Digital Procurement Controls in Energy Enterprises: Purchase-Order Traceability, Invoice Reconciliation, and Supplier Payment Reliability

Full text

Text extracted from the article PDF for reading and search. Tables, figures and equations are in the PDF, which remains the authoritative version.

1. Introduction

Procurement is one of the largest controllable cost pools in any energy enterprise. Upstream oil and gas operators, refiners, power generators, transmission and distribution utilities and renewable developers all rely heavily on contractors, equipment vendors and service providers, and global energy investment has continued to rise as firms fund both conventional supply and the energy transition (International Energy Agency [IEA], 2023). Much of this spending flows through capital projects whose scale and complexity are notorious for cost overruns and weak financial control (Flyvbjerg, 2014; Merrow, 2011). Applied studies of engineering, procurement and construction (EPC) and gas processing projects likewise place procurement and supply risk at the centre of project delivery in the sector (Agbabiaka et al., 2019; Ogunwole et al., 2021). In such an environment, the reliability of the procure-to-pay cycle, from requisition and purchase order (PO) to goods receipt, invoice and payment, is not a back-office detail. It is a determinant of cost discipline, fraud exposure, regulatory standing and the health of the supplier base.

Three control problems recur across the literature. The first is traceability: the inability to link a payment back to an approved need, a competitively awarded commitment and a verified receipt. Spend that bypasses POs ("maverick" or after-the-fact purchasing) weakens both cost control and transparency (Presutti, 2003; Croom & Brandon-Jones, 2007). The second is reconciliation: invoices that are not systematically matched against POs and receipts create opportunities for overbilling, pricing errors and fictitious charges. The third is payment reliability: payments may be duplicated, misdirected, inaccurate or late. Duplicate and erroneous payments represent direct financial leakage and are a recognised fraud vector (Association of Certified Fraud Examiners [ACFE], 2022), while late payment shifts financing burdens onto suppliers, particularly small firms, and damages relationships (Murfin & Njoroge, 2015; Barrot, 2016).

Digitalisation promises remedies to all three problems. Electronic procurement (e-procurement) suites, integrated enterprise resource planning (ERP) systems, electronic invoicing, robotic process automation (RPA), artificial intelligence (AI), process mining and distributed ledger technology (DLT) have each been proposed as means of enforcing controls, generating evidence and accelerating payment (Bienhaus & Haddud, 2018; Srai & Lorentz, 2019; Guida et al., 2023). Work from emerging economies adds frameworks for automating procurement workflows to improve transparency and for integrating information systems engineering with supply chain operations (Akinleye & Adeyoyin, 2021; Okonkwo et al., 2023a). Digital supply chain research situates these tools within broader capabilities for integration, analytics and risk management (Rai et al., 2006; Büyüközkan & Göçer, 2018; Ivanov et al., 2019). Yet the relevant scholarship is scattered across disciplines. Purchasing and supply management research focuses on adoption and performance; accounting information systems and auditing research focuses on controls, assurance and analytics; public procurement research focuses on transparency and corruption; and energy management research focuses on project delivery and digital operations. Few studies connect these streams, and fewer still address the specific conditions of energy enterprises. This paper addresses that gap through an integrative review. To the authors' knowledge, it is the first review to bring P2P control evidence from accounting information systems, auditing, purchasing and supply management and public procurement together with the specific operating conditions of energy enterprises, and the first to link internal control outcomes explicitly to supplier payment reliability and relationship quality in this sector. It also draws systematically on applied studies from emerging economies, where much energy procurement now takes place but which are rarely represented in mainstream reviews. Its objectives are to: (a) synthesise what is known about digital controls for PO traceability, invoice reconciliation and supplier payment reliability; (b) examine how these controls support procurement transparency, duplicate-payment detection and robust audit trails; (c) assess how payment reliability relates to supplier relationships; (d) interpret the findings in light of the characteristics of energy enterprises; and (e) propose a conceptual model and research agenda. The guiding review questions are: • RQ1: How do digital procurement controls establish purchase-order traceability and procurement transparency? • RQ2: What digital mechanisms support invoice reconciliation and the prevention and detection of duplicate or erroneous payments? • RQ3: How do digital audit trails, continuous auditing and emerging technologies strengthen assurance over the procure-to-pay cycle? • RQ4: How does supplier payment reliability relate to supplier relationship quality and supply-base performance? • RQ5: Which features of energy enterprises condition the design and effectiveness of these controls?

The remainder of the paper is organised as follows. Section 2 describes the methodology. Section 3 presents the literature synthesis, beginning with the theoretical lenses and the energy-sector context and then addressing each review question in turn. Section 4 develops a conceptual model that integrates the findings. Section 5 discusses the findings, Section 6 sets out theoretical and practical implications, Section 7 notes the limitations of the review, Section 8 outlines directions for future research and Section 9 concludes.

2. Methodology

2.1. Review Design

An integrative review was selected because the topic draws on heterogeneous evidence: conceptual frameworks, design science artefacts, field studies, surveys, case studies, standards and professional reports. Integrative reviews are suited to synthesising such diverse sources to generate new frameworks and perspectives on mature but fragmented topics (Torraco, 2005; Snyder, 2019). The review followed the five stages described by Whittemore and Knafl (2005): problem identification, literature search, data evaluation, data analysis and presentation. Reporting was informed by, though not bound to, the transparency principles of PRISMA 2020 (Page et al., 2021), since PRISMA was designed primarily for systematic reviews of intervention studies.

2.2. Search Strategy and Sources

Sources were identified through structured keyword searches of major bibliographic databases and publisher platforms, through screening of an author-supplied consolidated seed list of applied studies, and through backward and forward citation chaining from seminal works in continuous auditing, process mining, e-procurement and supply chain finance. Professional and regulatory sources (internal control frameworks, auditing standards, anti-corruption standards and fraud surveys) were included because practice in this field is heavily shaped by such documents. Table 1 summarises the review protocol.

Table 1: Review protocol Element Specification Search strings Combinations of: "e-procurement", "procure-to-pay", "purchase order", "three-way match", "invoice reconciliation", "duplicate payment", "audit trail", "continuous auditing", "process mining", "blockchain", "supplier payment", "trade credit", "supplier relationship", "oil and gas", "energy", "utility" Databases and platforms Scopus, Web of Science, ScienceDirect, Emerald Insight, Taylor & Francis Online, Wiley Online Library, IEEE Xplore, AAA digital library, Google Scholar (for citation chaining) Seed list Author-supplied consolidated reference list screened by title and abstract against the review questions; 150 entries dated 2023 or earlier retained as directly related or semi-related (for example, cybersecurity, data governance and asset management studies that bear on control infrastructure), emphasising energy-sector procurement, internal control, audit, fraud analytics, payments and supplier management studies from emerging economies Grey and professional literature COSO, IIA, PCAOB, ACFE, OECD, EITI, ISO, IEA and European Union legislative texts Time frame 2000 to 2023, with earlier foundational theory admitted where it underpins the synthesis Inclusion criteria English language; addresses at least one of: P2P controls, procurement digitalisation, invoice or payment controls, audit trails and assurance, payment behaviour and supplier relationships, or energy-sector procurement and digitalisation Exclusion criteria Purely technical system descriptions without control or organisational implications; opinion pieces without evidential or conceptual contribution; duplicate versions of the same study Quality appraisal Peer-reviewed status or issuing authority; clarity of method; relevance to review questions; contribution to theory or practice (adapted from Whittemore & Knafl, 2005) Analysis Thematic coding by review question, constant comparison across disciplines, and integration into a conceptual framework

