a newer list, or somebody tried it on. It goes through because the person paying was not the person negotiating and has nothing to compare against. The match compares the invoice price line by line against the order price and holds anything that differs.
Paying for something nobody ordered. An invoice turns up with no order behind it at all. In a WhatsApp process this is indistinguishable from a legitimate urgent purchase, so it gets paid. When a purchase order is the only route to a payment, it stands out immediately.
Two-way matching, tolerances and services
Not everything can be matched three ways. A consultancy fee or a monthly service charge never arrives at a door, so it is matched two ways, invoice against order, sometimes with a service confirmation standing in for the receipt. Good systems let you set the rule per category rather than forcing one behaviour on everything.
They also let you set tolerances, so a few fils of rounding or a delivery a fraction over the ordered quantity does not block a payment and create work for nothing. Set those deliberately and review them. A tolerance set too wide switches the control off without anyone noticing.
There is a tax angle here too. The point where you compare the invoice against the order and the receipt is also the point where you are most likely to spot that the supplier's tax invoice is defective, missing a TRN, showing the wrong VAT amount, or converting currency without stating the rate. The Federal Tax Authority treats a valid tax invoice as the primary documentary evidence supporting VAT recovery [1]. Catching a bad invoice before you pay it is far easier than fixing it after.
Four different products called procurement software
Before shopping, work out which category you are actually in. Buying the wrong one is the standard way to overspend here.
| Category | What it adds | Usually right when |
|---|---|---|
| Purchasing module inside accounting or ERP | Orders, approval routing, receipts against the system you already run | You already own the system and the module is simply switched off |
| Standalone procure-to-pay | Approval chains independent of accounting roles, supplier onboarding, matching as its own step | You will not replace your accounting system but need a real control layer in front of it |
| Spend management and corporate cards | Cards, expense claims and approvals in one layer | Usually a different problem from routine purchase approval |
| E-sourcing and tendering | Competitive bidding before a supplier is chosen | Large buyers running formal bids, not routine reordering |
The first row deserves more attention than it usually gets. Zoho Books documents multi level transaction approval with up to ten configurable levels [14]. Odoo documents purchase approvals driven by order value, so orders under a threshold pass automatically and orders above it need a manager, along with blanket orders for recurring purchases [15]. If you already pay for one of these, the honest first question is whether the feature is missing or just unused.
Tendering is a different world again. Federal government entities follow their own framework under Federal Decree-Law No. 11 of 2023 [17]. That is a useful boundary marker rather than a rule a private trading company has to follow.
Control: approval limits and segregation of duties
Matching stops bad invoices. Control decides who can commit the business in the first place.
Approval limits. The standard practice is tiered: larger orders need a more senior approver than smaller ones, so nobody can authorise unlimited spend alone. There is no official UAE threshold and no authority publishes one, so any specific figure you read is somebody's opinion rather than a rule. Set your own tiers against your real order values. Small teams usually do better with two levels than with an elaborate ladder nobody follows.
Segregation of duties. No single person should be able to raise, approve and pay for a purchase. The person raising the order should not approve it. The approver should not release the payment. The person releasing the payment should not also hold the banking credentials. This is a core control activities principle in the COSO Internal Control framework, developed with the AICPA, the Institute of Internal Auditors and the American Accounting Association [6]. In a small business perfect separation is not always possible, and the practical answer is compensating controls: a second pair of eyes on anything above a threshold, and a log that makes the exception visible.
The audit trail. Every requisition, approval, order, receipt, match and payment should be logged against a named person with a timestamp, including edits to supplier records. This is what lets anyone reconstruct a purchase a year later. It also matters for tax, because Cabinet Decision No. 74 of 2023 describes accounting records that can be examined through a series of auditable documents [2]. ISO 37001, the anti-bribery management standard, covers the same territory formally, including third party due diligence and financial controls, and is worth knowing about as a reference point [9].
The supplier bank detail change
This is the one to take seriously, because it is the fraud that empties an account rather than costing a margin point.
It works like this. Someone impersonates a supplier you have dealt with for years, from a spoofed address or a mailbox they have genuinely compromised. The email is polite, uses the right names, references a real open invoice, and says the company has changed banks. Please pay the next invoice to this account. Nothing about it feels like an attack, because the relationship is real and the invoice is real. Only the account number is new.
The FBI Internet Crime Complaint Center recorded 55.5 billion US dollars in exposed losses from business email compromise between October 2013 and December 2023, across 305,033 reported incidents in 186 countries [7]. Those are global figures over a decade, not a UAE number, and we have not found a primary source publishing a reliable UAE specific total, so we are not quoting one.
