Not every procurement transaction moves smoothly from Purchase Order to delivery, invoice and payment.

Materials can arrive damaged. Quantities can be wrong. Documentation may be missing. Invoices may not match the Purchase Order or goods receipt. A supplier may issue the wrong price, while internal receiving or purchasing data may also be incorrect.

For the operative buyer, these deviations create operational work.

But the objective is not simply to close every deviation as fast as possible.

The buyer often depends on other functions or the supplier before a deviation can be fully resolved.

The more relevant question is:

Has the deviation been identified, assigned, actioned and kept under control until it can be closed?

This article explains how to measure that process through separate Quality Deviation Control and Invoice Deviation Control KPIs.

LHTS Procurement Framework

Primary role: Operative Procurement
Supporting interfaces: Quality / Accounts Payable / Supplier / Receiving / Tactical Procurement
Procurement process: Deviation Management / P2P Exception Management
Learning level: Basic
Related course: Operative Procurement Processes 1-3

This article is part of the LHTS Operative Buyer KPI system.

The common principle behind the system is:

Each KPI should measure a process the operative buyer is expected to control or coordinate, identify operational problems early and lead to a defined action.

For deviation management, the central question is:

When an exception prevents the normal procurement flow from continuing, is the issue visible, owned and actively controlled?

Quick answer: What does the Deviation Management KPI measure?

Deviation Management should not be reduced to one combined backlog or one average ageing number.

Quality and invoice deviations share the same control philosophy, but they have different:

owners;
workflows;
operational consequences;
resolution times.

The recommended internal KPIs are therefore:

Quality Deviation Control Rate

Quality Deviation Control Rate (%) = Quality deviations correctly actioned within applicable control SLA ÷ Quality deviations due for control × 100

Invoice Deviation Control Rate

Invoice Deviation Control Rate (%) = Invoice deviations correctly actioned within applicable control SLA ÷ Invoice deviations due for control × 100

A deviation is considered under control when:

it is registered;
ownership is clear;
operational impact is understood;
the required first action has been taken;
the next step is visible;
overdue actions are followed up or escalated.

The deviation may still remain open.

That does not automatically mean the operative buyer has failed.

Why deviation control matters in operative procurement

A deviation interrupts normal flow.

For example:

Quality deviation

Material arrives but cannot immediately be used because:

it is damaged;
the wrong item was delivered;
specification requirements were not met;
required documentation is missing;
quantity is incorrect.

Invoice deviation

An invoice cannot move through normal payment processing because:

invoice price does not match the PO;
quantity does not match the goods receipt;
the PO reference is missing;
currency is wrong;
tax information is incorrect;
the supplier issued the wrong invoice.

The common problem is:

The normal process has stopped.

The operative buyer therefore needs to restore control.

That means making sure somebody knows:

what happened;
who owns the next action;
what needs to happen next;
when it should happen;
whether escalation is required.

Quality and invoice deviations should not be mixed into one KPI

It is useful to manage both types of exception within one Deviation Management framework.

But they should not be blended into one operational statistic.

A quality NCR and a blocked invoice can have completely different:

severity;
business impact;
responsible function;
investigation process;
resolution timeline.

For example:

A production-stopping NCR may require immediate containment.

An invoice discrepancy may require correction before the payment due date.

These are different processes.

The better approach is:

One common management philosophy.

Separate KPI results.

The common deviation-management cycle

Both quality and invoice deviations should follow a controlled cycle.

Identify

The issue is detected and registered.

Assign

Ownership is made clear.

Act

The required first action is taken.

Follow up

The buyer monitors the next responsible party.

Escalate

Critical or overdue issues are raised according to the process.

Close

The deviation is formally resolved and the transaction can continue or be completed.

The operative buyer’s role is to maintain visibility, ownership and momentum through this cycle.

Quality deviations

What is a quality deviation?

A quality deviation is an exception where delivered material, service or supporting documentation does not meet the expected requirement.

Examples include:

Wrong material
Damaged material
Specification non-conformance
Missing certification
Quantity discrepancy
Packaging problem
Transport damage
Incorrect documentation

A formal quality process may record the issue as an:

NCR;
non-conformance;
quality notification;
defect report;
supplier complaint.

The exact terminology varies by organization.