2.3. Composition of The Synthesis Set

The final synthesis set comprises the 275 sources listed in the reference section: 125 identified through database searching and citation chaining (Panel A of Table 2) and 150 retained from the seed list (Panel B). The spread confirms the interdisciplinary character of the topic: no single field contributes a majority of the evidence. Applied studies from the seed list strengthen coverage of energy-sector procurement and of emerging-economy settings such as Nigeria and wider Sub-Saharan Africa, although most of them are conceptual frameworks rather than empirical tests, which itself is a finding of the review.

Table 2: Composition of the synthesis set (N = 275) Stream or cluster Sources Representative works Panel A. Database-searched literature 125 Review methodology 4 Whittemore & Knafl (2005); Torraco (2005); Snyder (2019) Theory (agency, transaction cost, relational) 4 Jensen & Meckling (1976); Williamson (1985); Dyer & Singh (1998) E-procurement and digital supply chains 21 Presutti (2003); Mishra et al. (2007); Bienhaus & Haddud (2018); Guida et al. (2023)

Blockchain and distributed ledgers 17 Dai & Vasarhelyi (2017); Yermack (2017); Kumar et al. (2020) Supplier relationships, trade credit and supply chain finance 16 Terpend et al. (2008); Murfin & Njoroge (2015); Caniato et al. (2016) Public procurement and corruption 6 Olken (2007); Fazekas & Kocsis (2020); Ashore-Onisemo & Unamma (2022)

Energy sector, megaprojects and local content 12 Merrow (2011); Flyvbjerg (2014); Asibor & Isong (2019); Asibor et al. (2023)

Standards, regulation and legislation 9 COSO (2013); IIA (2020); OECD (2016); EITI (2023) Panel B. Seed-list literature 150 Energy-sector procurement, contracts and supply chains 20 Okonkwo et al. (2018a); Okonkwo et al. (2021b); Uchechi et al. (2020)

Energy operations, asset integrity and safety governance 23 Obetta et al. (2023); Adaramola et al. (2018); Obogo et al. (2020a) Procurement, supplier management and supply chain analytics 26 Akinleye & Adeyoyin (2021); Nnabueze et al. (2021); Akin-Oluyomi et al. (2023c)

Internal control, audit, compliance and fraud analytics 32 Dogbatsey et al. (2019); Mbonu et al. (2022); Akomolafe & Agu (2019a)

Payments, treasury, blockchain and financial analytics 24 Akomolafe et al. (2022); Adesuyi et al. (2023a); Dada et al. (2021) Cybersecurity, data governance and enterprise IT 25 Mbonu et al. (2019b); Adegbite et al. (2022); Ominyi & Anichukwueze (2022)

Counts reflect the primary stream or cluster to which each source contributes; many sources inform more than one theme. Seed-list sources classed as semi-related were retained where they inform the technical, organisational or sectoral conditions under which procurement controls operate.

2.4. Analysis

Each source was coded against the five review questions and against a set of control concepts derived from the COSO (2013) internal control framework, namely control environment, risk assessment, control activities, information and communication, and monitoring. Findings were then compared across streams to identify convergence, divergence and gaps. The synthesis is presented thematically in the literature synthesis (Section 3) and then integrated into a conceptual model (Section 4).

3. Literature Synthesis

This section synthesises the literature in two steps. Sections 3.1 and 3.2 set out the theoretical lenses and the energy-sector context that frame the review. Sections 3.3 to 3.7 then address the review questions: Section 3.3 addresses RQ1, Sections 3.4 and 3.5 address RQ2, Section 3.6 addresses RQ3 and Section 3.7 addresses RQ4. RQ5, on the conditioning role of the energy context, is addressed throughout and drawn together in Sections 4 and 5.

3.1. Theoretical Lenses

Four theoretical lenses recur in the literature and together explain why digital P2P controls matter. Agency theory. Procurement involves layered agency relationships: shareholders or the state delegate to managers, managers delegate to buyers and project staff, and the firm contracts with suppliers. Information asymmetry enables opportunism, including collusion, kickbacks and inflated invoices (Jensen & Meckling, 1976). Digital controls reduce asymmetry by recording commitments and receipts in systems that principals and auditors can inspect, and by constraining discretion through workflow rules and segregation of duties. Field evidence confirms that monitoring and audit reduce leakage in public spending and procurement, and that much waste is passive rather than corrupt (Olken, 2007; Bandiera et al., 2009). Transaction cost economics. Williamson (1985) emphasises that monitoring and enforcement are costly. Manual matching, paper invoices and dispute resolution consume resources on both sides of the buyer–supplier dyad. Digitalisation lowers these transaction costs and makes tighter monitoring economically feasible, which helps explain the attraction of automated matching and continuous monitoring (Bienhaus & Haddud, 2018).

Internal control theory. The COSO (2013) framework and the Institute of Internal Auditors' Three Lines Model (IIA, 2020) treat P2P as a classic domain of control activities: authorisation, segregation of duties, reconciliation and review. In firms subject to the Sarbanes-Oxley Act of 2002 and PCAOB Auditing Standard 2201 (Public Company Accounting Oversight Board [PCAOB], 2007), these controls must also be documented and tested. Digital systems shift controls from detective to preventive and from sample-based to population-based (Vasarhelyi et al., 2004). Risk-based internal control and audit models extend these frameworks by directing control effort to the highest-risk transactions (Akomolafe & Agu, 2019a; Akomolafe et al., 2023a), and comparative reviews show how SOX-style control expectations are being adapted in cross-border settings (Agu et al., 2023). Empirical accounting research links internal control weaknesses to poorer accrual quality and traces them to complexity, rapid change and limited resources (Doyle et al., 2007; Ashbaugh-Skaife et al., 2008). Applied models for technology-enabled internal audit, data-driven risk evaluation, integrated governance and compliance risk assessment in emerging economies extend this line (Akomolafe & Agu, 2018; Akomolafe & Agu, 2019b; Akomolafe & Agu, 2019c; Akomolafe et al., 2023b), as do ethics and compliance training frameworks that address the behavioural side of control (Anichukwueze et al., 2020). Relational view and commitment-trust theory. Buyer– supplier relationships generate value when partners invest in trust and relation-specific routines (Dyer & Singh, 1998). Reliable, predictable conduct by the buyer, including on-time and accurate payment, is a precondition for trust and commitment (Morgan & Hunt, 1994; Terpend et al., 2008). Trust in buyer–supplier relationships rests on perceived credibility and benevolence, both of which are shaped by observed behaviour over time (Doney & Cannon, 1997). This lens connects internal control quality to external relationship outcomes, a link that the auditing literature rarely makes explicit.

