Receiving a supplier invoice, checking it, approving it, paying it, and archiving it: this cycle, repeated dozens or hundreds of times a month, concentrates a considerable portion of the financial, tax, and operational risks for a very small business (TPE) or a small or medium-sized enterprise (SME). Data entry errors, duplicate payments, invoices lost in an email inbox, validations blocked due to a lack of clear procedures, and now increasingly sophisticated bank account fraud: every link in this chain can break. Djaboo offers a dedicated module: supplier management.
The digitization of supplier invoices is no longer optional. The French reform of the electronic invoicing The law requires all VAT-registered businesses to be able to receive electronic invoices from September 1, 2026, and to issue them from September 1, 2027 for very small businesses (TPEs) and small and medium-sized enterprises (SMEs). This tight schedule necessitates a rethinking not only of the tools, but of all processes: from receipt to archiving, including reconciliation checks and anti-fraud measures.
This guide presents, step by step, the method to adopt and the controls to put in place to transform this obligation into a sustainable operational advantage.
What the digitization of purchase invoices entails
The term "digitalization" is often used imprecisely. It doesn't simply mean receiving a PDF file by email rather than a paper document by mail. It actually encompasses several very different levels of maturity, and confusion between these levels is one of the main sources of error in preparing for the reform.
The first level This is simply digitization: you scan a paper invoice and save it as an image. The information remains static, cannot be automatically processed, and the processing remains entirely manual.
The second level This is the digitization process in PDF format. The invoice is generated or transmitted as a digital file, but the data it contains is unstructured. To extract it, you have to re-enter it manually or use an optical character recognition (OCR) tool, with the inherent risk of error.
The third levelThe one imposed by the ongoing reform is electronic invoicing in the regulatory sense: the invoice is issued in a structured format (Factur-X, UBL or CII), transmitted via a approved platform by the tax authorities, and its data is readable and automatically processed by computer systems.
This distinction is fundamental. As specified in Article 289 of the General Tax Code, the authenticity of the origin, the integrity of the content, and the legibility of the invoice must be ensured from its issuance until the end of its retention period. A simple PDF sent by email does not meet this requirement under the new regulations.
For a micro-enterprise or SME, the dematerialization of purchase invoices therefore covers a project with several dimensions: technical (choosing the right formats and the right tools), organizational (redefining validation circuits and responsibilities), fiscal (respecting the obligations of the reliable audit trail and archiving), and human (training teams and securing processes against fraud).
The typical process of a supplier invoice, from receipt to payment
Before digitizing anything, it is essential to map the existing process. Too many companies embark on digitization projects without having formalized their current processes, and end up digitizing malfunctions rather than correcting them.
The process of a supplier invoice generally follows seven steps, although their formalization varies considerably from one company to another.
The reception is the first point of entry. Even today, invoices arrive through multiple channels: postal mail, email, supplier portal, download from an online customer area. This dispersion is one of the primary causes of lost documents and processing delays.
Registration This involves entering or importing invoice data into the management or accounting system. It is at this stage that manual data entry errors occur, and duplicates are introduced if no automatic controls are in place.
Compliance control It concerns the mandatory information required by Article 289 of the French General Tax Code (CGI): full identification of the parties, sequential invoice number, date of issue, description of goods or services, quantities, unit prices excluding VAT, applicable VAT rate, total amount including VAT, and payment terms. An incomplete invoice may legitimately be rejected and a request for rectification must be submitted to the supplier.
The rapprochement The purchase order and delivery note together form the core of internal purchasing controls. We will discuss this in detail in the dedicated section.
The validation Authorization by authorized personnel is a condition for payment. It can be single or double depending on the amounts involved and the organization of the company.
Payment triggers the disbursement. It is at this stage that the risk of fraud is highest, particularly in the event of a change in bank details.
Archiving closes the circuit and entails specific legal obligations regarding duration and conditions of storage.
Each of these steps must be documented, with an identified person responsible, a target deadline, and a procedure for handling exceptions. Without this prior formalization, digitization only accelerates a flawed process.
What the electronic invoicing reform changes for reception
The French reform of electronic invoicing is fundamentally changing how you will receive invoices from your suppliers. Understanding this change is the first step to preparing for it properly.
Until September 1, 2026, your suppliers have considerable freedom in their invoicing methods. They can send you paper invoices, PDFs by email, or documents transmitted via online portals. From that date, large companies and medium-sized enterprises (ETIs) are required to issue their invoices in a structured electronic format, via a approved platformAll companies subject to VAT, including micro-enterprises and SMEs, are required to receive these electronic invoices from this same date.
What this means in practical terms for you: if you work with large suppliers (telephone operator, energy supplier, SaaS software publisher, large service provider), you will receive their invoices via an approved platform from September 2026. You must therefore have designated your own approved platform and registered in the electronic invoicing directory before this deadline.
