What to Include in an AR Outsourcing SLA for B2B Invoice Collections

For mid-market B2B finance teams, collections-as-a-service should mean buying accountable collections work. An AR outsourcing SLA makes that distinction enforceable through cash targets, named owners, reporting duties, and remedies. This guide explains what each clause should contain so finance leaders can leave invoice chasing to a provider without losing control of the cash.

Why a vague AR outsourcing contract produces activity, not cash

Revenue can be earned before the cash is in hand. The finance team sees an overdue invoice, but the balance alone does not explain the blockage. Required documentation may be missing, a receipt may be unapplied, a deduction may need investigation, or follow-up may have no owner. Another reminder will not repair a posting problem. Without a structured SLA, however, the vendor can report calls made and emails sent while those problems remain untouched.

A useful SLA makes monthly performance visible, turns a missed standard into a credit without requiring proof of loss, and gives the buyer an exit after repeated failures. Each of those protections needs its own terms in the contract. A promise of “collections coverage” supplies none of them by itself. The buyer needs an auditable operating model.

What to baseline before the SLA is signed

Before setting targets, use invoice-level records to tell whether the failure is in collections, billing, posting, or disputes. Otherwise, the SLA starts its stopwatch without agreeing where the starting line is. Before penalty clocks start, both parties need to write down what shape the portfolio is in.

Record DSO using a formula agreed at engagement start, plus the 60-day and 90-day aging percentages as shares of total AR. Record unapplied cash by dollar value and dispute cycle time from creation to resolution. A posting backlog needs its own resolution path.

Require the same monthly KPI reporting format from day one, including ramp. Define the baseline measurement period separately from the performance period and state when penalties begin. Ramp can suspend penalties without suspending visibility. Changing the report halfway through makes it harder to prove that the work has improved.

DSO target clause: how to write a commitment that cannot be gamed

The DSO clause should state the agreed baseline, targets at defined intervals, the exact formula in an SLA exhibit, and the penalty trigger for missing each target. Those intervals might be 6 months and 12 months from steady-state. The contract must also define when steady-state begins.

The formula deserves as much attention as the target. Changes in new invoicing volume can distort DSO, including lengthening it during an invoicing spike even when collections improve. Without a fixed definition, the provider can point to a favorable number while collection quality deteriorates. Write the calculation into the exhibit rather than leaving either party free to choose it later.

DSO measures the conversion of billed revenue into liquidity. It does not, by itself, establish that the provider is collecting effectively across the portfolio. A provider can meet its DSO target while failing on disputed accounts. That is why the next clause needs a separate measure of collection effectiveness.

Collection Effectiveness Index clause: the control for what DSO misses

The Collection Effectiveness Index measures the share of collectible amounts actually collected within a period, independent of new invoice volume. Pair it with DSO. DSO shows the working-capital outcome, while CEI helps show where collections have failed in ways the headline number can hide. Neither earns the right to work alone.

The CEI clause should define its numerator as collectible beginning AR plus new invoices issued in the period minus ending total AR. To get its denominator, add beginning AR and new invoices issued, then subtract ending current AR. Set the minimum threshold the provider must maintain. Require reporting at least monthly, with the underlying data available for audit.

A miss should also trigger a root-cause report within a defined number of days. Disclosure is not corrective action, and a dashboard cannot investigate a dispute. Even paired, however, DSO and CEI remain period-end measures. Aging bucket limits add the third layer by exposing a worsening backlog those calculations can lag.

Aging bucket ceiling clause: the early warning the other metrics lag

Set maximum shares of total AR for the 60-day-plus and 90-day-plus buckets, with monthly reporting against the client’s own baseline. An industry average cannot show whether this portfolio is deteriorating. The comparison needs to preserve the buyer’s starting point so the trend stays visible. A tolerable aggregate result can otherwise conceal a growing old-debt problem.

The 90-day-plus bucket is a particularly useful warning. Invoices past that threshold have materially lower recovery rates, so crossing the agreed limit should trigger mandatory root-cause review. Define the threshold for the portfolio rather than leaving “acceptable aging” open to interpretation.

Aging distributions can reveal backlog deterioration before period-end DSO and CEI reflect it, but monthly reporting alone is not real-time oversight. That distinction connects the metric clause to the operating obligations. Aging limits are only enforceable in practice if the SLA also specifies collections cadence, dispute handling, and process accountability.

Operational process commitments: how the work must actually get done

To turn those outcomes into accountable work, require a prioritized collections queue segmented by customer segment, invoice value, aging bucket, and dispute likelihood. Specify first-contact timing and collections cadence in the document. Require weekly activity reporting as evidence that the collections cadence is running. That is the difference between outsourcing AR and outsourcing noise.

The dispute protocol should require the provider to log the issue, gather evidence, route it internally, and pause collections on that invoice. Specify a maximum resolution cycle time and an open-dispute report with reason codes at each reporting interval. Chasing a disputed invoice can upset the customer while hiding why payment has stalled.