3.2. Procurement in Energy Enterprises

Several characteristics distinguish procurement in energy enterprises and condition the controls reviewed here. Capital and project intensity. Exploration, field development, generation plants and grid projects involve multi-year engineering, procurement and construction (EPC) contracts, variation orders, milestone billing and retentions. These arrangements complicate matching, because the "receipt" may be a certified progress measurement rather than a delivered item, and because contract values evolve. Megaproject research documents systematic overruns and governance weaknesses that make strong commitment control especially valuable (Merrow, 2011; Flyvbjerg, 2014). In upstream petroleum, misalignment between capital budgeting and field development execution compounds this problem (Nwangwu et al., 2021). Technical due diligence on energy acquisitions shows that inherited supply contracts and vendor bases are a recurring integration risk (Nwangwu et al., 2023).

Operational spend and maintenance. Alongside capital spend, energy firms process very high volumes of maintenance, repair and operations (MRO) purchases, field services and logistics. High volume and urgency create pressure for emergency purchases and after-the-fact POs, which weaken traceability. Applied frameworks for oil and gas procurement stress that strategic sourcing and vendor governance must be paired with contract-level cost control if these pressures are not to erode value (Okonkwo et al., 2018a; Okonkwo et al., 2019). Materials readiness, inventory availability and asset lifecycle visibility are closely tied to plant uptime (Okonkwo et al., 2021a; Okonkwo et al., 2018b; Okonkwo et al., 2023b), and maintenance management for static equipment, risk-based inspection, reliability-centred maintenance and integrity assurance generate continuous demand for services and spares (Obetta, 2018; Obetta, 2019; Obetta, 2020; Obetta et al., 2021; Obetta et al., 2023). Predictive and condition-based maintenance, non-destructive testing and inspection quality assurance in power and process plants create similar demand for specialist services whose delivery must be evidenced before payment (Adaramola et al., 2018; Atta et al., 2022; Atta et al., 2020; Sunday et al., 2020). Port logistics delays and demurrage add further cost lines that must be reconciled against contracts (Okonkwo et al., 2020). Gas infrastructure adds further layers of specialised spend. Risk-based process engineering, HAZOP and reliability analysis for critical energy infrastructure, flare-gas recovery and methane emissions reduction programmes all depend on specialist contractors and equipment vendors whose services must be specified, verified and paid against technical acceptance criteria (Asibor & Isong, 2019, 2020; Asibor & Olisakwe, 2022; Asibor et al., 2023). Because many of these programmes respond to environmental and safety regulation, their procurement records also serve as evidence of regulatory compliance. System fragmentation. Mergers, joint ventures and operator-partner arrangements often leave energy groups with multiple ERP instances, separate project control systems and inconsistent vendor master files. Fragmentation is a known precondition for duplicate vendors and duplicate payments, and it complicates the construction of end-to-end audit trails (Lu et al., 2019).

Joint ventures and cost recovery. In upstream oil and gas, operators charge costs to non-operating partners under joint operating agreements and, in many jurisdictions, recover costs from host governments under production sharing contracts. Partners and governments therefore audit operator spending, raising the stakes for traceable, well-documented procurement. Finance leadership in such joint ventures must reconcile partner reporting, cash calls and cross-border obligations (Isiekwu et al., 2021). Energy service contracts also carry complex liability, force majeure and statutory compliance provisions that shape what may be invoiced and when (Uchechi & Ominyi, 2019; Uchechi et al., 2020; Ominyi et al., 2020; Uchechi & Ominyi, 2020), and shared-responsibility models extend these obligations across multi-jurisdictional supply chains (Ominyi et al., 2021). Standardised statutory bidding workflows have been proposed to reduce discretion in emerging-market tendering (Uchechi et al., 2019).

Public ownership and transparency obligations. Many energy enterprises are state-owned or state-controlled and are subject to public procurement rules and extractive-industry transparency regimes. The EITI Standard (EITI, 2023) and OECD guidance on integrity in public procurement (OECD, 2016) both emphasise disclosure, traceable contracting and data-driven oversight. Data-driven red-flag methods developed in public procurement research are directly relevant to state-owned energy firms (Fazekas & Kocsis, 2020; Lyra et al., 2022). Frameworks for regulatory-compliant procurement in high-risk energy environments emphasise documented approvals, sanctions and integrity screening, and auditable contract records (Okonkwo et al., 2021b). Local-content regimes, such as Nigeria's Oil and Gas Industry Content Development Act, add supplier-development obligations to procurement and make the treatment of domestic suppliers a matter of regulatory compliance (Nigerian Oil and Gas Industry Content Development Act, 2010; Tordo et al., 2013; Ovadia, 2016). Digital operations maturity. The energy sector has invested heavily in operational technologies such as digital twins, sensors and predictive maintenance (Lu et al., 2019; Wanasinghe et al., 2020). Applied studies of UAV and GIS-based asset monitoring, digital twins for substations, smart grid architectures and predictive diagnostics for renewable assets illustrate the breadth of operational data now available (Dagodzo & Ahiaeke Patrick, 2020; Dagodzo & Ahiaeke Patrick, 2021; Dagodzo & Ahiaeke Patrick, 2023; Shittu et al., 2023; Adenuga, 2022; Komi & Adamolekun, 2021; Komi & Adeniji, 2023), and work on produced water risk shows the same pattern elsewhere in the value chain (Falegan & Aniebonam, 2022). Multi-contractor operations also require governance of contractor performance and compliance, a theme well developed in the safety literature, where internal QHSE audits and contractor compliance systems offer transferable lessons for procurement assurance (Nwangwu et al., 2018; Arumosoye & Obriki, 2020; Obogo et al., 2020a; Obogo et al., 2020b; Obogo et al., 2021; Obriki & Arumosoye, 2018). These capabilities create opportunities, for example using sensor or work-order data as evidence of service receipt, but the review found that finance and procurement digitalisation has received far less scholarly attention than operational digitalisation in the sector.

3.3. Purchase-Order Traceability and Procurement

Transparency The literature consistently treats the PO as the anchor document of procurement control. A PO records an authorised commitment, links it to a budget or project cost code, and provides the reference against which receipts and invoices are later compared. Early e-procurement research reported that electronic requisitioning and cataloguing reduced maverick spending and transaction costs, and increased compliance with negotiated contracts (Presutti, 2003; Croom & Brandon-Jones, 2007). Adoption studies identify perceived benefits, organisational readiness and supplier capability as drivers of e-procurement use, and show that internet-based procurement improves process efficiency and visibility (Mishra et al., 2007; Gunasekaran & Ngai, 2008). Public-sector studies identified top management support, user adoption, supplier participation and system integration as determinants of e-procurement success (Vaidya et al., 2006).

