Supplier onboarding determines which parties may be created in the vendor master and eventually receive payments. A supplier record can look complete while crucial verification is missing, outdated or linked to the wrong legal entity. Finance teams need a documented acceptance process and a visible queue of expired or incomplete documents.
Identify the supplier and the business relationship
Record the supplier’s verified legal name, trading name if applicable, unique internal supplier ID, contracting entity, country, tax identifiers as relevant, contact details and intended goods or services. Distinguish verified information from supplier-submitted information, and prevent duplicate master records where feasible.
Build a risk-based document register
Different supplier types and jurisdictions require different evidence. Examples may include signed contracts or engagement terms, applicable tax documentation, registrations, bank verification evidence, insurance or compliance certifications where the relationship requires them. The list should be established by company policy and local requirements, not represented as universally mandatory.
| Control field | Why it matters |
|---|---|
| Supplier ID and legal entity | Prevents document assignment to the wrong supplier |
| Document category and reference | Supports the exact evidence requirement |
| Issue and expiry date | Identifies expired or future-dated evidence |
| Verification method and date | Distinguishes checked evidence from merely received material |
| Owner and review deadline | Makes missing material actionable |
| Approval decision and reference | Preserves the controlled master-data action |
How to calculate document expiry status
For a declared report as-at date, classify documents as expired when a valid expiry date is before the as-at date; expiring soon when it falls within a configured future warning interval; and current only if other required checks pass. Missing or invalid dates are data-quality exceptions, not “current”.
Example: as-at 30 September with a 30-day warning threshold. A required certificate expiring on 15 October is due in 15 days and should show “expiring soon”. One expired on 29 September should show “expired”. A blank expiry date should be treated according to whether that document actually requires expiry tracking; it must not default silently to “verified”.
Six checks before activating a supplier
- Verify the supplier's identity through appropriate trusted records.
- Check potential duplicate supplier identifiers, names and payment details without automatically declaring fraud.
- Verify required documents for that supplier type and jurisdiction.
- Apply the approved bank-detail verification workflow separately from document upload.
- Have an appropriate independent reviewer approve the supplier master creation or material change.
- Record evidence references, changes, next review date and outstanding restrictions.
Ongoing monitoring is not the same as onboarding
Supplier documentation can expire after approval. Review the ongoing status of contracts, tax evidence, certifications and insured activities where relevant. Some documents have no fixed expiration; mark them as “not applicable” or “review required” based on policy rather than inventing a date.
Common control mistakes
- Using supplier-uploaded contact details as the sole channel for verifying a banking change.
- Treating an empty expiry-date field as evidence that a document is valid.
- Allowing preparer and reviewer names that differ only by spaces or case to count as independent approval.
- Making a status green when evidence exists but has not been verified.
- Storing unnecessary sensitive documents or unmasked account details in an accessible spreadsheet.
Frequently asked questions
Does every supplier need identical documents?
No. Requirements vary by contract, risk, jurisdiction and policy. A good tracker makes those applicability decisions explicit.
Can an expired document automatically block all payments?
The organisation must decide according to document type, risk and policy. A finance tool should flag the issue and support the approved workflow, not make a universal payment decision.
Does duplicate supplier data prove fraud?
No. It may result from shared addresses, reorganisations or master-data errors; investigate using source evidence.
Continue with supplier bank-detail verification controls and the free AP Fraud Prevention Checklist.
Educational supplier control guidance. Apply data privacy, retention and supplier approval policies.
Put this into practice: Supplier Risk & Document Tracker flags expired supplier documents and holds payment until a bank change is verified. Macro-free Excel with a Worked Example and a Blank edition, one-time payment, instant download. Or start with the free AP Fraud Prevention Checklist (printable PDF).