The operative buyer does not own the full quality investigation

A quality deviation may require work from:

Quality
Engineering
Production
Supplier
Logistics
Tactical Procurement

The operative buyer should not automatically be measured on how long a technical root-cause analysis takes.

That may involve:

laboratory analysis;
technical disposition;
supplier 8D;
corrective action;
process redesign;
supplier development.

These activities can take time.

For the operative buyer, the immediate objective is different:

Make sure the operational consequence is under control.

Containment comes before final closure

A quality deviation can remain technically open while the immediate supply risk has already been contained.

Examples of containment include:

blocking affected material;
separating defective stock;
arranging replacement;
confirming usable quantity;
identifying alternative supply;
agreeing temporary disposition;
preventing defective material from reaching production.

This creates an important distinction:

Initial quality control

Is the immediate operational risk controlled?

Final quality closure

Has the technical issue and root cause been fully resolved?

The operative KPI should focus mainly on the first question.

KPI definition: Quality Deviation Control Rate

Purpose

Ensure quality deviations affecting procurement or supply flow receive timely operational action and remain visibly controlled.

Primary owner

Operative Buyer for procurement coordination.

Supporting functions

Quality
Supplier
Engineering
Production
Logistics
Tactical Procurement

Start point

Quality deviation is assigned or becomes actionable for procurement.

End point

Required procurement action is completed and the next responsible step is visible, or the issue is appropriately escalated.

Formula

Quality Deviation Control Rate (%) = Quality deviations correctly actioned within applicable SLA ÷ Quality deviations due for control × 100

Measurement frequency

Operationally daily or weekly.

Management reporting can be monthly.

Examples of quality-control actions

Depending on the issue, the operative buyer may need to:

contact the supplier;
request replacement material;
obtain a recovery date;
coordinate return shipment;
clarify quantity impact;
support Quality communication;
escalate production risk;
update planning information;
support credit or commercial handling.

The buyer is not necessarily responsible for making the technical quality decision.

The buyer is responsible for making sure the procurement and supply consequences are controlled.

Invoice deviations

What is an invoice deviation?

An invoice deviation occurs when an invoice cannot be processed normally because it does not match the expected purchasing transaction.

Examples include:

Invoice price differs from PO
Invoice quantity differs from receipt
Goods receipt is missing
Incorrect PO reference
Wrong currency
Tax mismatch
Duplicate invoice
Incorrect supplier details
Contract and PO conditions differ

The result may be:

invoice block;
payment delay;
supplier query;
manual Accounts Payable work;
buyer intervention.

A blocked invoice does not automatically mean supplier error

This distinction is important.

Suppose the invoice says:

€110

and the PO says:

€100

At first glance, the supplier may appear to have invoiced incorrectly.

But if the contract price is actually €110 and the buyer created the PO incorrectly, the supplier is right.

Likewise:

PO quantity = 100
Invoice quantity = 100

but goods receipt = 80.

The invoice block may be caused by incomplete receiving rather than supplier behavior.

The principle is:

The existence of a deviation does not tell you who caused it.

The cause needs to be investigated.

KPI definition: Invoice Deviation Control Rate

Purpose

Ensure invoice deviations requiring procurement involvement are assigned and actioned within the required control time.

Primary owner

Operative Buyer for procurement-owned or procurement-coordinated exceptions.

Supporting functions

Accounts Payable
Supplier
Receiving
Requester
Tactical Procurement
Finance

Start point

Invoice deviation is routed or assigned to procurement.

End point

Required buyer action is completed and responsibility for the next step is clear, or the issue is escalated.

Formula

Invoice Deviation Control Rate (%) = Invoice deviations correctly actioned within applicable SLA ÷ Invoice deviations due for control × 100

The operative buyer should not own every invoice deviation

Different causes require different owners.

Supplier action

Examples:

wrong invoice price;
incorrect tax;
duplicate invoice;
missing reference;
credit note required.

Operative Procurement action

Examples:

PO contains wrong operational data;
PO amendment required;
commercial reference needs clarification.

Tactical Procurement action

Examples:

contract and PO conditions conflict;
negotiated price is unclear;
commercial agreement needs interpretation.

Receiving action

Examples:

goods receipt missing;
receipt quantity incorrect.

Accounts Payable action

Examples:

invoice-routing issue;
payment-processing issue;
tax-processing issue.