Traceability depends on the continuity of identifiers across the process. When requisitions, POs, goods or service receipts, invoices and payments share linked keys in an integrated ERP, every payment can be traced backward to its authorisation and forward to its accounting entry. Process mining research shows that event logs from such systems allow the actual path of each transaction to be reconstructed and compared against the designed process, revealing variants such as invoices posted before POs, POs created after receipt or approvals by unauthorised users (Jans et al., 2013, 2014; van der Aalst, 2016). These variants are the operational signature of weak traceability. End-to-end visibility frameworks make a similar argument from the supply chain side: transparency, compliance and traceability depend on linked data across every stage of the chain (Nnabueze et al., 2021). Applied ERP studies propose enriching procurement records with location and asset data so that commitments can be tied to specific sites and facilities, a feature of particular value for dispersed energy assets (Ahiaeke Patrick et al., 2020).

Transparency has an internal and an external dimension. Internally, traceability allows managers and auditors to see who committed what, when and on what basis. Externally, it allows regulators, partners and the public to see how contracts are awarded and paid. The public procurement literature links e-procurement adoption to reduced corruption opportunities, mainly by reducing discretionary face-to-face interaction and creating permanent records (Neupane et al., 2014). Field evidence from public works in India and Indonesia shows that e-procurement improved the quality of delivered infrastructure (Lewis-Faupel et al., 2016). Data-driven corruption-risk indicators such as single bidding, short advertisement periods and unusual contract modifications depend on structured, traceable procurement data (Fazekas & Kocsis, 2020; Lyra et al., 2022). Predictive analytics applied to anti-corruption and public financial oversight extends this logic from rule-based red flags to risk scoring of transactions, contracts and suppliers, an approach directly applicable to state-owned energy enterprises subject to public audit (Ashore-Onisemo & Unamma, 2022).

More recent work frames digital procurement as part of Industry 4.0 or "Procurement 4.0". These studies emphasise integration, real-time data and analytics as drivers of transparency and performance (Glas & Kleemann, 2016; Bienhaus & Haddud, 2018; Nicoletti, 2020; Gottge et al., 2020). Systematic reviews confirm the growing interest but note that empirical evidence on control outcomes, as distinct from efficiency outcomes, remains limited (Jahani et al., 2021; Seyedghorban et al., 2020). Hallikas et al. (2021) provide survey evidence that procurement analytics capability is associated with improved supply chain performance, partly through better visibility. Related applied work shows that process automation and data visualisation make procurement status and exceptions visible to decision makers, and that data-driven vendor evaluation supports more transparent bid selection (Akinleye & Adeyoyin, 2021; Babatope et al., 2023; Ahiaeke Patrick et al., 2021). Supply chain analytics research more broadly shows that predictive analytics and AI improve visibility and decision quality (Schoenherr & Speier-Pero, 2015; Sanders et al., 2019). Applied procurement studies from emerging economies propose negotiation optimisation, big data and business intelligence, comparative cost optimisation and supplier sustainability metrics as means of making procurement decisions more transparent and evidence-based (Akinleye & Adeyoyin, 2022a; Akinleye et al., 2023; Akokodaripon et al., 2023; Akin-Oluyomi et al., 2023c), alongside green and sustainable procurement frameworks and automated ESG reporting that add environmental criteria to the audit trail (Akin-Oluyomi et al., 2023a; Efobi et al., 2022; Okojie et al., 2020; Abioye et al., 2023). Supplier risk assessment and chain-of-custody traceability models from regulated pharmaceutical supply chains offer transferable designs (Akin-Oluyomi et al., 2023b; Aneke & Adesemoye, 2019). Supply chain governance, analytics and leadership models emphasise that traceability requires aligned performance indicators and governance across sites (Akin-Oluyomi & Akhigbe, 2022; Akin-Oluyomi & Akhigbe, 2023a; Akin-Oluyomi & Akhigbe, 2023b; Sakyi et al., 2022), and forecasting, lean, resilience and predictive logistics studies show how the same data support planning and risk management (Aifuwa et al., 2020; Ike et al., 2022; Anene, 2021; Efobi et al., 2023; Anene & Clement, 2022). For energy enterprises, three traceability challenges stand out: services procurement, where receipt confirmation is subjective; emergency and field purchases that are regularised after the fact; and EPC contracts with evolving values. The literature suggests that the most effective responses combine policy (no PO, no pay), workflow enforcement in systems, and analytics that monitor after-the-fact POs and contract variations as risk indicators.

3.4. Invoice Reconciliation and Matching Controls

Invoice reconciliation in the P2P cycle is normally implemented as two-way matching (invoice against PO) or three-way matching (invoice against PO and goods or service receipt), sometimes extended to four-way matching that includes inspection or quality acceptance. Matching operates within tolerance rules for price and quantity. It is the principal preventive control against overbilling, billing for undelivered items and pricing errors, and it is a standard expectation within control frameworks (COSO, 2013). ERP research shows that integrated systems standardise process data and can strengthen internal control over financial reporting (Davenport, 1998; Grabski et al., 2011; Morris, 2011). Digitalisation affects reconciliation in three ways. First, data capture has moved from manual keying to optical character recognition (OCR) and, increasingly, structured electronic invoicing. Structured e-invoices remove capture errors and allow matching rules to be applied immediately. Second, automation through ERP matching engines and RPA executes matching at scale, routes exceptions and records every decision (Moffitt et al., 2018; Huang & Vasarhelyi, 2019). Conceptual work on emerging-market organisations argues that automating reconciliation is most effective when the surrounding financial workflow is redesigned, rather than when legacy manual steps are simply digitised (Dogbatsey et al., 2019). At group level, automated consolidation models extend the same logic to inter-company balances and transparency across subsidiaries (Bola-Sadipe et al., 2023). RPA studies describe bots as suited to rule-based, high-volume tasks such as invoice handling, but warn of governance and exception-handling challenges (van der Aalst et al., 2018; Cooper et al., 2019; Syed et al., 2020). Applied models for standardising reporting and decision workflows, managing change in digital transformation and governing data integration address the organisational preconditions of reliable matching (Alieme et al., 2022; Agboada et al., 2018b; Eyetsemitan et al., 2023; Badmus et al., 2019). Data integrity and corrective-action research from regulated life sciences reinforces the point that reconciliation depends on trustworthy source records and on closing out exceptions (Aneke et al., 2023; Aneke et al., 2022), and contract review standardisation adds an upstream safeguard by ensuring that the contract terms used in matching are accurate (Uchechi et al., 2021). Financial reporting, strategic accounting and data-driven cost management models link reconciliation quality to the transparency of reported results (Bola-Sadipe et al., 2019; Medon & Oduleye, 2022; Oduleye & Medon, 2021; Adesuyi et al., 2023b). Third, intelligence through machine learning supports exception classification, coding prediction and anomaly scoring (Handfield et al., 2019; Guida et al., 2023), extending the broader shift toward automated, AI-supported assurance described by Kokina and Davenport (2017). The literature also identifies limits. Tolerance settings involve a trade-off between control and efficiency: generous tolerances speed payment but allow leakage, while tight tolerances create exception queues that delay suppliers. Automation can embed flawed rules and propagate errors at speed, and RPA bots require their own access controls and change management (Huang & Vasarhelyi, 2019). Matching is also only as good as the receipt record. Where receipts are entered by the same person who raised the PO, or are posted in bulk to clear blocked invoices, three-way matching becomes a formality. Process mining studies have documented exactly such patterns in real P2P logs (Jans et al., 2014; Werner & Gehrke, 2015).