The control is unglamorous and it works. Any request to change a supplier's bank details triggers a callback to a phone number already on file, not a number printed in the email or on the new invoice, to a person you have spoken to before. IC3's own guidance on this pattern is to verify payment detail changes through a secondary channel or two factor confirmation [7]. Then a second person approves the change before it takes effect, and the system records who requested it, who approved it, and what the old details were.
In software terms, that means asking three questions on any demo. Can I restrict who is allowed to edit a supplier's bank account field. Can I require a second approval on that specific change. Does the audit log keep the previous value. If the answer to all three is no, the product is a purchasing tool rather than a control system. If money has already gone out, contact your bank immediately. The Central Bank of the UAE also runs a fraudulent reporting channel through its Cyber Security Centre of Excellence [8].
The UAE rules that shape the system
None of this is tax, customs or legal advice, and each point below ends with who to confirm it with.
Tax invoices. The Federal Tax Authority's guide on tax invoices sets out what a full tax invoice must show: the words Tax Invoice, a sequential number, the issue date and the supply date where different, supplier name, address and TRN, recipient name and address plus TRN where registered, a description of the supply, and per line the unit price, quantity, VAT rate and amount, with gross amount and total VAT in dirhams [1]. A simplified invoice is allowed where the recipient is not registered, or is registered and the VAT inclusive consideration is AED 10,000 or less. Invoices must be issued within fourteen days of the supply [1]. Input tax recovery generally requires that you are registered, that the purchase is used for taxable supplies, and that you hold and keep a valid tax invoice [3]. Confirm edge cases with the Authority or your tax advisor.
Record retention. Cabinet Decision No. 74 of 2023 sets the period at five years generally and seven years for records relating to real estate, with extensions in circumstances such as a dispute or an ongoing audit [2]. Purchase orders, goods receipts and supplier invoices all sit inside the scope of accounting records. The fifteen year figure still circulating online reflects the repealed pre 2023 regime. Choose software that exports complete history rather than only showing current balances.
Importing. Dubai Customs lists the documents required for a standard commercial import in its own customer guide, including the bill of lading or airway bill, commercial invoice, certificate of origin, packing list, delivery order for sea shipments, and permits where required [5]. The same guide requires documents related to a customs declaration to be kept for five years from clearance [5], which is a separate obligation from the VAT rule. On duty, the official UAE government portal states 5 per cent of the value of goods plus cost, freight and insurance, with higher rates on alcohol and cigarettes [4]. Rates vary by classification, so confirm your goods with Dubai Customs.
Landed cost. Freight, insurance, duty and clearing belong on the goods receipt, not in a general expense account at month end, because the receipt is where you know both the charges and the quantity. Odoo documents allocation methods including equal split, by quantity, by value, by weight and by volume [18]. Our inventory and warehouse software guide covers this in more depth from the stock side.
What procurement software costs
First, what we will not publish. Every claim of the form companies save a given percentage of spend that we found during research came from a vendor page or a vendor sponsored study, with no method you could check. Those figures are marketing. The real case for the software is what matching catches in your own purchase history, and you can estimate that yourself from a few months of paid invoices.
Most vendors in this category do not publish prices at all. Procurify and Kissflow Procurement both quote on request [12] [13]. Of the ones that do publish, Precoro lists a Core plan at 499 US dollars a month billed annually [10], and Tradogram lists Essentials at 99 US dollars a month or 891 US dollars a year [11]. Both publish in US dollars only, with no dirham price shown, so treat any converted figure as your own estimate rather than a quote.
If you are looking at a module inside an ERP instead, note that Odoo's Purchase app is not part of the free single app tier and needs a paid plan [16]. We are not quoting an Odoo figure here, because pricing pages in this category can render in different currencies depending on where the page thinks you are. Check it from a UAE session and get the number in writing.
On our side, procurement is usually a module decision before it is a product decision. Here is where a setup engagement sits in our published ladder.
| Engagement | From |
|---|---|
| A single system integration | Around AED 1,500 |
| Document management setup | Around AED 3,000 |
| Accounting software setup and migration | Around AED 3,500 |
| Procurement setup and configuration | Around AED 4,000 |
| Inventory software setup | Around AED 5,000 |
| ERP first phase | Around AED 20,000 |
Final pricing depends on scope.
Real client stories
These are real situations from systems work we have done, with details changed.
The module they had already paid for. A Dubai trading company came to us to buy a procurement platform after a duplicate payment to a supplier. They were already running a full accounting system with purchasing and approval routing included, switched on by nobody, because the original setup had configured invoicing and stopped there. We configured approval levels, supplier records and matching inside the system they owned. The new subscription they were about to sign was not needed.
