Vendor Master Data

Vendor master data is the central set of records that an organisation holds about each supplier it buys from and pays. A record typically contains the supplier's legal name and address, registration and tax numbers, contacts, payment terms, currency and bank account details. It is held in the vendor master file of the organisation's enterprise resource planning or accounting system, and every purchase order, invoice and payment refers back to it.

Because payments are made to whatever bank account the record contains, vendor master data is one of the most sensitive data sets in finance. Accurate records allow invoices to be processed and paid automatically; inaccurate or manipulated ones lead to failed payments, duplicate payments, tax errors and fraud. Responsibility usually sits with accounts payable, procurement or a dedicated master data team, and it is a standard area of review for auditors.

• Identity. Legal name, trading name, registered address, company registration number and, for international suppliers, country of establishment.
• Tax data. Tax identification or VAT number, tax status and any certificates needed to apply the correct withholding tax treatment.
• Banking data. Account holder name, account number or IBAN, bank identifier, currency and payment method.
• Commercial terms. Payment terms, discounts, delivery terms, the purchasing categories the supplier is approved for and the general ledger accounts used for posting.
• Contacts and status. Named contacts for orders and remittances, the internal owner of the relationship, and flags showing whether the vendor is active, blocked or one-time.

A new supplier is added through a controlled onboarding process. The requesting department or the supplier itself submits the required information, often through a supplier portal, with supporting documents. The master data team checks it before the record is activated. Checks commonly include confirming that the business exists and is correctly registered, a form of know your vendor due diligence; sanctions screening of the supplier and its owners; validation of tax numbers; a search for an existing record to avoid duplicates; and bank account verification to confirm that the account belongs to the named supplier.

Records then need maintenance. Suppliers move, merge, change banks and cease trading. Good practice includes periodic confirmation of details with suppliers, blocking of vendors with no activity for a set period, removal of duplicates, and standard naming and formatting rules so that the same supplier cannot be entered twice under slightly different names.

The vendor master file is a frequent target for fraud from outside and inside the organisation. The most common external attack is a request to change a supplier's bank details, sent by email or letter that appears to come from the supplier, so that genuine invoices are paid into a criminal's account. This is a principal form of business email compromise, and because the invoices themselves are valid it is not caught by three-way matching.

Internal schemes include creating a fictitious vendor, sometimes a shell company controlled by an employee, and submitting invoices for it; temporarily altering a real vendor's bank details before a payment run and changing them back afterwards; and reactivating a dormant vendor for the same purpose. These are forms of insider fraud and often involve employee collusion with an outside party.

The main safeguard is segregation of duties: staff who create or change vendor records should not be able to enter invoices or release payments, and the reverse. Other standard controls are:

• Independent verification of bank changes. Any request to add or change bank details is confirmed by calling the supplier on a number already held on file, never one given in the request.
• Dual approval. A second person reviews each new record and each change to sensitive fields before it takes effect.
• Change logs. The system records who changed what and when, and reports of changes to bank details, names and addresses are reviewed regularly.
• Data analysis. Periodic tests look for vendors sharing a bank account or address with an employee or with another vendor, vendors without tax numbers, and payments made shortly after a bank detail change.
• Restricted one-time vendors. Accounts for occasional payees, which bypass normal set-up, are limited by value and monitored.

Beyond payment security, clean vendor data supports spending analysis, negotiation with suppliers, tax and regulatory reporting, and automated invoice matching and supplier statement reconciliation. Duplicate records split a supplier's activity across several accounts, hiding the true volume of business and making duplicate payments more likely. Organisations with several systems, often the result of acquisitions, face the further task of keeping one authoritative record for each supplier and feeding it to every system that needs it.