How SAP Concur works

Requirement evaluated: Mobile approval with full invoice image view; approvers must be able to act from their phone in under 30 seconds

For a multi-location services company with distributed approvers, SAP Concur delivers mobile invoice approval through its native iOS and Android app. When an invoice reaches an approver's queue, they open the SAP Concur app and are presented inline with a summary, a rendered image of the invoice, and line-item details — all without a separate download step. From that screen, the approver taps once to approve or send the invoice back with a comment. This covers the legitimacy and authorization stages of the pre-processing journey (stages 1 and 5 of the five-question chain). …

Limitations: For approvers who authenticate with a Concur username and password rather than SSO, 2FA is mandatory on every new session login, requiring a six-digit authenticator-app code each time a session expires — a step that can push the first approval action in a new session well beyond 30 seconds. …

Requirement evaluated: Segregation of duties enforcement: person who enters cannot approve, person who approves cannot process payment

For a 3-person AP team at a $120M services company, SAP Concur Invoice enforces segregation of duties through three structurally separate roles assigned per user by a Company Administrator. The Invoice AP User role covers invoice creation and submission; the SAP Help Portal Permissions documentation explicitly states that the Invoice Processor role 'cannot create and submit invoices,' blocking any processor from also acting as the submitter. A separate Approver/Manager role handles the approval step; the system prevents self-approval (an approver cannot approve their own submitted documents). …

Limitations: The Approval Routing configuration includes a toggleable setting called 'Allow Invoice Processors to process their own invoices,' meaning the submitter-cannot-process control is configurable rather than permanently locked, and must be deliberately disabled to enforce the restriction. …

Requirement evaluated: Segregation of duties enforcement: person who enters cannot approve, person who approves cannot process payment

For a 3-person AP team processing 1,800 invoices per month across 2 Sage Intacct entities, SAP Concur Invoice addresses segregation of duties through a tiered role architecture with non-overlapping permissions. The system defines at least four distinct Invoice roles: Invoice AP User (entry and creation of payment requests), Invoice Approver (business-user approval), Invoice Processor (final AP review and processing), and Invoice Pay Manager (monitoring and releasing payment batches). The Invoice AP User role is explicitly scoped to back-office tasks like attaching invoice images, creating payment requests, and routing to approvers — that role does not include approval authority. …

Limitations: One admin-configurable escape hatch is material for this buyer: the 'Allow Invoice Processors to Process Their Invoices' setting, if enabled, permits a processor who also submitted an invoice to process it — SAP's own documentation notes this is designed only for single-processor companies, but it must be explicitly le …

Requirement evaluated: Batch approval capability for recurring invoices from the same vendor (e.g., monthly telecom bills across 6 locations)

For a multi-location services company handling monthly telecom bills across 6 sites, Concur Invoice offers two relevant but incomplete mechanisms. First, Concur Invoice's Recurring Invoices feature (documented in the SAP Help Portal table of contents under 'Managing Recurring Invoices') lets users set up templates that pre-populate invoice fields for repeating vendors, reducing manual data entry. However, per the SAP Concur community, recurring invoice templates do not auto-submit or auto-approve: each generated invoice still routes individually through the configured approval workflow and must be approved one at a time. …

Limitations: The recurring invoice template eliminates re-keying but does not create a true batch approval: each invoice still flows through the workflow as a discrete item, meaning an approver handling 6 monthly telecom bills must still act on up to 6 separate items rather than approving one grouped batch. …

Requirement evaluated: Support for Sage Intacct dimensions: Location, Department, Class, Project, Customer, and custom dimensions

For a $120M multi-location services company running two Sage Intacct entities, SAP Concur's native Sage Intacct integration pulls GL accounts, vendor lists, and Intacct dimension lists directly into Concur via a bidirectional, near-real-time sync. The Sage Intacct Marketplace listing published by SAP Concur confirms that 'SAP Concur automatically collects all Account Codes, dimension lists, and vendors directly from Sage Intacct,' and a third-party implementation review (RSM Technology) confirms that 'Intacct dimensions can be selected and mapped into SAP Concur.' During invoice coding in Concur Invoice, coders select dimension values (Location, Department, Class, Project, Customer) …