A good deviation process routes the problem to the correct owner instead of leaving the operative buyer responsible for every blocked invoice.

Measure first-action time separately from final resolution time

This is one of the most important KPI design principles in Deviation Management.

Two clocks should be kept separate.

Buyer control clock

Deviation assigned → Required buyer action completed

This is largely controllable by the operative buyer.

Process resolution clock

Deviation opened → Deviation finally closed

This is influenced by multiple parties.

For example:

Buyer first action: 3 hours

Final quality closure: 18 days

The buyer may have performed excellently even though the technical resolution took more than two weeks.

Likewise:

Buyer invoice action: same day

Supplier credit note: 8 days later

The final process time is still useful, but it should not automatically be interpreted as buyer performance.

Resolution Lead Time remains useful as a process KPI

Separate resolution measures can still provide valuable insight.

Quality Deviation Resolution Lead Time

Quality deviation opened → Operational/quality closure

Invoice Deviation Resolution Lead Time

Invoice deviation opened → Invoice correctly released, replaced, cancelled or otherwise closed

These measures show cross-functional process health.

They can help identify:

slow supplier responses;
technical bottlenecks;
AP delays;
approval issues;
poor escalation.

But they should remain separate from the operative buyer’s internal control KPI.

Open deviation count measures workload

The number of open deviations is useful.

But it should not automatically be used as a buyer-performance score.

A buyer responsible for poor-performing suppliers may naturally receive more deviations than another buyer.

Useful workload measures include:

Open Quality Deviation Backlog

Number of open NCRs or quality exceptions.

Open Invoice Deviation Backlog

Number of unresolved invoice discrepancies.

These show workload and operational exposure.

They do not by themselves show whether the operative buyer is performing well.

Ageing is more useful than one average

One average age can hide important exceptions.

Consider:

nine deviations are three days old;
one deviation is 120 days old.

An average alone does not show the seriousness of the oldest issue.

Use ageing buckets instead.

Example quality-deviation ageing

0–2 days
3–7 days
8–30 days
More than 30 days

Example invoice-deviation ageing

0–2 days
3–7 days
8–14 days
More than 14 days

These are only examples.

The actual buckets should reflect the process.

Useful supporting measures include:

median age;
oldest open deviation;
number beyond SLA;
critical deviations without action.

Quality and invoice deviations should not automatically use the same ageing thresholds.

Criticality should determine urgency

Not every deviation has the same business impact.

A practical model might classify exceptions as:

Critical

Potential immediate impact on:

production;
customer delivery;
safety;
compliance;
major payment or supplier relationship.

Standard

Normal operational issue requiring action within the agreed process.

Administrative

Lower-impact exception without immediate operational risk.

The applicable control SLA can then vary by criticality.

For example:

A production-stopping quality issue may require same-day containment.

A low-risk invoice-reference error may have a different response expectation.

The headline control KPI can still aggregate performance by asking:

Was each deviation actioned within its applicable SLA?

Use separate reason codes for quality deviations

A useful quality reason structure might include:

Wrong material
Damaged material
Specification non-conformance
Missing documentation
Quantity discrepancy
Packaging issue
Transport damage
Internal receiving error
Other

Then add:

Cause ownership:

Supplier
Procurement
Logistics
Internal Quality
Other

This makes it possible to understand where quality-related workload originates.

Use separate reason codes for invoice deviations

Possible invoice reasons include:

Supplier price error
PO price error
Quantity mismatch
Missing goods receipt
Missing or incorrect PO reference
Currency error
Tax issue
Duplicate invoice
Supplier master-data issue
Contract/PO mismatch
Other

Again, identify cause ownership.

This may be:

Supplier
Procurement
Accounts Payable
Receiving
Requester
Tactical Procurement

Now the deviation dashboard supports process improvement rather than simply reporting exceptions.

A deviation is not automatically the supplier’s fault

This is a central principle.

Consider three invoice deviations.

Example 1 – Supplier error

PO price:

€100

Correct contract price:

€100

Supplier invoice:

€110

Likely supplier error.

Example 2 – Procurement error

PO price:

€100

Correct contract price:

€110

Supplier invoice:

€110

Likely procurement/PO problem.