In energy settings, the receipt problem is acute for services and construction. Progress certificates, timesheets and job tickets serve as the evidence of receipt, and these are vulnerable to inflation. The review found little academic research on digital evidence of service delivery in energy projects, although the operational technology literature suggests that work-order systems, field mobility tools and sensor data could provide independent corroboration (Wanasinghe et al., 2020).

3.5. Duplicate-Payment Detection and Payment Analytics

Duplicate payments arise from honest error, such as an invoice received twice through different channels, an invoice re-keyed with a slightly different number, a supplier present twice in the vendor master or a manual payment followed by a system payment. They also arise from fraud, where a duplicate is deliberately induced and the second payment diverted. Billing schemes, including duplicate and inflated invoices, consistently feature among the common forms of occupational fraud (ACFE, 2022).

The literature describes a layered defence. Preventive controls include vendor master governance (unique tax identifiers, bank account validation and segregation of master-data changes from payment processing), system duplicate checks at invoice entry and structured e-invoicing with unique identifiers. Detective controls include periodic or continuous analytics over payment data. Forensic analytics literature describes tests that search for exact and near duplicates, the so-called "same-same-different" tests, where amount and vendor match but invoice number or date differs slightly, as well as Benford's Law tests, round-number analysis and relative size factors (Nigrini, 2012, 2020). Table 3 summarises the principal techniques.

Table 3: Digital techniques for duplicate and erroneous payment detection Technique What it detects Strengths Limitations System duplicate check at entry Exact repeat of vendor, invoice number and amount Preventive; low cost Bypassed by small variations in invoice number or vendor ID Fuzzy matching (same-same-different)

Near duplicates: altered invoice numbers, swapped dates, duplicate vendors Catches common errors and simple fraud False positives; needs tuning and review (Nigrini, 2020)

Vendor master analytics Duplicate vendors, shared bank accounts, employee–vendor matches Addresses root cause Depends on master-data quality Benford's Law and digit tests Anomalous number distributions in invoices Population-level screening Indicative only; not evidence of fraud (Nigrini, 2012)

Rule-based red flags Split purchases, after-the-fact POs, threshold avoidance Transparent, auditable logic Static; can be learned and evaded Machine learning anomaly detection Unusual combinations of attributes Adapts to complex patterns Opaque; labelled fraud data scarce (West & Bhattacharya, 2016)

Process mining conformance checking Deviant paths, missing approvals, payment before receipt Uses full event history Requires clean event logs (Jans et al., 2014)

Recovery audit Overpayments already made Recovers cash Detective only; after the event Academic research on fraud detection more broadly confirms that data mining and machine learning techniques can identify anomalous transactions, but it also highlights high false-positive rates and the scarcity of labelled fraud cases (Ngai et al., 2011; West & Bhattacharya, 2016). Baader and Krcmar (2018) show that combining red-flag rules with process mining reduces false positives in P2P fraud detection, illustrating the value of combining transaction attributes with process context. Continuous data-level auditing systems apply such analytics to every transaction rather than to samples (Kogan et al., 2014). Recent reviews of machine learning for financial fraud detection report similar trade-offs between detection power and interpretability (Atakpa & Abetoh, 2022), and predictive analytics models for public systems show how risk scores can prioritise review of payments in state-linked entities (Adelanwa et al., 2023b). Data-driven procurement risk frameworks for multinational enterprises integrate such signals with supplier and contract risk indicators (Bello et al., 2023). Statistical and machine learning studies of financial fraud show that ensemble and meta-learning methods can outperform single classifiers (Perols, 2011; Abbasi et al., 2012), and data mining and process mining case studies demonstrate the detection of internal transaction fraud in procurement processes (Jans et al., 2010, 2011). Applied studies extend these methods with anomaly detection for financial time series, anti-money laundering analytics, cybersecurity-integrated financial crime governance and forensic analysis of communications data (Atakpa & Fobellah, 2023; Atakpa, 2021; Fadayomi et al., 2021; Mbonu et al., 2021b), while privacy-preserving analytics architectures address the data-protection limits on such monitoring (Atakpa & Abolaji, 2022). Machine learning methods for cyber threat and anomaly detection offer transferable techniques for flagging unusual payment patterns, such as sudden changes to supplier bank details or bursts of manual payments, which often signal account takeover or payment diversion (Okwesa et al., 2020). Fraud exposure analytics, anti-money laundering and anti-bribery regimes, transfer pricing risk and tax governance provide further rule sets that overlap with payment analytics in multinational energy groups (Eboh & Aliliele, 2023; Ominyi & Anichukwueze, 2021; Lawal & Oduleye, 2019a; Lawal & Oduleye, 2018), and budget compliance research from Sub-Saharan Africa shows that such controls often operate in weak institutional settings (Dogbatsey & Ebhojie, 2018). A notable gap is the absence of rigorous, peer-reviewed estimates of duplicate-payment prevalence. Most quantitative claims come from vendors and recovery audit firms, whose figures are not independently verified. This review therefore does not cite a prevalence rate. Energy enterprises are plausibly at elevated risk because of high invoice volumes, multiple ERPs and large vendor bases, but this remains a proposition for empirical testing rather than an established finding.

3.6. Audit Trails, Continuous Auditing and Emerging

Technologies An audit trail is the chronological, attributable record of who did what to which transaction and when. In digital P2P systems, audit trails exist at two levels: document-level records (the PO, receipt, invoice and payment) and event-level logs (creation, change and approval events with user and timestamp). The continuous auditing literature argues that event-level data allow assurance to move from periodic, sample-based testing to continuous, population-based monitoring (Vasarhelyi et al., 2004; Alles et al., 2008). Earlier work introduced embedded audit modules and automated monitoring (Rezaee et al., 2002), and the Siemens pilot showed how business process controls could be monitored continuously (Alles et al., 2006). Chan and Vasarhelyi (2011) describe how continuous auditing changes the timing and nature of audit work. Pilot implementations showed that continuous monitoring of P2P controls was feasible but required substantial work on data extraction, rule design and exception handling (Alles et al., 2008). Process mining extends this approach by treating event logs as a complete record of process execution. Jans et al. (2013) set out the value of process mining for auditors, and Jans et al. (2014) demonstrated in a field study of a procurement process that process mining identified control deviations, such as payments without approval and segregation-of-duties violations, that traditional procedures did not reveal. Werner and Gehrke (2015) developed multilevel process mining for financial audits. Appelbaum et al. (2017) identified big data and analytics as a key research need in the modern audit. Reviews of real-time compliance pipelines describe how automated monitoring and enterprise data governance can feed such analytics continuously (Uchechi et al., 2022). Evidence on audit liaison and corrective action planning adds that detected exceptions only improve control when findings are tracked to closure (Ebhojie et al., 2023). Big data research identifies both new evidence sources and behavioural challenges for auditors (Brown-Liburd et al., 2015), and AI is expected to formalise and supplement audit tasks (Issa et al., 2016).