Limitations: The five named standard dimensions (Location, Department, Class, Project, Customer) are evidenced as synced through the native integration, but Sage Intacct user-defined (custom) …

Requirement evaluated: Native, pre-built, bidirectional integration with Sage Intacct (not middleware-dependent)

For a $120M services company running 2 Sage Intacct entities, SAP Concur offers a named, pre-built integration listed on both the SAP Concur App Center and the Sage Intacct Marketplace under SAP Concur's own account. The mechanism uses Concur's Financial Integration Service (FIS), a v4 API layer built into Concur's own infrastructure, to pull GL accounts, vendors, and Intacct dimensions into Concur for coding, then post approved invoices from Concur Invoice back into Sage Intacct automatically in near real-time, without requiring export/import files or a third-party iPaaS layer. …

Limitations: For this buyer, the two material concerns are: (1) Intacct dimensions must be manually mapped into Concur's field structure during setup; custom or project-level Intacct dimensions are not automatically inherited, so AP coding fidelity depends on how thoroughly those mappings are configured. (2) …

Requirement evaluated: Integration setup assistance included in implementation; not a separate SOW or additional cost

For a $120M multi-location services company moving from fully manual AP to Sage Intacct-connected automation, SAP Concur offers a native Sage Intacct integration listed in its App Center. The connector handles bidirectional sync of GL accounts, vendors, and Sage Intacct dimensions, and supports posting invoices and expense reports into Sage Intacct automatically with near-real-time feedback. SAP Concur's App Center listing characterizes the connector as having 'Quick and easy setup' and 'No IT or third-party implementation required,' meaning a Concur admin can configure the connection without outside developers. …

Limitations: The buyer's stated requirement is that integration setup assistance be included in the implementation at no separate cost or SOW; SAP Concur's commercial model does not satisfy this: guided integration setup is either self-service (no vendor assistance) or a separately purchased professional services engagement. …

Requirement evaluated: Multi-entity support within the integration; we operate 2 entities in Intacct and plan to add a third

For a two-entity Sage Intacct environment planning to grow to three, SAP Concur's native Intacct integration supports multi-entity sync directly within a single SAP Concur company instance: the integration can sync at the Top Level or route transactions to up to 10 discrete Intacct entities from one Concur account, so the AP team operates a unified workspace while each invoice posts to the correct Intacct entity's ledger. The connector is SAP's own integration listed in the official Sage Intacct Marketplace, carrying invoice, vendor bill, GL account, and dimension data per entity. …

Limitations: The documented ceiling is 10 Intacct entities per Concur company, which comfortably covers this buyer's current 2 entities and planned third; however, the connector's depth for invoice-specific dimensions (custom segments, project codes, cost centers beyond standard fields) …

Requirement evaluated: SOC 2 Type II certification (current, not in-progress)

For a $120M multi-entity services company requiring a current SOC 2 Type II certificate, SAP Concur meets the standard through a dedicated, annually renewed audit program hosted on the SAP Trust Center. The most recently issued report covers the audit period April 1, 2024 through March 31, 2025, and was prepared by an independent third-party CPA firm. The scope explicitly includes Concur Invoice (the module relevant to your AP process), and the report covers the Security, Availability, and Confidentiality trust service criteria under AICPA standards. …

Limitations: The full SOC 2 Type 2 report is NDA-gated rather than publicly downloadable, which is standard practice but does require your team to formally request it through the SAP Trust Center. …

Requirement evaluated: Data encryption at rest and in transit

For a $120M multi-location services company routing invoice data through Concur Invoice and into two Sage Intacct entities, SAP Concur applies encryption at both layers your security requirement calls for. At rest, <cite index="1-1,1-15">SAP Concur uses AES-256 to encrypt data stored on devices and in the cloud</cite>. In transit, <cite index="1-13,1-14">SAP Concur uses TLS and SSL protocols to encrypt data during transmission, ensuring that data exchanged between the application and SAP Concur's servers is protected from unauthorized interception</cite>. …

