Testing Invoice Three-Way Match Evidence in Cannabis Dispensary Purchasing

"The question is what a match test can establish."

Evidence observation 1

Preserve purchase-order identifier, approval, vendor, item or package reference, received quantity, receipt date, invoice number, amount, exception, and disposition. A match at the document-number level can conceal a unit, lot, or quantity mismatch. Define the matching grain before testing.

Evidence observation 2

GAO internal-control principles support control activities and documentation. NIST supply-chain guidance adds supplier-risk context. Virginia CCA material supplies cannabis jurisdictional context. None creates a universal invoice-matching tolerance or authorizes a payment decision for a particular operator.

Evidence observation 3

Report exact matches, approved variances, unresolved exceptions, duplicate invoices, and receipts without orders. Denominator should be invoices in scope for the period, with exclusions documented. A high match percentage may still hide a small number of material exceptions.

Evidence observation 4

Receiving evidence deserves independent attention. A signed delivery note may show receipt, but not that the right package, quantity, or condition was accepted. Compare inventory movement and quarantine records when relevant, and route uncertainty instead of forcing a match.

Evidence observation 5

Analysts should not approve payments solely because fields align. Approval authority, segregation of duties, tax treatment, and regulated-product review remain separate decisions. Keep the test result, reviewer, and exception resolution in history.

Evidence observation 6

The methodology draws on GAO, NIST, and Virginia public sources. It does not estimate fraud, purchasing savings, or compliance rates. Small samples and clean invoice populations may understate risk.

Evidence observation 7

Three-way matching is useful as a traceability test when its grain and exceptions are explicit. It supports review; it does not replace receiving judgment, approval authority, or cannabis-specific controls.

Additional measurement notes

For cannabis invoice three-way match, the observation unit should be stable before any trend is calculated. A record may represent an attempt, package, request, document, or interval, and those units should not be blended. The operator should state whether duplicates are retained, linked, or excluded and preserve the rule used. That makes a later review reproducible without pretending that a local queue is a representative sample of cannabis businesses.

The evidence also has a time dimension. A same-day count can describe workload or event volume, but it cannot establish a durable rate unless the observation window, open hours, system coverage, and missing periods are known. If a source record was corrected after the event, retain the original value, correction timestamp, and reason. This is analysis hygiene, not proof that the underlying operation performed well.

A responsible finding should name the next decision boundary. Routine records can be summarized; exceptions need an owner, a stopping rule, and a source for the decision. If the evidence is incomplete, “unknown” is more accurate than a favorable assumption. The distinction is especially important in cannabis administration because a customer, product, payment, delivery, or access record may cross several systems and authorities before it is closed.

These limits do not make the research unusable. They make the conclusion narrower and more defensible. A dispensary can use the described fields to compare its own periods, test whether a control operated, and identify records needing review. It should not convert that internal comparison into a public industry statistic, a legal conclusion, or a claim about a vendor, employee, customer, or product without additional evidence.

For an internal repeat measurement, freeze the field definitions before collecting the next sample. Document whether the source is a point-of-sale export, an integration log, a ticket, a scanned document, a meter, or a human observation. Each source has a different failure mode. A missing log event is not the same as a negative event, and a manually corrected record should not silently replace the original. These distinctions let a reviewer challenge the method without having to guess how the number was made.

Comparisons also need a like-for-like boundary. Store hours, product scope, channel, reviewer coverage, and rule version can change the apparent result even when the underlying process is unchanged. Report those changes beside the measure. Where the population is small, show counts and examples of unresolved states rather than relying on a percentage that suggests precision the sample cannot support.

The operational use of this research is therefore diagnostic. It can help an owner decide which evidence to request, which exception to route, and which process boundary needs clarification. It should not be used to rank dispensaries, assign blame, or promise an outcome to a customer or supplier. Those decisions require facts outside the public sources reviewed here and an accountable decision-maker.

Before publishing a local result, have a second reviewer trace a sample from the reported number back to its source record and forward to the stated decision. Resolve disagreements by recording the rule, not by averaging opinions. That modest review step exposes missing identifiers, duplicated events, stale exports, and unsupported causal language. It also keeps the article’s central promise intact: evidence should clarify a cannabis dispensary decision while remaining honest about what the evidence cannot show.

Sources and evidence scope

This article is a bounded desk review for cannabis dispensary administration. The cited sources are public references selected for the specific control question; they are not evidence of a national industry average. Facts from the sources are identified as such, while recommendations and interpretations are analysis. Operators should verify current Virginia requirements and their own license, system, and record boundaries.

Evidence-led conclusion

Three-way matching is useful as a traceability test when its grain and exceptions are explicit. It supports review; it does not replace receiving judgment, approval authority, or cannabis-specific controls.

Public sources

1. [S1] Virginia CCA laws and regulations (public source).
2. [S2] NIST supply-chain risk management (public source).
3. [S3] GAO Standards for Internal Control (public source).