Vendor Master Data Management: A Small-Business Checklist

By Taylor Frizzell. Updated November 4, 2026. Worked examples are fictional.

What belongs in the vendor master?

The vendor master is the reference list used by purchasing, accounting and payment systems. It is different from the invoices and payments that refer to those vendors. A useful record identifies the supplier, its approved status, authorized contact route, payment terms and the evidence supporting important changes.

For ownership, definitions and access rules, see the small-business data governance guide. The UK government data ownership model is a useful reference for accountability, although this checklist is an editorial small-business workflow rather than a universal compliance standard.

A minimum field checklist

Keep bank and tax identifiers out of broadly shared spreadsheets. A vendor ID is not a bank account number. If several legal entities share a supplier, document the mapping and each entity’s approval rather than assuming one approval applies everywhere.

1. Onboard through a controlled request

1. Require the requester to explain the business purpose, purchasing owner, expected payment method and supporting agreement.
2. Check for an existing supplier using legal identity, trading names and other appropriate evidence. Similar names are review candidates, not automatic duplicates.
3. Establish contact and payment instructions through the approved verification process. Do not rely solely on an unsolicited email.
4. Have an authorized person approve the record before it becomes payment eligible.
5. Have the editor enter the approved data and a second person compare sensitive fields to verified evidence.

Record who requested, verified, approved and entered the information. A system audit log supports this record but does not replace evidence that the underlying instruction was legitimate.

2. Verify sensitive changes independently

Route bank, beneficiary, payment method and critical contact changes through a documented review. The FBI’s business email compromise guidance recommends verifying payment changes independently. Use a known contact route established separately from the change request.

Follow the full vendor bank-detail verification workflow. Keep the request pending until verification and authorization are complete. Compare the final system values and the first payment to the approved instruction. Changing the contact phone number and then using it to verify a bank change defeats the independence of the check.

3. Review access and incompatible duties

List who can request a vendor, edit payment details, approve invoices, release payments and review bank activity. Give individual accounts the minimum suitable permissions. Review access when roles change and remove obsolete access promptly through the authorized process.

If one bookkeeper must maintain vendors and prepare payments, an owner can independently approve bank changes and review the actual beneficiary and batch before release. See segregation of duties for small teams for a practical responsibility matrix. A reviewer needs actual evidence, not just a signature box.

4. Run recurring exception reviews

• New or reactivated vendors paid soon after creation.
• Bank-detail changes shortly before payment.
• Multiple vendor IDs that may represent the same supplier.
• Missing ownership, verification dates or required approvals.
• Inactive suppliers with new transactions.
• Unusual shared payment details, subject to access restrictions and legitimate explanations.

These are investigation flags. A shared address may be a legitimate service center; a recently created supplier may be valid. Review original documents, contact history, access logs and payment evidence before reaching a conclusion. Keep unresolved high-risk records out of an automatic payment workflow.

Worked example: two names, one supplier

A fictional company has V014 “Desert Office Supply LLC” and V087 “Desert Office Supplies.” Together they show $3,200 outstanding. The steward compares contracts, invoices and verified identity records and finds that both IDs represent the same legal supplier. Two $800 invoices are the same obligation; the other $1,600 is valid.

The reviewer confirms posting and payment history before approving the accounting correction. The team uses supported system procedures to merge or deactivate records, preserves history and updates purchasing mappings. Merely deleting V087 could lose valid transactions or links. The root cause was a new-vendor form without an existing-record search, so that check is added to onboarding.

Use a small, maintainable checklist

The Excel governance starter kit provides fictional dictionary, ownership and issue-log examples. Adapt the fields and evidence requirements to your systems. Review active records according to payment risk and business change; no single review frequency suits every supplier.

Common mistakes

Avoid using supplier names as permanent keys, accepting bank changes from invoice footers alone, collecting unnecessary sensitive data, sharing administrative logins, and treating a successful import as an approved master. Test imports on controlled samples and reconcile the record count and changed fields.

Frequently asked questions