Limitations: The full SOC 2 Type 2 report is available only under NDA, so your team will need to request it through the SAP Trust Center to review the specific tested controls rather than relying on the summary attestation alone. …

Requirement evaluated: Data encryption at rest and in transit

For a $120M multi-location services company moving 1,800 invoices per month through SAP Concur, every invoice document, vendor record, and financial data element processed in the platform is protected by two distinct cryptographic layers. At rest, SAP Concur applies AES-256 encryption to data stored on devices and in the cloud, meaning invoice images, OCR output, coding fields, and vendor PII stored on SAP's infrastructure are encrypted with one of the strongest available symmetric algorithms. …

Limitations: SAP Concur does not offer customer-managed encryption keys (CMEK) as a standard configuration; key management is handled by SAP's centralized infrastructure, which is standard for cloud AP deployments at this company's size but may require additional contractual review if the buyer's IT policy mandates control over the …

Requirement evaluated: SOC 2 Type II certification (current, not in-progress)

For a multi-location services company evaluating AP automation vendors against a security compliance baseline, SAP Concur holds a completed, issued SOC 2 Type II report covering the audit period April 1, 2024 through March 31, 2025, prepared by an independent third-party accountant. The report is published on SAP's public Trust Center and covers the trust principles Security, Availability, and Confidentiality under AT-C Section 205 and ISAE 3000 standards. Critically for this buyer's use case, the audit scope explicitly includes the Invoice module: 'Concur Standard/Professional/Premium Editions, including Travel, Expense, and Invoice' are named in-scope solutions. …

Limitations: The report is restricted and requires an NDA to obtain a copy, which is standard practice for SOC 2 reports; prospects will need to request it through their SAP account executive. …

Requirement evaluated: Clear exception categories: price variance, quantity variance, missing PO, missing receipt, duplicate, vendor mismatch

For a 6-location services company running 1,800 invoices per month across two Sage Intacct entities, Concur Invoice's exception management centers on its configurable PO Matching Rules engine. Administrators define rule groups for two-way matching, three-way matching, and receipt confirmation, each with configurable tolerance thresholds expressed as a percentage or unit amount above the PO value; when an invoice breaches a threshold, the system triggers an exception message and can warn or block submission. …

Limitations: The entire matching and exception framework in Concur Invoice applies only to PO-linked invoices; the buyer's 45% non-PO volume (utilities, subscriptions, insurance) …

Requirement evaluated: Two-way matching for service POs where no goods receipt applies

For a multi-location services company with subcontractor and professional services POs that will never generate a goods receipt, Concur Invoice supports configurable two-way matching as a distinct rule group within its PO Matching module. The mechanism works in two layers: first, at the PO line level, each line carries a ReceiptType field set to either QUANTITY_RECEIPT (for goods requiring three-way match) or NONE (the default, meaning no receipt is required and the invoice is reconciled against the PO only). …

Limitations: Once a matching rule set is put into use in Concur Invoice, it cannot be edited; any changes require creating a new rule set and reassigning it to the relevant PO policy, which adds configuration overhead if matching thresholds need adjustment over time. …

Requirement evaluated: Clear exception categories: price variance, quantity variance, missing PO, missing receipt, duplicate, vendor mismatch

For your 55% PO-backed invoices (facilities, supplies, subcontractors), Concur Invoice's PO Matching engine creates distinct, named exception categories when configurable rules are breached. Administrators define tolerance thresholds by percentage or absolute unit for price and quantity comparisons, and the system flags invoices that exceed those thresholds before submission; the 'PO Matching' configuration page explicitly covers unit price, quantity, total amount, and vendor record as rule dimensions, which maps directly to your price variance, quantity variance, and vendor mismatch categories. Three-way matching (invoice vs. PO vs. receipt) …