The short deliveries nobody chased. A contracting business with three active sites asked for better reporting. Going through six months of paid invoices against delivery notes, a pattern appeared: several suppliers routinely delivered slightly less than ordered and invoiced in full, and site staff noted the shortfall on paper that never reached finance. Recording receipts at site level on a phone, and holding any invoice that did not match, changed the supplier conversations within one quarter.
The bank detail that nearly changed. A multi branch business received a well written email from a long standing supplier announcing new bank details. Accounts was ready to update the record. The callback rule we had put in place a few months earlier meant somebody rang the supplier's known number first. The supplier had sent nothing. The control that stopped it took two minutes and cost nothing.
How SKIMBOX approaches procurement projects
We start by asking whether this is a product decision at all. Very often the purchasing module inside the accounting or ERP system a business already owns will do the job once approval levels, supplier records and matching rules are configured properly, which costs a fraction of a new subscription. Where a dedicated layer genuinely is needed, we scope it against your real order volume and your actual approval structure rather than a feature list. Then we design the approval tiers, set the matching rules and tolerances, protect the supplier bank field, connect purchasing to whatever holds your accounts and stock, and train the people who will raise and approve orders every day [19].
A procurement setup and configuration engagement starts from around AED 4,000. A single integration starts from around AED 1,500, a document management setup from around AED 3,000, an accounting setup from around AED 3,500, an inventory setup from around AED 5,000, and an ERP first phase from around AED 20,000. Final pricing depends on scope.
See our core business operations services and business consulting services, or contact us to talk through how your purchases get approved today.
For related reading, see our guides on ERP implementation in the UAE, accounting software in the UAE, helpdesk software in the UAE, data analytics and BI, and digital transformation for UAE SMEs.
References
[1] Federal Tax Authority, UAE - Tax Invoices, VAT guide. tax.gov.ae/Datafolder/Files/Pdf/2023/Knowledge%20Center%20Page/VAT11%20-%20Tax%20invoices%20En.pdf
[2] Federal Tax Authority, UAE - Cabinet Decision No. 74 of 2023 on the Executive Regulation of Federal Decree-Law No. 28 of 2022 on Tax Procedures. tax.gov.ae/Datafolder/Files/Legislation/
[3] Federal Tax Authority, UAE - Timeframe for recovering input tax. tax.gov.ae/en/content/timeframe.for.recovering.input.tax.aspx
[4] U.AE Official UAE Government Portal - Clearing the customs and paying customs duty. u.ae/en/information-and-services/finance-and-investment/clearing-the-customs-and-paying-customs-duty
[5] Dubai Customs - Customer Guide, official publication. dubaicustoms.gov.ae/en/OpenData/Publications/Customer_Guide_Booklet_EN.pdf
[6] COSO - Guidance on Internal Control, Internal Control Integrated Framework. coso.org/guidance-on-ic
[7] FBI Internet Crime Complaint Center - Business Email Compromise public service announcement, PSA240911. ic3.gov/PSA/2024/PSA240911
[8] Central Bank of the UAE - Cyber Security Centre of Excellence, fraudulent reporting. centralbank.ae/en/our-operations/risk-management/cyber-security-centre-of-excellence-1/fraudulent-reporting/
[9] ISO - ISO 37001, Anti-bribery management systems. iso.org/standard/37001
[10] Precoro - Official pricing. precoro.com/pricing/
[11] Tradogram - Official pricing. tradogram.com/pricing
[12] Procurify - Official pricing. procurify.com/pricing/
[13] Kissflow - Procurement pricing. kissflow.com/procurement/pricing/
[14] Zoho - Zoho Books multi-level approval documentation, UAE. zoho.com/ae/books/help/transaction-approval/multi-level-approval.html
[15] Odoo - Purchase app official documentation. odoo.com/documentation/
[16] Odoo - Official pricing plans. odoo.com/pricing-plan
[17] Ministry of Finance, UAE - Federal Decree-Law No. 11 of 2023 regarding Federal Government Procurement. mof.gov.ae/ministry-of-finance-announces-federal-decree-law-no-11-of-2023-regarding-federal-government-procurement/
[18] Odoo - Inventory documentation, landed costs and allocation methods. odoo.com/documentation/18.0/applications/inventory_and_mrp/inventory/product_management/inventory_valuation/landed_costs.html
[19] SKIMBOX - Internal experience implementing business systems for UAE companies, 2026. skimbox.co