A point often misunderstood: an electronic invoice, as defined by the reform, is not a PDF sent by email. It is a document containing structured data, transmitted via an approved platform that verifies its technical and regulatory compliance before sending it to you. If your SIREN number is incorrectly entered in the directory, or if your supplier's details are wrong, the invoice will be automatically rejected by the platform. The Belgian experience, which rolled out electronic invoicing nationwide in January 2026, showed that the mass rejections of invoices in the first few days were mainly due to poor quality of the reference data, and not to technical failures.
From September 1, 2027, the obligation to issue electronic invoices will apply to all businesses subject to VAT in France. From that date, all your suppliers established in France will invoice you electronically. Only your foreign suppliers will remain outside the national system and may continue to send you paper or PDF invoices.
The transition period between 2026 and 2027 therefore requires a hybrid system: you will simultaneously receive electronic invoices via your approved platform and traditional invoices from your smaller suppliers. This coexistence of two systems is a potential source of duplication and processing errors if it is not anticipated.
Automatic data extraction: what to expect and its limitations
One of the most frequently cited benefits of digitization is the automatic extraction of billing data: no more manual re-entry, direct integration into accounting, and considerable time savings. These promises are real, but they need to be qualified to avoid disappointment during implementation.
What automatic extraction can actually bring When an invoice is received in a structured format (Factur-X, UBL, or CII), its data is directly readable by computer systems. The invoice number, date, supplier details, line items, pre-tax amounts, VAT rates, and total amount can be automatically imported into your management system without any human intervention. The correct extraction rate for well-formed structured invoices is very high, drastically reducing data entry errors and processing times.
For invoices received in unstructured PDF format, optical character recognition (OCR) tools can extract the data, but with significant limitations. The quality of the recognition depends on the invoice layout, document resolution, and the complexity of the information to be extracted. Error rates remain significant, particularly for itemized lines, discounts, and product references. Human verification is still necessary for these types of invoices.
Limitations to be aware of before deploying Automatic data extraction does not verify the accuracy of the extracted data. It can easily import a duplicate invoice, an invoice whose price does not match the order, or an invoice from a supplier whose bank details have been fraudulently altered. Therefore, automating data capture does not replace reconciliation and validation checks; it makes them faster to implement, but does not eliminate them.
Furthermore, the quality of the data extraction depends directly on the quality of your supplier database. If the same supplier is recorded with multiple spellings in your database, if their SIREN number is missing or incorrect, or if their bank details are outdated, the automation will produce anomalies that are difficult to detect. Before any deployment, an audit and cleaning of the supplier file are essential.
Finally, automatic data extraction only works correctly if it's connected to your management or accounting system via a reliable integration. A solution that extracts data but then places it in an Excel file requiring manual re-entry offers limited value.
Three-level reconciliation: order, receipt, invoice
Three-way matching, also known as three-way verification, is the most effective internal control mechanism for securing your supplier payments. It involves verifying the consistency between three documents before authorizing any payment: the purchase order, the delivery note, and the supplier invoice.
Purchase order This document formalizes your company's commitment to the supplier. It must specify the item references, quantities ordered, the agreed unit price excluding taxes, payment terms, and delivery time. This document serves as the basis for evaluating any subsequent discrepancies. A purchase order created after the fact to formalize a purchase already made renders this verification process pointless.
The delivery receipt This is the document signed by your department upon physical receipt of goods or confirmation of service completion. It attests to the quantities actually received and their apparent condition. Without a signed and dated delivery receipt, it is impossible to confirm that a delivery has indeed taken place, which opens the door to fictitious invoices and overestimations of quantities.
The supplier invoice is then compared to the two previous documents. The control points relate to quantities (does what is invoiced correspond to what was ordered and received?), unit prices (is the invoiced price in accordance with the purchase order?), contractual discounts (are they correctly applied?), and payment terms (do the due date and method of payment correspond to what was agreed?).
When the three documents match, the invoice can be validated for payment. When a discrepancy is detected, the invoice is put on hold until the anomaly is identified and resolved.
In practice, tolerances are generally defined to avoid blocking invoices due to minor differences related to rounding or exchange rate fluctuations. Best practices recommend a tolerance of 2% to 5% on unit prices and 5% on quantities. These thresholds should be formalized in your purchasing policy and configured in your processing tool.
For purchases of services, for which there is not always a physical delivery note, a two-level reconciliation (purchase order and invoice) may suffice, supplemented by validation from the operational manager attesting to the proper execution of the service.
