Supplier Master Data and Vendor Risk

What the master actually holds

For each supplier: an ID, name, city, payment terms, and a kind classification — goods, service, utility or professional. A firm of chartered accountants tagged “professional” is not a trivial label; it determines which verification approach and which tax treatment apply to every invoice they raise.

Master data is where a downstream control gets its assumptions. Wrong here, wrong everywhere after.

The fake-vendor pattern

Someone with access to the supplier master creates a fictitious record — a plausible-sounding name, and a bank account that is actually theirs or an accomplice’s. Fictitious invoices are then raised against it. With no independent verification of new suppliers before payment, real money leaves for someone who supplied nothing.

This is not hypothetical. It is one of the most common ways money is actually stolen from finance departments.

Three onboarding controls

Before the first payment is ever released:

• 1.Verify the business exists independently — a GST registration check, a company registration check. Not just trusting what was typed into a form.
• 2.Confirm bank details through a channel independent of the form — a cancelled cheque or bank verification letter, never only the numbers supplied by whoever requested the vendor.
• 3.Separate requester from approver — the person approving a new supplier record must not be the person who asked for it.

Why the third control is the one that matters

A team member who normally raises purchase orders asks for a new supplier to be added, supplying the name and bank details themselves. Can they also approve it?

No. If one person can both request and approve, they can add a fictitious supplier with their own bank details entirely on their own, with no independent check anywhere in the chain. Segregating those two steps is the control that specifically closes that gap — and the first two controls are only as good as this one, since the same person could otherwise wave their own paperwork through.

Bank-detail changes are the same risk

It is not only new suppliers. A long-standing, genuine supplier’s bank details changing is just as dangerous a moment.

The classic pattern: someone impersonates a trusted existing supplier by email, requests a “routine” bank detail update, and collects the next real payment — one that was always going to be made anyway, to a genuine invoice, for goods genuinely delivered. Nothing about the transaction looks wrong except the destination.

Any bank-detail change needs the same independent verification as onboarding: ideally a phone call to a number already on file — never a number provided in the same message requesting the change.

Concentration: a different kind of vendor risk

Separate from fraud entirely: how dependent is the business on any one supplier? If a single source — the main raw-material supplier, say — represents a large share of total purchases, losing that relationship suddenly to insolvency, a dispute or a shortage could halt production.

Reviewing supplier concentration periodically, and consciously avoiding over-reliance on one source for anything critical, is a real risk-management discipline in its own right.

Common mistakes

• —Letting the same person request and approve a new supplier record.
• —Verifying bank details using contact information supplied in the same request.
• —Treating a bank-detail change as an administrative update rather than a control event.
• —Leaving dormant or duplicate supplier records active in the master indefinitely.
• —Never reviewing who holds edit access to the supplier master.
• —Monitoring fraud risk while ignoring concentration risk entirely.