Urgent Vendor Setup? Here’s How to Protect Your Vendor Master File

March 26, 2019

Share

by Debra R. Richardson, MBA, APM, APPM, CPRS

Richardson bio pic_vertical.jpgUrgent vendor setups are a common scenario in Accounts Payable (AP), especially for non-PO spend when the request for the vendor setup is not triggered until the invoice is received. Combine that with month-end or year-end when those forgotten invoices make their way over to AP at the same time, and the potential for fraud can increase.  

There are two ways urgent vendor requests can be handled:  

One: Same Vendor Setup Process, and hurry.

Handling urgent new vendor setups when your current vendor setup process is still followed, only expedited, can and should be planned for. When I was an AP Sr. Manager for a Fortune 15 company over Global Vendor Maintenance, I had one or two team members (one per large ERP) assigned to daily urgent vendor setups. I expected urgent requests to come in, and they did. My next level up and my peers knew who to reach out to if I was not available and it worked well. Same setup process, expedited. I would also recommend that a report or log be maintained to track why these requests are coming in as expedited and from whom. Identifying any internal team members that continue to submit urgent requests signals a training or a meeting is necessary to reduce that behavior.  

Two: Disregard Vendor Setup Process, and hurry.

Expectations to disregard or postpone your vendor setup process because there is a deadline (need a purchase order, invoice overdue, etc) is problematic. In my previous role, these urgent requests come in with no supporting documentation and the expectation was to overlook our normal process and add the vendor to the vendor master file.  There is no one to blame here; the vendor, and many times the internal team member that had the relationship with the vendor, had no idea what AP’s authentication and validation processes were and assumed that they could be disregarded in urgent situations. We know better. We know that fraudulent vendors cost U.S. businesses every day with data breaches and misdirected payments. Yet, you still have this critical purchase order or payment that needs to be made and you are not able to push back. 

So Now What?  

Listed below are the minimum required documentation and validations to setup a new vendor in your vendor master file to protect your company from fraud and reduce the risk of penalties from regulatory agencies. Keep reading for what to do if you are not able to follow your new vendor setup process:  

IRS W-9 or IRS W-8 for the IRS Tin Check and/or Tax-Exempt Organization Tool

  • No W-9 or W-8? Start backup withholding with the first payment. Communicate to the vendor or internal team member submitting that this will occur if you don’t receive the IRS W-9 or W-8, and the potential of withholding will more than likely be enough incentive for the vendor to submit the W-8 or W-9.  
  • If the vendor indicated that they are a charitable organization, you need the legal name and tax ID to use the IRS Tax-Exempt Organization Search Tool to verify the vendor is registered with the IRS as tax-exempt.  Set them up as a regular vendor until you receive the W-9.  

OFAC/SDN Check

  • At a minimum, do an OFAC/SDN check since you don’t need any supporting documentation for this check.  Make sure you have the legal name and not the DBA.  
  • Search by the legal name and if the vendor appears on this list, do not set them up in your vendor master file and notify leadership.  
  • Search the vendor bank name if the vendor will receive ACH payments.  

If payment by ACH:  Verify Banking Information to Avoid EFT Returns

  • Collect the banking data and validate the ABA Routing#/Swift/BIC or the IBAN format for foreign banks.  To reduce the potential for fraud and protect what is considered sensitive data, confirm that the banking data came from the vendor when received. Verify the banking data, then reach out to the vendor to verify the banking information received.  

Address 

  • Validate with USPS or Postal Union (International) to confirm that vendor is not fraudulent and using an address that does not exist. This is critical if the vendor will receive payment via check, since you don’t want the check returned. 

System for Award Management (SAM) 

  • Governments are prohibited from awarding contracts to contractor entities that are on this exclusion list. If you are a government, search using the vendor legal name. 

Include any additional validations or collect any documents that may be specific to your company or industry for vendor setup, and check with leadership and/or as needed. 

Have a vendor self-registration portal? Great. This information can still be useful for those scenarios where the vendor has opted out of the portal (can you say GDPR?), or if the vendor is not in a position to log on and register yet. Also, make sure you are reviewing all authentication, validation and management recommendations to fill any gaps in your vendor portal solution. 

About the author:

Debra Richardson is an accounts payable speaker, consultant and trainer with over 20 years of experience in AP, AR, general ledger and financial reporting for Fortune 500 companies including Verizon, General Motors and Aramark. For the past eight years, Debra has focused on Global Vendor Maintenance and implemented a vendor self-registration portal for 140k+ global vendors across five ERPs. In her consultancy, she focuses on internal controls and authentication to prevent fraud in the vendor master file. Debra now focuses on protecting the vendor master file from fraud. She hosts a weekly podcast: “Putting the AP in hAPpy.” Contact her by email at [email protected] or visit her website: www.debrarrichardson.com.

Subscribe to our Newsletter

You may unsubscribe from our mailing list at any time. Diversified Communications | 121 Free Street, Portland, ME 04101 | +1 207-842-5500