Vendor master file
The central record of every supplier a business pays: legal name, address, tax numbers, payment terms and bank details.
In short
- Every invoice and payment relies on it. Errors spread everywhere.
- Changes to bank details are the single most common route for payment fraud.
- Who can create and edit suppliers should be tightly limited and logged.
The vendor master file, or supplier master data, holds the details of every supplier in the accounting or purchasing system. Each record typically includes the legal and trading names, address, contacts, tax registration numbers, payment terms, currency, default expense accounts and bank account details.
Why it matters
Every invoice is matched to a supplier record, and every payment goes to the bank account stored there. A wrong tax number can cost input tax credits. Wrong payment terms mean paying too early or too late. Wrong bank details send money to the wrong place, sometimes permanently.
The fraud risk
The most common attack on accounts payable is a request to change a supplier's bank details, often by an email that looks like it comes from the supplier. If the change is made without checking, the next payment goes to the fraudster. Standard protection is to confirm every bank detail change by calling the supplier at a phone number already on file, never one given in the request, and to have a second person approve the change.
Keeping it clean
- Limit who can create or edit suppliers, and keep that separate from who approves invoices and releases payments.
- Log every change with who made it and when.
- Check new suppliers against duplicates and against employee addresses and bank accounts.
- Deactivate suppliers that have not been used in a set period.
Worked example
An email that looked right
AP receives an email, apparently from a longtime supplier, with a new bank account for all future payments. The request is logged, and the AP clerk calls the supplier's accounts receivable number already on file. The supplier has sent no such request. The change is rejected, and the $64,000 payment due that week goes to the correct account.