Limitations: Two material ceilings for your scenario: first, the built-in duplicate detection key is fixed to vendor ID plus invoice number, and the SAP Concur Community confirms these factors are not modifiable, meaning near-duplicate invoices with slightly different invoice numbers from the same vendor will not be flagged. …

Requirement evaluated: Automated three-way matching: invoice to PO to goods receipt, with configurable tolerance (2% price, 5% quantity)

For a multi-location services company processing 1,800 invoices per month with a 55% PO-based mix across facilities, supplies, and subcontractors, SAP Concur Invoice's PO Invoice module does support three-way matching: the system compares the invoice against an imported PO and an associated goods receipt record, and will auto-submit or auto-approve when all three documents align within configured tolerances. PO data is brought into Concur via FTP flat file or API, and receipt data must similarly be imported via the Receipt Import mechanism. …

Limitations: For this buyer's facilities, supplies, and subcontractor invoices, which frequently arrive before goods are physically received and logged, the one-time evaluation at invoice creation means the three-way match will not automatically clear when the receipt is later imported; manual rework is required for those invoices, …

Requirement evaluated: Cash flow forecasting based on approved and pending payables with due date distribution

For a 3-person AP team processing 1,800 invoices monthly across two Sage Intacct entities, SAP Concur Invoice offers several reporting components that touch cash flow visibility, but they do not combine into the forward-looking, status-segmented forecast the buyer describes. The platform includes a default accrual report that shows every invoice in the system along with its current status, location, and approver, and this report can be scheduled for automatic distribution to stakeholders. …

Limitations: For this buyer, the material shortfall is the absence of a native, pre-built cash flow forecast view that unifies approved and pending-in-workflow invoices into due date buckets; the available accrual and aging reports address workflow status and payment batch management separately, but not the combined forward-looking …

Requirement evaluated: Real-time AP dashboard: invoice aging, approval queue depth, processing cycle time, spend by vendor/category/entity

For a 3-person AP team processing 1,800 invoices per month across 2 Sage Intacct entities, SAP Concur surfaces AP reporting through two layers. The first is its built-in processor queue inside Concur Invoice, where an AP admin can see invoices by approval status at any point in the workflow. The second is the Analytics/Intelligence reporting suite: named standard reports include a workflow aging report that tracks aging payables including vendor invoice payments, a workflow cycle time report that measures how long approvals take to identify bottlenecks, and a spend-by-vendor report. …

Limitations: The buyer specifically requires a real-time dashboard showing live approval queue depth and current invoice aging as invoices move through the workflow; the documented mechanism (Cognos-based Intelligence standard reports) …

Requirement evaluated: Real-time AP dashboard: invoice aging, approval queue depth, processing cycle time, spend by vendor/category/entity

For a $120M multi-location services company with two Sage Intacct entities and 1,800 invoices per month, Concur Invoice delivers AP visibility through two complementary layers. First, the Invoice Manager dashboard gives the AP team a near-real-time operational view: the Active Invoices section surfaces invoices aging beyond configurable thresholds with alert flags, the My Tasks section shows the current approval queue by status and assignee, and an audit trail records every status change per invoice. …

Limitations: Concur consistently characterizes its dashboard data as 'near-real-time' rather than true real-time streaming, so there may be a short lag between an invoice action and its reflection in the dashboard or reports — a consideration for buyers who need second-by-second queue visibility. …

Requirement evaluated: The system must provide auditor-ready compliance reporting that can produce, on demand, a complete control evidence package for any invoice or payment: the immutable event log, the SoD enforcement record, the authority limit in effect at the time of approval, the chain of custody, and the duplicate check result. This reporting must be exportable without requiring database-level access or vendor professional services, so that the buyer's internal audit and external auditors can pull evidence independently during IPO-readiness reviews and ongoing SOX testing cycles.