The approval process: who approves what and within what timeframe
A poorly defined approval process is one of the most frequent causes of bottlenecks in supplier invoice processing. Approvals are either too slow because responsibilities are not clearly assigned, or too fast because no one is actually checking what they are signing.
The first principle This is the separation of duties. The person who enters or records an invoice should not be the same person who approves it for payment. The person who prepares the transferThe system must not be the same as the one that releases them. This separation, even in a small structure, is the most basic safeguard against errors and fraud.
The second principle This involves defining validation thresholds. Not all invoices require the same level of review. A recurring invoice from a known supplier, for a typical amount, can be approved by the accounting manager. An invoice for an unusual amount, from a new supplier, or containing a change in bank details must always undergo double validation. These thresholds must be defined in writing and strictly adhered to.
An example of a validation matrix applicable to an SME:
Invoices below a certain threshold (for example, €2,000) are approved by the accounting manager after reconciliation with the purchase order. Invoices between this threshold and a second threshold (for example, €10,000) also require approval from the operational manager responsible for the expenditure. Invoices exceeding this second threshold require dual approval: from the operational manager and from senior management.
The third principle This involves defining target payment deadlines. An invoice received but not processed within a reasonable timeframe exposes your company to late payment penalties. The French Law on the Modernization of the Economy (LME) sets a maximum payment period of 60 days from the invoice date, or 45 days end of month. Beyond this, late payment penalties are automatically due. Defining an internal processing timeframe (for example, 48 hours for registration, 5 business days for validation) allows you to anticipate these deadlines and avoid additional costs.
The fourth principle Traceability is key. Each validation step must be documented: who validated it, when, and on what basis. This traceability is essential in the event of a dispute with a supplier, during a tax audit, or as part of a reliable audit trail.
Anti-fraud controls: detecting fake invoices and bank account details changes
Supplier invoice fraud is a growing risk for French micro-enterprises and SMEs. A large majority of businesses report having already faced an attempted fraud, and the most common technique is identity theft to commit supplier fraud using a fake bank account number (RIB). (francenum.gouv.fr)
Supplier fraud involves impersonating one of your usual suppliers by providing a fraudulent new bank statement to divert payment of one or more invoices. It takes several forms: an email spoofing the supplier's address, a phone call requesting a change of bank details, or hacking into the supplier's email system to intercept and alter documents in transit.
The widespread adoption of electronic invoicing does not eliminate this risk; it merely shifts it. An invoice arriving via an approved platform may seem more reliable in principle, which could lower the vigilance of teams. However, the approved platform guarantees the technical authenticity of the format and transmission channel, not the legitimacy of the payment request.
The controls to be put in place are organized around several levels.
For the supplier database: the creation and modification of a supplier's bank details must be restricted to a limited number of people, separate from those who prepare and validate payments. Any change to the bank account details must be systematically verified by a telephone call to the supplier, using a number from your internal database (never the number provided in the email or letter requesting the change). This verification must be documented: who called, when, which number, and who spoke with them.
To detect anomalies: check the email address of the sender of an invoice or a request to change contact information. Fraudsters frequently use addresses very similar to the official address, with a modified initial or a slightly different domain. Pay attention to any urgent requests or contact information changes accompanied by pressure to act quickly: these are classic red flags.
For payments: define a whitelist of authorized IBANs in your transfer tool. Any payment to a new or modified IBAN must trigger a waiting period and double validation. Above a certain threshold, out-of-band confirmation (phone call or written confirmation via a channel separate from email) must be mandatory before any disbursement.
Successful wire transfer fraud exploits a human weakness, not a technical flaw. Regular training for exposed teams (accounting, administrative and financial management, executive assistant) is therefore just as important as technical measures.
Electronic archiving and reliable audit trail
The archiving of supplier invoices is subject to specific legal obligations, which dematerialization does not eliminate but transforms.
Shelf life are now set by two main texts. From a tax perspective, Law No. 2026-534 of June 25, 2026, which amends Article L. 102 B of the Tax Procedures Code, extends the retention period for tax documents from 6 to 10 years for deadlines expiring after January 1, 2027. (entreprises.cci-paris-idf.fr) From an accounting perspective, Article L. 123-22 of the Commercial Code already mandates a 10-year retention period for accounting documents and supporting documents. In practice, a 10-year retention policy applies to all invoices and related documents (purchase ordersreceipts, contracts, proofs of payment) is the safest and easiest to manage.
The reliable audit trail This is the central requirement of Article 289 VII of the French General Tax Code (CGI). It refers to all the documented and ongoing controls that link each invoice to an actual commercial transaction and its payment. In practice, it establishes a documented link between three elements: the invoice, the transaction that justifies it (order, contract, delivery note), and the payment that settles it.