Example 3 – Receiving problem

PO quantity:

100

Supplier invoice:

100

Goods receipt:

Actual physical delivery:

100

Likely internal receiving issue.

The same logic applies to quality and quantity deviations.

Investigate before assigning responsibility.

Use a deviation worklist with action status

The operative buyer needs more than a monthly count.

A useful worklist might look like:

Type	Supplier	Issue	Age	Criticality	Owner	Next action	Due
NCR	Supplier A	Damaged material	2 days	High	Buyer / Quality	Replacement confirmation	Today
Invoice	Supplier B	Price mismatch	5 days	Medium	Buyer	Correct PO price	Tomorrow
NCR	Supplier C	Wrong specification	18 days	High	Quality	Supplier corrective action	Friday
Invoice	Supplier D	Missing goods receipt	3 days	Medium	Receiving	Post receipt	Today

This gives the buyer the information required to manage the process.

The most important field is often:

What happens next?

A deviation can remain open for legitimate reasons.

An old deviation with no owner, next action or due date is much more concerning.

A practical Deviation Management KPI example

Assume the operative buyer receives the following during one month.

Quality deviations

15 NCRs require procurement coordination.

Of those:

14 receive the required initial action within SLA.

Quality Deviation Control Rate = 14 ÷ 15 × 100 = 93.3%

At month-end, six remain open.

They include:

four awaiting supplier corrective action;
one awaiting internal Quality disposition;
one with no current action.

The first five remain open but are controlled.

The final one is not.

Invoice deviations

40 invoice deviations are routed to procurement.

38 receive the required action within SLA.

Invoice Deviation Control Rate = 38 ÷ 40 × 100 = 95%

At month-end, twelve remain open:

five awaiting supplier correction or credit;
four caused by missing goods receipt;
three caused by incorrect PO prices.

The KPI now tells management much more than:

“18 deviations are still open.”

It shows:

buyer control;
workload;
ownership;
supplier contribution;
internal process problems.

Do not combine quality and invoice ageing into one average

Suppose:

Quality backlog average age = 24 days.

Invoice backlog average age = 5 days.

A combined average might be:

12 days

That number has little operational meaning.

Quality and invoice deviations have different processes and closure expectations.

Keep the results visible separately.

If management wants one top-level KPI, use:

Overall Deviation Control Rate

This can aggregate whether deviations met their applicable internal control SLA.

But always keep the underlying Quality and Invoice results separately available.

Supplier performance helps explain deviation workload

Supplier-performance KPIs provide an important external perspective.

Supplier Quality / NCR Rate

Measures how frequently supplier quality deviations occur.

Poor quality performance can create:

blocked material;
production disruption;
inspection work;
replacement activity;
buyer workload.

Supplier Invoice Accuracy

Measures whether supplier invoices match expected purchasing and receipt information.

Poor invoice accuracy creates:

invoice blocks;
AP workload;
supplier queries;
payment delays;
buyer intervention.

Supplier Performance KPIs – Supporting the Operative Buyer’s KPIs

The distinction is:

Operative buyer KPI: How well do we control the deviation?

Supplier KPI: How frequently does the supplier create the deviation?

These two measures work together.

Deviation Management and supplier scorecards

Recurring supplier-caused deviations may belong in supplier-performance reviews.

For example:

NCR Rate
Invoice Accuracy
Supplier response time
Corrective-action completion

can become inputs into a supplier scorecard.

But the internal Deviation Control Rate should remain an internal procurement measure.

The relationship is:

Buyer KPI → controls our exception-management process

Supplier KPI → measures supplier-caused performance

Supplier scorecard → combines selected supplier KPIs for management decisions

Supplier Scorecard in Procurement: How to Build and Use One

High deviation backlog does not automatically mean weak buyer performance

A large backlog can indicate several different problems.

Examples include:

supplier quality crisis;
poor supplier invoice accuracy;
delayed technical disposition;
slow supplier corrective actions;
Accounts Payable bottleneck;
missing receiving data;
procurement process issues.

Therefore:

A high number of old deviations without ownership, action or escalation indicates weak process control.

But:

A high total deviation backlog requires root-cause analysis before responsibility is assigned.

This is an important distinction.

Root-cause effectiveness is outside the core operative KPI

Deviation data can eventually support deeper improvement work.