For a PE-backed NetSuite company preparing for IPO, the buyer's requirement is a single on-demand evidence package per invoice or payment: immutable event log, SoD enforcement record, the authority limit in effect at the time of approval, chain of custody, and duplicate check result, all exportable without database access or vendor professional services. SAP Concur Invoice does record a per-invoice audit trail that captures submission, approval, and payment status changes, and the help portal confirms a dedicated 'Invoice Audit Trail' and 'Reviewing the Audit Trail of an Invoice' documentation exists (from vendor documentation). …

Limitations: The critical gap for this IPO-readiness buyer is the absence of a documented, self-service, auditor-facing evidence package that consolidates all five required control artifacts (immutable event log, SoD enforcement record, authority limit at time of approval, chain of custody, duplicate check result) …

Requirement evaluated: Automatic extraction of: vendor name, invoice number, date, PO number, line items, amounts, tax, and payment terms

Your team currently keys every invoice by hand into Sage Intacct; Concur Invoice's Invoice Capture feature directly replaces that step. Vendors email invoices to a dedicated Concur-issued address (e.g., CompanyName_invoicecapture@concursolutions.com), or physical mail is scanned and uploaded; the system then applies OCR and machine learning to auto-populate the invoice record. …

Limitations: Payment terms extraction is not documented as an OCR-captured field in Invoice Capture; Standard Edition sets them to a fixed Net 30 regardless of what appears on the invoice face, which would require your AP team to manually override terms for any vendor with different contractual terms. …

Requirement evaluated: Automatic extraction of: vendor name, invoice number, date, PO number, line items, amounts, tax, and payment terms

For a services company currently keying 1,800 invoices per month from email and mail, SAP Concur's Invoice Capture feature handles pre-processing stage 1 (legitimacy/data extraction) using OCR combined with machine learning. <cite index="2-4,2-5,2-6">Invoices created with Invoice Capture leverage Concur's automated service to process vendor-submitted invoices via email, upload, fax, or hard copy; the system uses OCR and machine learning to extract data, capturing details like vendor name, invoice number, date, line items, PO numbers, and GL codes automatically.</cite> At the line level specifically, <cite index="7-15">Concur Invoice captures the description, quantity, unit prices, and catego …

Limitations: Payment terms extraction is the documented gap: official SAP Concur Invoice Capture field lists (SAP Learning Portal and concur.com product documentation) enumerate vendor name, invoice number, date, line items, PO number, tax, and amounts, but do not explicitly include payment terms as a captured field, which matters …

Requirement evaluated: Automatic extraction of: vendor name, invoice number, date, PO number, line items, amounts, tax, and payment terms

For a 1,800-invoice-per-month operation currently keying data manually into Sage Intacct, SAP Concur's Invoice Capture module addresses Pre-Processing Stage 1 (legitimacy and intake) and Stage 2 (PO-number surfacing). Invoices arrive by email to a dedicated SAP Concur-issued address, by fax, or by upload; the system then applies OCR and machine learning to auto-populate invoice data. …

Limitations: Payment terms extraction is not documented as a supported or configurable capture field in any SAP Concur Invoice Capture resource found; the buyer should confirm directly with SAP Concur whether this field can be added to the capture configuration before selecting the product. …

Requirement evaluated: Automatic extraction of: vendor name, invoice number, date, PO number, line items, amounts, tax, and payment terms

For a 3-person AP team currently keying invoices manually into Sage Intacct, SAP Concur's Invoice Capture module sits at Stage 1 of the pre-processing journey: it ingests invoices arriving by email, fax, or scanned mail to a dedicated capture address, then applies OCR technology and machine learning to auto-populate data before a human verifier reviews the results. …

Limitations: Payment terms auto-extraction from the invoice document itself is not confirmed in any available documentation; the system stores payment terms at the vendor master level rather than reading them off each invoice, meaning that field would still require manual entry or separate configuration for this buyer's 1,800-invoi …

Requirement evaluated: International wire payments to 8 overseas vendors with multi-currency support

For a $120M services company needing to pay 8 overseas vendors in multiple currencies, Concur Invoice's native payment network does not cover international wire transactions. As documented by SAP Concur's own Director of Global FSI Partnerships, the platform historically handled payments 'only within the US and Canada,' with any international payment falling outside the system and requiring separate, manual bank processing. To close this gap, SAP Concur partnered with TransferMate, an independent third-party payments company, whose 'PaymentsHub' product can execute cross-border payments in 130+ currencies across 160+ countries and embed within Concur Invoice's approval flow. …