Contrary to popular belief, a reliable audit trail does not disappear with electronic invoicing. Article 289 VII of the French General Tax Code (CGI) remains applicable, and the approved platform secures the invoice transmission channel, not the entire supporting documentation. Purchase orders, contracts, and proofs of delivery remain your responsibility for maintaining accurate documentation.
Many SMEs lack structured documentation of their reliable audit trail. In tax audits, a missing or insufficient audit trail can lead to the rejection of VAT deductions on received invoices, with tax adjustments potentially covering several years.
Archiving conditions They must guarantee three properties throughout the retention period: integrity (the document has not been modified since its creation), legibility (the document remains usable and understandable), and availability (the document can be retrieved at any time, particularly during a tax audit). A simple shared folder on an internal server, accessible to everyone and without access control, does not meet these requirements. An electronic archiving system compliant with the NF Z42-013 standard offers the necessary technical and legal guarantees.
Invoices transmitted via an approved platform benefit from built-in security (time stamping, sealing, traceability). For other types of documents (scanned paper invoices, PDFs received by email during the transition period), the conditions for legally valid scanning are specified in Article A. 102 B-2 of the French Tax Procedures Code.
Common errors: duplicate entries, lost invoices, blocked validations
Even with the best intentions, supplier invoice processing systems are prone to recurring errors. Identifying them allows you to prevent them.
Duplicate payments These are the most costly errors. They occur when the same invoice is recorded twice in the system, often because it was received through two different channels (email and an approved platform, or email and postal mail) and processed by two different people without any duplicate checks in place. Without a formal control mechanism, companies record an average of 5% duplicate invoices among those actually paid. The 2026-2027 transition period, during which the two systems will coexist, is particularly conducive to this type of error.
Duplicate checking must cover the invoice reference (number, date, amount, supplier ID), regardless of the receiving channel. It must be automated and systematic, and not rely on operators' memory.
The lost invoices These issues stem from the fragmentation of incoming channels. An invoice received in the personal email inbox of an absent employee, downloaded from a supplier portal without notification, or slipped into an unprocessed paper file: all these situations lead to payment delays, penalties, and tension with suppliers. Centralizing all incoming flows to a single entry point (a dedicated email address, an approved platform, or both) is the most effective solution.
Blocked validations These issues arise when the approval process is not clearly defined, when an approver is absent without a designated replacement, or when the invoice cannot be matched in the system due to the lack of a prior purchase order. These blockages lengthen payment delays and damage the supplier relationship.
To address this, each validation step must have a designated primary manager and alternate. Invoices without a corresponding purchase order must be subject to a documented exception procedure, requiring mandatory validation by a higher hierarchical level. Recurring invoices (rent, subscriptions, fixed-amount contracts) can undergo simplified validation, or even partial automation, once the conditions have been verified once.
The accumulation of these errors This has a direct impact on cash flow. Duplicate payments tie up cash and require lengthy recovery procedures with suppliers. Lost invoices generate late payment penalties. Blocked approvals delay legitimate payments and can lead suppliers to suspend deliveries. Implementing monitoring indicators (average processing time, percentage of invoices with exceptions, number of duplicates detected) allows you to measure process performance and identify areas for improvement.
FAQ: Your questions about supplier invoices
Will electronic invoicing apply to very small businesses and SMEs from September 2026?
Yes, partially. From September 1, 2026, all VAT-registered businesses in France, regardless of size, are required to receive electronic invoices from their suppliers. The requirement to issue electronic invoices applies to very small businesses (TPEs) and small and medium-sized enterprises (SMEs) only from September 1, 2027.
Is a PDF sent by email considered an electronic invoice under the reform?
No. An electronic invoice, as defined by the reform, must be issued in a structured format (Factur-X, UBL, or CII) and transmitted via a platform approved by the tax authorities. A PDF sent by email does not meet this requirement for transactions between VAT-registered businesses established in France, from the deadlines set by the reform.
How long should supplier invoices be kept?
Law No. 2026-534 of June 25, 2026, extended the tax retention period from 6 to 10 years by amending Article L. 102 B of the French Tax Procedures Code. The French Commercial Code also mandates a 10-year retention period for accounting documents. In practice, a 10-year retention policy for all invoices and related supporting documents is the prudent rule to follow.
What should you do if you receive a request to change your bank details from a supplier?
Never comply with a request to change bank details received by email without prior verification. Call your usual contact at the supplier on a number from your internal database (never the number provided in the email). Document this verification. Any change of bank account details must be validated by at least two people before being recorded in your supplier database and reflected in your payments.
Djaboo is an all-in-one management tool designed for very small businesses and SMEs, integrating financial management, invoicing, and supplier relationship tracking. It allows you to centralize your processes, streamline approval workflows, and maintain complete visibility into your financial flows, without requiring any specific technical or accounting skills.