Examples include:

supplier corrective-action programs;
supplier development;
tactical commercial action;
process redesign;
quality improvement;
training;
master-data improvement.

These activities are valuable.

But they should not be confused with the Basic operative-buyer KPI.

The core operative responsibility remains:

Visibility → Ownership → Action → Follow-up → Escalation → Closure

Data sources for Deviation Management

Typical data sources include:

Quality

Quality Management System
ERP quality notifications
NCR database
Supplier portal
Corrective-action system

Invoice

ERP
Accounts Payable system
Invoice workflow
Procure-to-Pay platform
Supplier portal

Useful common data fields include:

deviation ID;
supplier;
type;
creation date;
assignment date;
criticality;
owner;
cause category;
next action;
next-action due date;
status;
closure date.

The objective is to maintain a reliable exception-management worklist.

Deviation Management maturity

KPI maturity describes how the process can develop.

Maturity stage 1 – Visibility and ownership

Procurement knows:

what deviations exist;
whether they are quality or invoice related;
who owns them;
how old they are;
current status.

Maturity stage 2 – SLA and exception control

Procurement measures:

Quality Deviation Control Rate;
Invoice Deviation Control Rate;
backlog;
ageing;
criticality;
next action;
reason codes.

The focus becomes systematic control.

Maturity stage 3 – Cross-functional and root-cause visibility

Procurement can identify:

supplier-caused issues;
procurement-caused issues;
AP issues;
receiving issues;
recurring suppliers;
recurring deviation types.

Supplier-performance information explains where workload originates.

Maturity stage 4 – Exception-based automation

Systems can automatically:

register or route deviations;
assign owners;
trigger SLA alerts;
monitor ageing;
escalate overdue actions;
produce supplier trends.

The operative buyer increasingly focuses on deviations requiring coordination and judgment.

The principle is:

Automate visibility and routing. Apply professional judgment to resolution.

Desired behaviour created by the KPI

A well-designed Deviation Management KPI should encourage the operative buyer to:

Identify deviations quickly
Clarify ownership
Understand business impact
Take required first action
Separate supplier issues from internal issues
Maintain next-action visibility
Follow up external parties
Escalate critical delays
Keep backlog clean
Close completed cases
Use recurring patterns for improvement
Avoid owning deviations that belong elsewhere

The objective is not to make the buyer close every issue personally.

The objective is to make sure no operational exception becomes invisible or ownerless.

Common Deviation Management KPI mistakes

Combining quality and invoice deviations into one average

They have different workflows and timelines.

Keep them separately visible.

Measuring only the number of open deviations

Open count measures workload, not necessarily buyer performance.

Blaming the operative buyer for final resolution time

Suppliers and other functions may control parts of the process.

Separate buyer first-action time from total resolution time.

Treating every deviation as supplier-caused

Investigate the actual cause first.

Using one SLA for every deviation

Criticality and process type matter.

Using only average age

Average age can hide old exceptions.

Use ageing, oldest case and overdue action status.

Allowing open cases with no next action

An open deviation should always have visible ownership and momentum.

Making the operative buyer responsible for technical root-cause analysis

Quality and Engineering may own deeper investigation.

The buyer coordinates procurement consequences.

Treating invoice blocks as procurement problems by default

AP, Receiving, suppliers and requesters may own the required correction.

Mixing supplier-performance KPIs with buyer-control KPIs

Measure supplier quality and invoice accuracy separately from internal deviation control.

Keeping completed deviations open

Close resolved cases so the backlog reflects current reality.

A practical monthly Deviation Management dashboard

A Basic-level dashboard might contain:

Measure	Result	Target
Quality Deviation Control Rate	93.3%	≥98%
Open Quality Deviations	6	Trend
Critical NCRs without action	1	0
Invoice Deviation Control Rate	95%	≥98%
Open Invoice Deviations	12	Trend
Invoice deviations beyond SLA	2	0
Supplier-caused NCR share	67%	Analyse
Supplier-caused invoice deviation share	42%	Analyse

The dashboard should then create questions:

Why was one critical NCR not actioned?

Which suppliers generate repeated NCRs?

Why are invoice deviations beyond SLA?

How many invoice blocks come from missing goods receipts?

Are PO price errors recurring?

Which function owns the largest share of the backlog?