Limitations: International wire and multi-currency AP vendor payments require contracting with TransferMate, a separate third-party company, as Concur has no native international payment rails of its own. …

Requirement evaluated: Payment approval workflow: all payment batches require CFO or Controller electronic approval before release

For a multi-location services company running bi-weekly check and monthly ACH batches through Sage Intacct, Concur Invoice Pay provides a dedicated batch release gate that directly addresses the CFO/Controller sign-off requirement. Within the Invoice Payment Manager module, administrators enable the 'Require Batches to be Released' checkbox in the check configuration and ACH funding account settings. Once enabled, every closed payment batch enters a 'Pending Release' status and is held from transmission to the payment provider until a user holding the 'Payment Release Manager' role takes explicit action. …

Limitations: The batch release gate operates within Concur Invoice Pay, so this control applies only to payments processed through that module; invoices paid outside Concur (marked as 'Client Pay' and executed in Sage Intacct directly) would bypass this gate entirely. …

Requirement evaluated: Unified payment hub supporting ACH, check, wire transfer, and virtual card from a single interface

For a $120M services company moving off manual check runs and ACH batches, SAP Concur's Invoice Payment Manager is the payment execution layer inside Concur Invoice. Once invoices are approved, the Payment Manager consolidates them into batches and executes payments through Concur's own managed disbursement service. Natively, the platform supports ACH payments in USD, CAD, GBP, and EUR, check payments in USD and CAD, and single-use virtual cards in USD and CAD, all managed from within the Concur Invoice interface with a Payment Release Manager for scheduling and batch control. …

Limitations: Wire transfer execution is not available within Concur's own Invoice Payment Manager and requires the buyer to separately source, onboard, and operate PaymentsHub by TransferMate (a different vendor's product), which has its own UI rather than being embedded in Concur's interface. …

Requirement evaluated: Automatic remittance advice sent to vendors upon payment

For a 3-person AP team processing 1,800 invoices per month across bi-weekly check runs and monthly ACH batches, SAP Concur handles automatic remittance through its Invoice Pay managed payment service. When the administrator enables the 'Send vendor payment email notifications for Check and ACH Concur Invoice Pay types' checkbox in Invoice Settings, <cite index="4-1,4-2">vendors automatically receive an email when paid via ACH or check through Invoice Pay, containing full remittance information including when, how, and for what they are paid, covering both partial and full payments.</cite> <cite index="4-6,4-7">The email contains the invoice date, invoice amount, invoice number, payment date, …

Limitations: Automatic remittance emails are contingent on the buyer routing payments through Concur Invoice Pay (the managed payment service); <cite index="21-20">ACH and check payments that occur outside of SAP Concur are not supported in this feature.</cite> The buyer's current check and ACH runs flow through their own bank, so …

Requirement evaluated: The system must maintain an immutable, timestamped, per-action audit log covering every discrete event in the AP lifecycle: invoice receipt, data extraction, coding, each approval action, exception handling, payment initiation, and ERP posting to NetSuite. No event may be deleted, overwritten, or backdated after it is written; the log must be append-only and cryptographically or architecturally protected against alteration by any user including administrators. This directly addresses the buyer's stated requirement that no action in the AP lifecycle is unrecorded or editable after the fact.

For a PE-backed company on NetSuite preparing for IPO, SAP Concur Invoice provides a per-action, timestamped audit trail at both the invoice header level and the line-item level. <cite index="38-1,38-2,38-3">It is possible to review the audit trail history for an invoice; this information is read-only and for viewing purposes only, and the trail captures date and time, the name of the user who updated the audit trail, the action, and a description of the action.</cite> <cite index="38-4">The information cannot be edited.</cite> <cite index="10-3,10-10">Automatic audit trails are described as helping reduce bottlenecks and maintain accountability.</cite> <cite index="10-16">Internal controls …

Limitations: The audit trail is application-layer read-only but Concur does not publish cryptographic or architectural immutability guarantees that block administrator-level alteration, which is the specific bar this buyer's SOX readiness requirement sets. …

Requirement evaluated: The system must provide full chain-of-custody documentation for every invoice, capturing: the identity of the person or system that received it, every individual who viewed, acted on, approved, rejected, or escalated it, and the exact timestamp of each action. This chain must be exportable in a format suitable for auditor review and must remain intact and retrievable for the retention period required by SOX (minimum seven years), without dependency on the vendor's continued storage of archived data.

