Lesson 4 of 5
Assessing defects by spend and supplier impact
12 min
Not every P2P defect is equal. A misspelled label on the PO form and an invoice above tolerance being paid automatically both fail a test, but one is cosmetic and the other lets money leave the company without control. Priya's team rates every P2P defect on three questions: how much spend does it touch, how does it affect suppliers, and does it break a control?
Three lenses
| Lens | Question | Contoso example |
|---|---|---|
| Spend impact | How much purchase value per month could be wrong, delayed or unapproved? | Lakeside rotor spend is about $1.2 million a month (fictional); a defect on all J45 POs touches all of it |
| Supplier impact | Will suppliers get wrong, late or no orders, payments or documents? | PO output not sent: Lakeside never sees the order and the line stops |
| Control risk | Does it bypass approval, tolerance, segregation of duties or the duplicate check? | Invoices above tolerance paid without a block |
Three lenses for rating P2P defects.
Control failures are always serious
A control failure can have zero observed financial effect in test and still be high severity, because in production it lets the wrong thing happen silently. Contoso rates as at least high any defect where: a PO above the threshold is output without approval; an invoice above tolerance is not blocked; a blocked invoice is proposed for payment; the duplicate invoice check does not fire; or a user can post both the goods receipt and the invoice for the same PO when segregation of duties says they should not.
| Severity | Definition for P2P | Example |
|---|---|---|
| Critical | Stops procurement, receiving or payment, or causes material financial error, with no workaround | Payment run fails for all suppliers in company code 1710 |
| High | Control failure, or wrong postings or supplier documents with only a costly workaround | Invoice above tolerance paid automatically |
| Medium | Wrong behavior with a practical workaround and limited spend | Service entry sheet notification goes to the wrong approver; manual forwarding works |
| Low | Cosmetic or convenience issue | PO form shows the plant name in the wrong font |
Contoso's P2P severity definitions (adapted from the program's defect standard).
Must fix before sign-off?
- Is it critical?Yes → must fix and retest before sign-off · No → next question
- Is it a control failure?Yes → must fix, or the process owner and Dan formally accept a compensating control · No → next question
- Is it high with a workaround?Yes → fix before go-live, or accept with a documented workaround, owner and fix date · No → next question
- Is it medium or low?Yes → may be deferred with a plan; list it in the sign-off package · No → reclassify
Quantify where you can. "Wrong G/L account" means little; "receipts of all MRO materials post to the wrong expense account, about $85,000 a month at plant 1720" gives the process owner something to decide on. Use spend data from the old ECC system for the affected suppliers, materials or plants to size the impact.
Writing a P2P defect the owner can act on
- Where: test case, scope item step, company code, plant and purchasing organization.
- What: expected result versus actual result, in one sentence each.
- Evidence: document numbers (PO, material document, invoice, payment), journal entries and messages.
- Who: the user and business role that ran the step.
- Impact: spend, supplier and control impact, with numbers where possible.
- Proposed rating: severity with a one-line reason, confirmed in triage.
Triage happens daily during execution. Priya chairs it with the procurement key users, the functional consultants and, for invoice and payment defects, someone from Dan's team. Ratings are proposed by the tester and confirmed in triage, never changed silently later.
What would you do?
A defect lets invoices above the price tolerance be posted without a payment block, but in the test cycle only one invoice was affected and it was $1 over. The developer proposes "low, tiny amount". What rating fits?
- Rate P2P defects by spend impact, supplier impact and control risk.
- Control failures are at least high, even when the test amount is tiny.
- Quantify impact with spend data where you can.
- Critical defects and control failures must be fixed (or formally compensated) before sign-off.
Check your understanding · not graded
Lesson check
1. A defect allows invoices above tolerance to be paid. How severe is it?
2. Which defect has the highest supplier impact?
3. How should spend impact be sized?
4. When can a control failure remain open at sign-off?