The importance of the master vendor file and having good reliable data in it was highlighted with the surge of Please-Change-My-Bank-Account-Number frauds in recent years. This scourge has cost companies millions and, in a few instances, individuals their jobs. It has also changed best practices and increased the need for greater vendor validations. Today, the master vendor file is recognized as a critical feature in an organization’s fight to protect itself against fraud and erroneous payments. In this piece we review best practices, look at new ones and identify common vendor validation practices.
Vendor Management Best Practices
In an AP Now’s recent survey, it was discovered that on average, companies were only using half the recommended best practices. This opens the door for those looking to take advantage of the company. Here’s a list of the best practices every organization should use.
- Access to the master vendor file for purposes of adding new vendors or updating existing data should be extremely limited.
- Information entered into the master vendor file should be included on a form (for both new vendors and updates of existing information) that is completed by one person and approved or reviewed by a second. Use of a form further limits the opportunity for someone to set up a phantom vendor.
- Employ appropriate segregation of duties across the entire procure-to-pay chain, including the master vendor file responsibilities.
- Use a naming convention for entering all data. This should match convention used for entering data.
- Cleanse the entries in the master vendor file at least annually, although quarterly is definitely better.
- Collect Form W-9 from all vendors, not just those you believe are reportable. This should be done, ideally before the first purchase order is issued, but realistically before the first payment is made.
- Run the W-9 information through the IRS TIN Matching program before the first payment is made. Do not make the payment until you have a match. Correct mismatches from IRS TIN Matching and rerun the data before the first payment is made.
- Run this simple test yourself to ensure no employees are setting up phantom vendors. Run vendor address against addresses in the HR file. Investigate all matches as some may be legitimate. Some now take this step as part of their new vendor setup process.
New Master Vendor File Practices
Due to the advances, both in technology and unfortunately fraud, there are some new best practices every organization should be using. The cost for not employing the first one could run to the millions so if you haven’t already incorporated it into your processes, you should do so without delay. Let’s take a look at them.
- Verification of all changes to existing information. This has become a critical component of the accounts payable process given the explosion of fraud with “change my bank account” emails. While this is true especially when the request is received by email, there have been reports of such requests arriving in the mail. So, regardless of the source of the request, pick up the phone and verify the legitimacy of the request.
- Increased validations of vendor data. The accompanying vendor validation resources list at the end of this blog contains a list of free resources every organization can use. It was compiled from information from AP Now as well as excellent information provided by Debra R. Richardson in her Vendor Validations webinar. Platinum members can listen to it if they log into their AP Now accounts.
- There has been a move towards self-service vendor portals. The self-service feature requires the supplier to enter their own information into the master vendor file. This eliminates the risk associated with certain frauds and puts that risk with the supplier if one of their employees plays games with the data entry. However, adoption of these portals has not been brisk and only a small portion of the marketplace is using them.
The self-service vendor portals help accounts payable deal with many issues. If you are using a third-party invoice automation solution, inquire if it has this capability. Even if it means paying a little more, there are some real benefits. But be aware, you will not be able to get every last vendor to input their information so you will still need to devote some resources to that task. Best of all, some of these portals can also do IRS TIN Matching, handle OFAC checking and collect data for other regulatory compliance issues (i.e. minority business reporting, conflict mineral reporting etc.).
Vendor master file, if handled properly can help with lots of accounts payable responsibilities. Make sure you adjust your processes so best practices are used in relation to it. This includes new procedures to verify data, both when it initially is entered and andy time it is updated.
Some Free Vendor Validation Resources
- Vendor Legal Name and Tax ID validated against Internal Revenue Service (IRS) Records at www.irs.gov/tax-professionals/taxpayer-identification-number-tin-matching
- Vendor Legal Name and Tax ID validated against Internal Revenue Service (IRS) Records for Exempt Organizations at apps.irs.gov/app/eos
- Vendor Addresses (US) at www.usps.com and www.google.com/earth
- Vendor Addresses (Canada) at www.canadapost.ca/cpc/en/business/ecommerce/enhance/verify-addresses.page
- Vendor Addresses (non US) www.upu.int/en.html
- Vendor Legal Name against Specially Designated Nationals List (SDN) and Blocked Persons List from the Office of Foreign Assets Control (OFAC) at www.treasury.gov/about/organizational-structure/offices/Pages/Office-of-Foreign-Assets-Control.aspx
- Vendor Value Added Tax (VAT) Number against VAT Information Exchange System at ec.europa.eu/taxation_customs/vies
This blog was written by the founder of AP Now, Mary S. Schaeffer.