The integrity of the audit trail is itself a control concern. Logs can be incomplete, privileged users may alter records, and data migration between systems can break linkages. Distributed ledger technology has been proposed as a means of producing tamper-evident, shared records across organisational boundaries. Dai and Vasarhelyi (2017) argued that blockchain could support real-time, verifiable accounting and assurance, and Rozario and Vasarhelyi (2018) explored smart contracts that encode audit procedures. Wang and Kogan (2018) proposed confidentiality-preserving designs for blockchain-based transaction processing. Applied architectures propose blockchain-based recordkeeping to provide tamper-evident regulatory records and real-time audit readiness (Anichukwueze et al., 2021), and similar audit-trail models have been designed for configuration and compliance logs (Oshoba et al., 2020). Accounting scholars debate whether blockchains can serve an accounting purpose and how they alter audit (Coyne & McMickle, 2017; Kokina et al., 2017; Schmitz & Leoni, 2019), and governance research notes that they change transparency for shareholders and regulators (Yermack, 2017). In supply chain research, blockchain has been linked to traceability, transparency and trust (Kshetri, 2018; Saberi et al., 2019; Wang et al., 2019). However, the literature is cautious. Reviews identify technical, organisational and inter-organisational barriers, including scalability, governance, interoperability and the "oracle problem" of ensuring that data entered on a ledger reflect reality (Kumar et al., 2020; Kouhizadeh et al., 2021). Supply chain studies add theory-driven research agendas and empirical evidence on adoption drivers (Treiblmaier, 2018; Cole et al., 2019; Queiroz & Fosso Wamba, 2019). Bonsón and Bednárová (2019) note that blockchain may change the nature of audit work but does not remove the need for judgement about the underlying transactions. In the energy sector, Andoni et al. (2019) found that most blockchain applications concerned energy trading and metering rather than procurement, and that many remained at pilot stage. The review therefore treats DLT as a promising complement to, not a replacement for, well-governed ERP audit trails. Whatever the ledger technology, audit-trail integrity depends on the surrounding IT controls. Applied work on AI-enabled IT general controls and SOX audit automation is directly relevant, because P2P logs are only as reliable as the access and change controls around the ERP (Mbonu et al., 2022). Risk-based business intelligence, enterprise log analytics, cloud misconfiguration monitoring, identity and access governance and zero-trust architectures provide the technical foundations for trustworthy logs (Mbonu et al., 2021a; Mbonu et al., 2019b; Aliliele et al., 2023; Mbonu et al., 2020a; Oshoba et al., 2019; Ogbole et al., 2021b). Data protection regulation, impact assessment, privacy-centric security engineering and harmonised compliance across GDPR and NDPR determine what payment and supplier data can be retained and analysed (Mbonu et al., 2018; Mbonu et al., 2019a; Ominyi & Anichukwueze, 2022; Okoruwa et al., 2020). Security audit, threat intelligence, insider-threat and cybersecurity governance models address the risk that privileged users manipulate records (Dosunmu & Ogundele, 2019; Dosunmu & Ogundele, 2021; Akeju et al., 2018; Fadayomi et al., 2019; Jimoh et al., 2023), while studies of OT security, IT/OT convergence and SCADA threat detection in energy networks show that procurement and operational systems increasingly share infrastructure (Adegbite et al., 2020; Adegbite et al., 2022; Adegbite et al., 2023). Attribute-based encryption for smart supply chains and agile supply chain transformation with embedded IT risk controls illustrate secure designs for shared procurement data (Shittu & Nabil, 2023; Mbonu et al., 2020b). IT service management, continuous performance dashboards and lifecycle performance models support the operation of these systems (Ladapo et al., 2023; Ogbole et al., 2021a; Adelanwa et al., 2023a). Finally, algorithmic accountability, model risk management and fairness and bias auditing apply to AI matching and fraud models, which can otherwise treat some suppliers or transactions systematically more harshly than others (Ominyi & Anichukwueze, 2023; Unamma & Ashore-Onisemo, 2023), and standardised compliance controls help make automated rules auditable (Uchechi et al., 2023).

3.7. Supplier Payment Reliability and Supplier

Relationships Payment reliability has three components: accuracy (the right amount to the right party), timeliness (payment on or before the agreed date) and predictability (consistent behaviour that suppliers can plan around). The supply chain finance literature emphasises that payment terms and behaviour shape working capital across the chain (Hofmann & Kotzab, 2010; Wuttke et al., 2013; Gelsomino et al., 2016). On the buyer side, predictive cash-flow and working-capital models show how payment runs can be planned to balance liquidity with supplier commitments (Oduleye & Medon, 2023a). Supply chain finance research shows that reverse factoring and related instruments lower suppliers' financing costs only when buyers approve invoices promptly (Pfohl & Gomm, 2009; Caniato et al., 2016), and factoring is an important finance source for small suppliers in weak legal environments (Klapper, 2006). Trade credit theory explains why suppliers extend credit and why buyer payment behaviour matters to them (Petersen & Rajan, 1997).

Evidence shows that payment behaviour has material consequences for suppliers. Murfin and Njoroge (2015) found that small suppliers extending trade credit to large buyers reduce their own investment, implying real costs of long payment terms. Barrot (2016) showed that trade credit terms affect entry and survival in the trucking industry, particularly for financially constrained firms. Policy has responded: the European Union Late Payment Directive (Directive 2011/7/EU) sets default payment periods and statutory interest, and similar measures exist in other jurisdictions.