For a PE-backed NetSuite company preparing for IPO and SOX readiness, Concur Invoice does maintain a dedicated Invoice Audit Trail that is explicitly read-only, recording per-action events by both users and the system across the invoice lifecycle. <cite index="45-1,45-2,45-3">The audit trail presents a read-only history for each invoice, capturing samples of actions that generate entries; the documented list does not include every action that creates an entry.</cite> Supporting documentation confirms that granular actions are logged: <cite index="19-1">Concur Invoice creates an audit trail entry when a receipt image is deleted,</cite> and <cite index="13-12,13-13,13-14,13-15">when a user add …

Limitations: The audit trail's long-term retrievability depends entirely on continued access to the Concur platform; no documented native bulk-export of invoice audit events to an independent archive exists, which directly conflicts with the buyer's stated requirement for retention independent of vendor storage. …

Requirement evaluated: The system must enforce configurable segregation of duties (SoD) controls at the role level, ensuring that no single user can perform conflicting actions across the AP lifecycle; for example, the same user who enters or approves an invoice must be structurally prevented from also authorizing or executing the corresponding payment. SoD rules must be enforced by the system architecture, not by policy alone, so that violations are impossible rather than merely prohibited, supporting the buyer's SOX readiness requirements ahead of IPO.

For a PE-backed company on NetSuite preparing for IPO-level SOX readiness, Concur Invoice provides structurally distinct named roles across the AP lifecycle: Invoice AP User (invoice entry and submission), Invoice Processor (final approval and processing), and Invoice Pay Manager (monitoring and releasing payment batches). <cite index="24-3,24-4">The Invoice Pay functionality role allows a user to monitor and adjust Invoice Pay batches and invoices scheduled for payment.</cite> <cite index="24-9">The Invoice Processor role cannot create and submit invoices.</cite> When an administrator assigns these roles to different users, functional separation across the approval chain exists. …

Limitations: Concur Invoice does not contain a native SoD conflict-detection or conflict-blocking engine: a Company Administrator can assign both invoice-entry and payment-release roles to the same user without any system-level warning or hard stop, and the 'Allow Invoice Processors to Process Their Invoices' setting provides an ex …

Requirement evaluated: The system must enforce role-based access controls (RBAC) at a granular level, limiting each user's visibility and action permissions to only the invoices, vendors, GL accounts, cost centers, and approval queues relevant to their role. Permission assignments and any changes to them must be logged with the identity of the administrator who made the change and the timestamp, so that access creep and unauthorized permission escalation are detectable during a SOX audit.

For a PE-backed company on NetSuite preparing for SOX readiness, Concur Invoice's RBAC model delivers functional-area role segregation but falls short of the granular, auditor-ready permission-change logging the buyer requires. On the access-control side, Concur uses predefined 'Permission Sets' or 'Roles' mapped to licensed modules (Expense, Travel, Invoice, Request), assigned per user record by a Company Administrator via Administration > Company > User Administration (Stitchflow SAP Concur User Management Guide). …

Limitations: The permission-change log does not natively capture before/after field values for all administrative changes, and delegate removals are explicitly not logged — both gaps that SOX auditors at a pre-IPO company will flag. …

Requirement evaluated: Centralized vendor master synchronized bidirectionally with Sage Intacct