Attach approval and escalation matrices to keep consequential decisions with the right people. The approval matrix should say who can resolve disputes, agree to payment arrangements, adjust invoices, or pause collections. For each exception type, the escalation matrix should name the internal owner, say what evidence is needed, and set a deadline for a response. Require real-time or near-real-time dashboards covering SLA status, backlog, errors, bottlenecks, and productivity. When a metric misses its target, weekly or monthly governance reviews should include root-cause analysis and plans for corrective action.

Unapplied cash and cash application accuracy clause

Money that has arrived but remains unmatched to an invoice can leave working-capital reporting unreliable, even when collections metrics look healthy. The SLA therefore needs a clause of its own for cash application.

Track unapplied cash by value, age, and percentage of total receipts, with near zero at week-close as the standard to demand. Define cash application cycle time as the elapsed time from receipt to matched posting. Also define accuracy as the percentage of receipts correctly matched on the first attempt. These measures distinguish a slow posting process from an inaccurate one.

Ask whether the accuracy commitment covers exceptions and disputed transactions or only clean postings. A high rate can conceal persistent failure on complex cases where substantial dollar value concentrates. The clause should clearly cover those transactions so the provider has to grade the hard homework too. The customer and banking data used in this process also come with security obligations, and the terms for those need to be just as clear.

Data security, compliance, and audit rights clauses

The buyer is still at risk when a provider mishandles customer financial data, banking details, or personally identifiable information. A certification badge is not enough contractual protection. Require a current SOC 2 Type II report for operating effectiveness, as a Type I attestation addresses control design only. Its scope should cover billing, collections, cash application, dispute resolution, and aging analysis.

GDPR calls for a written Data Processing Agreement before personal data changes hands. Append it as an exhibit containing the required terms. India’s DPDP Rules, notified in November 2025, introduced obligations that need to be reflected in the DPA for relevant offshore delivery. The exhibit must address the actual engagement.

Negotiate a vendor breach-notification obligation of 24 to 48 hours so the buyer can meet its own applicable 72-hour regulatory deadline as controller. Include audit rights to inspect controls, logs, and data handling practices. Specify a timeline for data return and deletion on termination. Evidence is the approval gate here. A provider unable to produce the SLA exhibit, dispute reason codes, escalation paths, audit logs, and control model should not be approved regardless of price.

Service credits, remedy structure, and termination triggers

Service credits usually reduce what is owed on future invoices. Link them to core operational indicators and tier them by severity, typically as a percentage of the affected monthly fee. Include earn-back provisions when performance returns to standard, with reasonable liability caps for ordinary misses.

The dangerous language is “sole and exclusive remedy” for any service failure. That wording can eliminate the buyer’s right to claim other losses even when failures become serious or chronic. Negotiate an explicit carve-out. Credits can be the sole remedy for ordinary misses, but not for chronic failure, data breaches, or willful default.

Termination rights give the buyer more leverage than a small credit on the management fee. Define the repeated-failure triggers that let the buyer leave without a penalty, including thresholds for consecutive months and rolling periods. A small invoice offset is weak compensation for significant operational harm. Yet even a well-drafted exit right depends on documenting each miss throughout the failure period. The reporting and governance duties set out earlier provide those records.

The strongest objection to hard KPI ceilings — and how to answer it in the SLA

Hard targets can lead to disputes with good cause when the parties learn how complex the portfolio is only after work starts. Disputed invoices, deductions, and multi-entity billing do not fit neatly into a standard-processing promise. If the SLA implicitly excludes them, the provider can report strong performance while the buyer’s cash problem persists. That is a scope failure.

The sophisticated buyer’s response is to define scope before setting the numbers. State whether each target covers the full AR portfolio or only clean, undisputed invoices. If exceptions are excluded, require a separate metric for that portfolio.

Require dispute reason codes and the aging of the exception portfolio at every governance review. Separate reporting keeps clean-invoice performance from masking deterioration elsewhere. Every metric clause should say whether exceptions are included and, if not, which separate accountability mechanism governs them.

Putting the SLA clauses together: a drafting checklist for finance leaders

Read the draft in the order its commitments take effect. The written baseline exhibit and a ramp definition that separates measurement from the penalty-bearing performance period come first. Then check the DSO formula and targets, the CEI minimum, the aging limits, and the cash application commitments. Each needs a defined scope, reporting interval, and response to failure. A number without those terms is not a complete commitment.

Next, match the outcomes to the operating documents. Queue discipline, first-contact timing, dispute protocols, approval rights, and escalation deadlines should explain who does the work and who resolves the exceptions. Security exhibits should cover process scope, data processing, breach notification, audit access, and exit handling. Finally, match each enforceable standard to tiered credits, earn-back terms, remedy carve-outs, and documented termination triggers.

Two concessions deserve particular resistance during negotiation. Do not accept credits as the sole remedy for chronic failure and data breaches, or metric definitions that quietly exclude disputed invoices and exceptions. Those terms can leave an SLA that looks polished but protects only the easiest work and the smallest losses. The finance team needs the opposite, which is accountability where getting paid becomes difficult.