Relationship research suggests that reliability is a foundation of trust. Terpend et al. (2008), reviewing two decades of buyer–supplier research, found that relational practices, including fair and consistent treatment, are associated with supplier performance and value creation. Paulraj et al. (2008) showed that inter-organisational communication functions as a relational competency that improves outcomes for both parties. In commitment-trust terms, a buyer that pays accurately and on time signals reliability and integrity, while disputes over unmatched invoices, unexplained deductions or repeated delays erode trust (Morgan & Hunt, 1994). Applied supplier relationship management frameworks reach the same conclusion, treating dependable transactional conduct as the base on which collaboration, innovation and resilience are built (Ike et al., 2021; Akinleye & Adeyoyin, 2022b). Strategic buyer–supplier relationships and supplier development improve performance through commitment and social capital (Carr & Pearson, 1999; Krause et al., 2007), and supplier satisfaction research counts the buyer's operational conduct, including ordering, invoicing and payment, among the drivers of satisfaction and preferred-customer status (Essig & Amann, 2009; Vos et al., 2016). The review identifies an important tension. The same controls that protect the buyer, such as strict matching, blocked invoices and exception queues, can delay legitimate payments if exception handling is slow. Supplier-facing digital tools can mitigate this tension: supplier portals that show invoice status, structured e-invoicing that reduces rejections, and automated early-payment or supply chain finance programmes. Smart-contract models for supplier payments go further, releasing payment automatically once agreed conditions are met and benchmarking supplier performance on the same record (Akomolafe et al., 2022). Evidence on web-based payment portals in Sub-Saharan Africa indicates that adoption depends on trust, usability and infrastructure, which matters for small local suppliers (Agyei et al., 2019). Applied payment studies propose interoperable distributed ledger models for cross-border payments, predictive liquidity optimisation and regulatory adaptation of payment products, all relevant to energy firms paying foreign suppliers (Adesuyi et al., 2023a; Akomolafe et al., 2023c; Olaogun et al., 2023). Treasury research on cash-flow consolidation and FX risk control, predictive budgeting and cash-flow modelling, capital allocation and executive decision systems frames payment timing as a treasury decision (Dada et al., 2021; Adesuyi et al., 2022; Tonoyan et al., 2021; Lawal & Oduleye, 2021; Lawal & Oduleye, 2019b; Oduleye & Medon, 2023b), while fintech-enabled transaction banking, digital collections platforms and trade finance product design show how the banking side of the payment chain is being digitised (Okafor et al., 2021; Osuji et al., 2021; Agboada et al., 2018a). Process cost optimisation research cautions that efficiency gains must be weighed against control objectives (Tonoyan et al., 2022a). Predictive cost optimisation models and telemetry-driven approaches that embed economic evaluation directly into enterprise data pipelines indicate how payment and procurement data could be used to quantify the value of control improvements in near real time (Tonoyan et al., 2022b; Ogundairo & Ayivi-Donkor, 2023). Well-designed digital controls therefore have the potential to improve both control and relationship outcomes, but poorly designed ones can trade one off against the other. Empirical studies that measure both outcomes in the same setting are scarce.

For energy enterprises, supplier reliability is strategically significant. Local-content policies in many producing countries require operators to develop domestic suppliers, many of which are small and liquidity-constrained. Delayed payment to these suppliers can undermine local-content goals and project schedules. In joint ventures, delays may also arise from slow partner cash calls, linking supplier payment reliability to joint-venture governance.

4. Conceptual Model

Drawing the themes of the synthesis together, Figure 1 presents a conceptual model of digital procurement controls in energy enterprises. Digital enablers (e-procurement, integrated ERP, e-invoicing, RPA and AI matching, process mining and distributed ledgers) support control mechanisms (PO traceability, matching with tolerance rules, duplicate-payment analytics, immutable audit trails and vendor master governance). These mechanisms produce proximal outcomes: procurement transparency, payment accuracy and payment timeliness and predictability. Proximal outcomes in turn contribute to distal outcomes: supplier trust and relationship quality, supplier liquidity and continuity, and audit assurance and regulatory legitimacy.

Fig 1: Conceptual model of digital procurement controls and outcomes in energy enterprises The model includes contextual moderators specific to energy enterprises: capital-project intensity, ERP fragmentation, state ownership and transparency obligations, data quality and governance maturity. It also includes a feedback loop: suppliers that trust the buyer are more likely to adopt e-invoicing and portals and to maintain accurate master data, which strengthens upstream controls. Table 4 maps the main control mechanisms to the risks they address and the supporting evidence.

Table 4: Mapping of control mechanisms, risks, enablers and evidence Control mechanism Primary risk addressed Key digital enablers Supporting literature PO traceability and "no PO, no pay"

Maverick and unauthorised spend; untraceable payments E-procurement, ERP workflow, process mining Presutti (2003); Croom & Brandon-Jones (2007); Jans et al. (2014)

Two-, three- and four-way matching Overbilling; billing for undelivered goods or services ERP matching, OCR, e-invoicing, RPA COSO (2013); Moffitt et al. (2018); Huang & Vasarhelyi (2019)

Duplicate-payment analytics Duplicate and erroneous payments; billing fraud Forensic analytics, ML, continuous monitoring Nigrini (2020); Kogan et al. (2014); Baader & Krcmar (2018)

Vendor master governance Fictitious and duplicate vendors; bank detail fraud Master-data workflow, validation services ACFE (2022); Nigrini (2020)

Event-level audit trail Undetectable alteration; weak assurance ERP logs, process mining, DLT Vasarhelyi et al. (2004); Dai & Vasarhelyi (2017)

Supplier-facing transparency Disputes; late payment; relationship erosion Supplier portals, e-invoicing, SCF platforms Gelsomino et al. (2016); Terpend et al.

5. Discussion

Taken together, the synthesis indicates that digital procurement controls are most effective when they form a continuous chain of evidence rather than a set of separate tools. The five themes are interdependent. Purchase-order traceability supplies the identifiers that matching relies on; matching outcomes and vendor master data feed duplicate-payment analytics; event-level audit trails record every step and make the chain testable; and payment reliability is the visible result for suppliers. A weakness at any point propagates downstream. An after-the-fact PO undermines matching, a poorly governed vendor master defeats duplicate checks, and an editable log weakens assurance over all of them. This interdependence explains why studies of single technologies, such as RPA or blockchain, often report gains that are difficult to sustain when the surrounding data and process foundations are weak (Syed et al., 2020; Kumar et al., 2020).

A second finding is a tension between control strength and supplier experience that is rarely addressed directly. The auditing and accounting information systems literature evaluates P2P controls mainly by their ability to prevent and detect error and fraud (Vasarhelyi et al., 2004; Kogan et al., 2014), while the supply management literature evaluates buyer behaviour mainly through its relational effects (Terpend et al., 2008; Vos et al., 2016). Few studies examine both. Yet tight tolerances, blocked invoices and slow exception handling, which strengthen control, are also among the most common causes of late and unpredictable payment. The conceptual model resolves this tension by treating payment timeliness and predictability as proximal outcomes of control design in their own right, so that controls are judged by their effect on suppliers as well as on error rates. Digital tools such as structured e-invoicing, supplier portals and automated exception routing are the main levers for improving both at once.

With respect to RQ5, the energy context amplifies both the need for digital controls and the difficulty of implementing them. Capital projects, EPC contracts and field services make receipt evidence harder to establish than in the goods-dominated settings where much e-procurement research has been conducted (Mishra et al., 2007; Gunasekaran & Ngai, 2008). Mergers, joint ventures and multiple ERP instances fragment data. State ownership, cost-recovery audits and extractive-industry transparency regimes raise the external stakes of traceability (OECD, 2016; EITI, 2023), and local-content policies make the treatment of small domestic suppliers a matter of regulatory compliance as well as relationship management (Ovadia, 2016). Controls designed for standard P2P settings therefore need adaptation, particularly in how services are evidenced and how exceptions affecting small suppliers are prioritised. Finally, the evidence base is uneven. ERP-based matching, continuous monitoring and process mining are supported by substantial field and empirical work (Alles et al., 2008; Jans et al., 2014; Morris, 2011), whereas evidence on AI-based matching and distributed ledgers in procurement remains largely conceptual or pilot-based (Guida et al., 2023; Kouhizadeh et al., 2021). The applied studies from emerging economies included in this review add valuable contextual and sectoral detail, but most are conceptual frameworks rather than empirical tests. This unevenness suggests a sequencing logic for energy enterprises: establish integrated data and process foundations first, then extend analytics and continuous monitoring, and only then invest in experimental technologies where shared, multi-party records add clear value.