For a 2-entity Sage Intacct environment like yours, SAP Concur's native Financial Integration Service pulls vendor records, GL accounts, and dimensions directly from Sage Intacct into Concur in near-real-time: <cite index="21-1">SAP Concur automatically collects all account codes, dimension lists, and vendors directly from Sage Intacct,</cite> and <cite index="15-7">customers can sync at the Top Level or up to 10 entities to one SAP Concur company/entity.</cite> In the other direction, processed invoices post back from Concur to Intacct automatically after approval. However, the write-back path for net-new vendor records created inside Concur (rather than originated in Intacct) …

Limitations: For your team's specific need, the material gap is the Concur-to-Intacct direction for vendor records: new vendors created or updated inside Concur rely on a scheduled extract or a manual import step before they appear in Intacct, rather than an automatic real-time push. …

Requirement evaluated: Vendor performance visibility: on-time payment rate, average payment cycle, dispute frequency

For a 3-person AP team at a $120M services company processing 1,800 invoices monthly across two Sage Intacct entities, SAP Concur provides spend-level and cycle-time visibility through its KPI dashboards and Concur Intelligence reporting layer. The Concur Invoice blog documents that KPIs and dashboards let AP staff 'see how long it's taking to process invoices' and 'identify trends in spending with vendors' (SAP Concur, 'How Concur Invoice Works'). A standard 'Top Spend by Vendor' report surfaces aggregate vendor spend, and a 'Workflow Aging Report' tracks how long invoices sit in-queue by approver, which can be used as a proxy for cycle time (SAP Concur Community, 'Six Critical Reports'). …

Limitations: The two most operationally specific metrics the buyer named, on-time payment rate (a pass/fail ratio against invoice due dates per vendor) and dispute frequency (aggregated exception or hold counts per vendor over time), are not available as pre-built vendor scorecards: the AP team would need to commission custom Intel …

Requirement evaluated: The AP automation system's audit trail must integrate with Oracle NetSuite at full field fidelity, meaning that every AP event recorded in the AP tool (coding, approval, payment posting) must produce a corresponding, reconcilable record in NetSuite with no dimensional data loss across NetSuite's custom segments, subsidiaries, and transaction fields. A gap between what the AP tool records and what NetSuite receives creates an unauditable seam that external auditors will flag during SOX review; the integration must eliminate that seam entirely.

For a PE-backed company on NetSuite preparing for SOX, SAP Concur Invoice posts approved AP data to NetSuite via its Financial Connector, which SAP describes as automatically posting "expense and AP data from our solutions to NetSuite in near real-time" once approvals complete. Standard financial fields (vendor, invoice date, amount, GL account, cost center mapped to NetSuite's Department/Class/Location) travel across the connector, and the integration supports custom field mapping between Concur Invoice and NetSuite Vendor Bill custom fields. …

Limitations: The material ceiling for this SOX-focused buyer is twofold: first, NetSuite custom segments and advanced dimensions require manual, billable mapping configuration that can break when either system is reconfigured, creating maintenance-driven data gaps that auditors will flag. …

Requirement evaluated: The system must perform automated duplicate invoice detection at the pre-processing stage, using configurable matching logic across vendor ID, invoice number, invoice date, and invoice amount, with tolerance rules for near-duplicate scenarios. Detected duplicates must be flagged and routed to an exception queue rather than silently suppressed, and the detection event and disposition must be recorded in the audit trail to demonstrate to auditors that duplicate controls were operating at the time of each processing run.

For a PE-backed company on NetSuite preparing for SOX readiness, the duplicate detection controls in SAP Concur Invoice fall materially short of the buyer's specification. Concur Invoice's native duplicate check operates as a standard system validation across exactly four factors: vendor, invoice number, invoice date, and invoice amount. Per SAP Concur's own community support staff, 'this validation is Concur's standard validation, and these 4 factors are not modifiable,' meaning there is no mechanism to configure tolerance bands for near-duplicate scenarios (e.g., amount within ±2%, date within ±3 days). …

Limitations: The 4-factor matching logic is hardcoded and non-configurable, ruling out tolerance rules for near-duplicate scenarios and making the control unsuitable as a SOX-auditable pre-processing gate. …