Those questions create improvement.

Develop your knowledge with Operative Procurement Processes 3

Deviation Management is part of the broader operational purchasing process.

The LHTS Operative Procurement Processes 3 course provides the knowledge foundation for this article.

It connects topics including:

Purchase Order requirements
Order acknowledgement
Order management
Delivery discrepancies
Invoice discrepancies
Excess and obsolete material

Take Operative Procurement Processes 3 at Learn How to Source

For the supplier-performance perspective, continue with:

Supplier Performance KPIs – Supporting the Operative Buyer’s KPIs

Frequently asked questions about Deviation Management KPIs

What is deviation management in procurement?

Deviation Management is the process used to identify, assign, control and close exceptions that interrupt the normal purchasing flow.

Typical examples include quality NCRs and invoice discrepancies.

What is a Quality Deviation Control Rate?

It measures the percentage of quality deviations requiring procurement coordination that receive the required action within the applicable control SLA.

What is an Invoice Deviation Control Rate?

It measures the percentage of invoice deviations requiring procurement involvement that receive the required action within the applicable control SLA.

Should quality and invoice deviations use one KPI?

They can share one management framework, but their results should remain separate because their processes and resolution times differ.

Is the number of open deviations a buyer-performance KPI?

Not by itself.

Open deviations represent workload and operational exposure.

The number may be influenced heavily by supplier performance or other internal functions.

What is deviation ageing?

Deviation ageing measures how long an exception has remained open.

Ageing buckets are normally more useful than one average age.

What is the difference between control time and resolution time?

Control time measures how quickly the required buyer action occurs.

Resolution time measures how long the full issue takes to close.

The second measure may depend on several parties.

Is every NCR the supplier’s fault?

No.

Quality deviations may also result from transport, internal receiving, documentation handling or other causes.

Is every invoice block the supplier’s fault?

No.

PO errors, missing goods receipts, internal data and contract mismatches can also block invoices.

Should the operative buyer perform root-cause analysis?

The operative buyer may support the process, but technical root-cause analysis often belongs to Quality, Engineering or supplier-development functions.

The operative buyer should primarily ensure operational control and follow-up.

How should critical deviations be managed?

Critical deviations should receive faster action and appropriate escalation according to their business impact.

Can deviation management be automated?

Yes.

Systems can automate registration, routing, SLA alerts, ageing and escalation.

Human judgment is still needed for many exceptions.

Conclusion: An open deviation must have ownership and momentum

Quality and invoice deviations are normal parts of operational procurement.

The problem is not that deviations exist.

The problem begins when they become invisible, ownerless or inactive.

The recommended internal KPIs are:

Quality Deviation Control Rate (%) = Quality deviations correctly actioned within applicable SLA ÷ Quality deviations due for control × 100

and:

Invoice Deviation Control Rate (%) = Invoice deviations correctly actioned within applicable SLA ÷ Invoice deviations due for control × 100

Support them with:

Open Backlog
to understand workload.

Ageing and Criticality
to prioritize risk.

Resolution Lead Time
to understand cross-functional process health.

Reason and Ownership Distribution
to understand root causes.

Supplier NCR Rate and Invoice Accuracy
to understand supplier contribution.

The most important operating principle is:

An open deviation is not automatically an uncontrolled deviation.

And:

A deviation is not automatically the supplier’s fault.

When a deviation appears:

Identify it.

Assign ownership.

Understand the impact.

Take the required first action.

Define the next step.

Follow up.

Escalate when necessary.

Close it when resolved.

That is how Deviation Management becomes an effective operative procurement control rather than a growing list of unresolved problems.

Your next step

Review the open deviations in your own purchasing area.

Separate them into:

quality deviations;
invoice deviations.

Then ask:

Who owns each deviation?
What is the next action?
When is that action due?
Which deviations are critical?
Which have no current action?
Which suppliers create recurring NCRs?
Which invoice deviations are actually caused internally?
How many cases are beyond their applicable SLA?

Then look at the patterns.

Repeated supplier-caused quality and invoice deviations may indicate a broader supplier-performance problem.

Repeated internal deviations may indicate weaknesses in:

PO quality;
receiving;
master data;
Accounts Payable;
process design.

That insight is where Deviation Management starts contributing to continuous procurement improvement.