6. Implications

6.1. Theoretical Implications

The review has three implications for theory. First, it extends agency and transaction cost explanations of procurement control by showing that digitalisation changes not only the cost of monitoring but also its scope, shifting assurance from sampled transactions to entire populations and from periodic to continuous review (Williamson, 1985; Vasarhelyi et al., 2004). Monitoring that was previously uneconomic becomes feasible, which alters the balance between preventive and detective controls.

Second, it connects internal control theory with the relational view of buyer–supplier relationships. In the conceptual model, payment reliability is the mechanism through which the quality of internal controls reaches suppliers and shapes trust, commitment and the relational rents that collaboration can generate (Dyer & Singh, 1998; Morgan & Hunt, 1994). This link is implicit in each literature but has not been treated as a single causal pathway.

Third, it specifies contextual moderators, namely capital-project intensity, system fragmentation, ownership and transparency obligations, and data quality, that condition the effectiveness of digital controls. This moves explanations of procurement control beyond generic adoption models towards context-sensitive accounts suited to energy and other asset-intensive, publicly scrutinised industries.

6.2. Practical Implications

The review also has several implications for finance, procurement and internal audit leaders in energy enterprises. The first concerns design: identifier continuity should be treated as a design principle, so that every payment can be traced to a PO, contract line and receipt, with exceptions measured and reported. A "no PO, no pay" rule, paired with a controlled route for genuine emergencies, keeps traceability intact, and after-the-fact POs are a useful key risk indicator. Because services and construction dominate energy spend, evidence of receipt deserves particular attention, and work orders, field mobility tools and operational data can provide independent corroboration of progress claims. The second concerns detection and assurance. The vendor master is a critical control: tax and bank details should be validated, master-data maintenance segregated from payment processing, and vendors consolidated across ERP instances. Duplicate-payment analytics are more effective when run continuously rather than annually, and when exact, fuzzy and process-context tests are combined and their false-positive rates tracked. Audit-trail integrity should be protected by restricting privileged access, monitoring log changes and preserving linkages during system migrations. Integrity programmes can be aligned with ISO 37001 on anti-bribery management (International Organization for Standardization [ISO], 2016) and ISO 20400 on sustainable procurement (ISO, 2017), with digital P2P data serving as evidence of their operation. Distributed ledgers are best pursued selectively, in multi-party settings where shared records add clear value and data governance has been agreed.

The third concerns suppliers. Control outcomes should be measured alongside supplier outcomes, including on-time payment rates, dispute rates, invoice rejection rates and supplier satisfaction. Supplier portals, structured e-invoicing and early-payment options reduce the friction that strict controls can create, and they matter most for small and local-content suppliers whose liquidity is most exposed to payment delays.

7. Limitations

This review has limitations. As an integrative rather than systematic review, it prioritises conceptual breadth over exhaustive retrieval, and some relevant studies may have been missed. Restriction to English-language sources may under-represent research from major producing regions. The 150 seed-list studies were included for their regional and sectoral relevance, and some are only semi-related to procurement controls, but most are conceptual and published in multidisciplinary outlets, so they were used to contextualise rather than to establish empirical claims. Professional and vendor sources were included cautiously, and quantitative claims from vendors were excluded where they could not be verified. Finally, energy-specific procurement-control studies are scarce, so several conclusions are inferred from general P2P research and from the characteristics of energy enterprises; these inferences are framed as propositions for testing.

8. Future Research

The synthesis reveals several gaps that define an agenda for future research. Empirical work rarely measures control effectiveness and supplier outcomes together; energy-specific evidence is thin; duplicate-payment prevalence is poorly documented; and evaluations of AI and DLT in P2P are mostly conceptual or pilot-based. The following propositions are offered for testing. • P1. In energy enterprises, the degree of end-to-end identifier continuity from requisition to payment is positively associated with procurement transparency and negatively associated with the incidence of after-the-fact POs. • P2. Automated three-way matching reduces erroneous payments, but its effect on payment timeliness is positive only when exception-resolution capability is high. • P3. ERP fragmentation increases the incidence of duplicate vendors and duplicate payments; consolidated vendor master governance moderates this effect. • P4. Combining rule-based red flags with process-context data yields higher precision in duplicate- and fraud-payment detection than either approach alone. • P5. Supplier-perceived payment reliability mediates the relationship between digital P2P controls and supplier relationship quality. • P6. State ownership and transparency obligations strengthen the association between digital procurement controls and external legitimacy outcomes. • P7. Distributed ledger records improve audit-trail integrity in multi-party energy procurement (for example, joint ventures) only where governance of data entry is agreed among parties.

Table 5 summarises corresponding research designs.

Table 5: Suggested research designs Gap Suggested design Possible data Energy-specific evidence Multiple case studies of operators, utilities and state-owned energy firms Interviews, process documentation, ERP event logs Prevalence of duplicate payments Analytics on anonymised payment populations across firms AP and vendor master extracts; recovery audit outcomes Control and relationship outcomes together Dyadic surveys of buyers and suppliers Payment data linked to supplier perception surveys Effectiveness of AI matching Quasi-experimental before-and-after studies Exception rates, cycle times, error rates DLT in multi-party procurement Design science and pilot evaluation Prototype ledgers in joint-venture settings Local-content suppliers Longitudinal studies of payment terms and supplier survival Supplier registries, payment histories

9. Conclusion

This review set out to explain how digital procurement controls support traceability, reconciliation and reliable supplier payment in energy enterprises. Its central finding is that these controls work as a connected system rather than as separate tools. Purchase-order traceability provides the foundation for transparency. Automated matching is the main safeguard against overbilling, but it is only as strong as the evidence of receipt behind it and the speed with which exceptions are resolved. Duplicate and erroneous payments are best contained by combining preventive vendor master governance with continuous analytics. Event-level audit trails make continuous assurance possible, while distributed ledgers remain a promising but unproven complement. Payment reliability, finally, connects internal control to external relationships: accurate, timely and predictable payment builds the supplier trust on which energy projects depend.

The conceptual model developed in this paper brings these elements together and shows how capital-project intensity, system fragmentation, ownership structure and data quality condition their effectiveness in the energy sector. For practitioners, the main message is that control and supplier outcomes should be designed and measured together, so that stronger controls do not come at the expense of the suppliers that energy enterprises rely on. For researchers, the priority is to test the propositions advanced here in energy-sector settings, moving the field from promising concepts to tested evidence.