Urgent Vendor Setup? Here’s How to Protect Your Vendor Master File

Urgent vendor setups are a common scenario in Accounts Payable (AP), especially for Non-PO spend when the request for the vendor setup is not triggered until the invoice is received.  Combine that with month-end or year-end when those forgotten invoices make their way over to AP at the same time, and the potential for fraud can increase. 

 There are two ways urgent vendor requests can be handled: 

One: Same Vendor Setup Process, and hurry.

 Handling urgent new vendor setups when your current vendor setup process is still followed, only expedited, can and should be planned for.  When I was an AP Sr. Manager for a Fortune 15 company over Global Vendor Maintenance, I had one or two team members (one per large ERP) assigned to daily urgent vendor setups.  I expected urgent requests to come in, and they did.  My next level up and my peers knew who to reach out to if I was not available and it worked well.  Same setup process, expedited.  I would also recommend that a report or log be maintained to track who and why these requests are coming in as expedited.  What is measured improves and identifying any internal team members that continue to submit urgent requests signals a training or a meeting to reduce that behavior. 

 Two: Disregard Vendor Setup Process, and hurry.

Expectations to disregard or postpone your vendor setup process because there is a deadline (need a purchase order, invoice overdue, etc) is problematic.  In my previous role, these urgent requests come in with no supporting documentation and the expectation was to overlook our normal process and add the vendor to the vendor master file.  There is no one to blame here, the vendor and many times the internal team member that had the relationship with the vendor, had no idea what AP’s authentication and validation processes were and assumed that they can be disregarded in urgent situations.  We know better.  We know that fraudulent vendors cost US businesses every day with data breaches and misdirected payments.  Yet, you still have this critical purchase order or payment that needs to be made and you are not able to push back.

 So now what? 

Listed below are the minimum required documentation and validations to setup a new vendor in your vendor master file to protect your company from fraud and reduce the risk of penalties from regulatory agencies.  Read below for how to handle if you are not able to follow your new vendor setup process: 

  • IRS W-9 or IRS W-8 for the IRS Tin Check and/or Tax-Exempt Organization Tool

    •  No – W-9 or W-8? Start backup withholding with the first payment.  Communicate to the vendor or internal team member submitting that this will occur if you don’t receive the IRS W-9 or W-8 and the potential of withholding will more than likely be enough incentive for the vendor to submit the W-8 or W-9. 

    •  If the Vendor indicated that they are a Charitable Organization, you need the Legal Name and Tax ID to use the IRS Tax-Exempt Organization Search Tool to verify the vendor is registered with the IRS as tax-exempt.  Set them up as a regular vendor until you receive the W-9. 


  • OFAC/SDN Check

    • At a minimum do an OFAC/SDN check since you don’t need any supporting documentation for this check.  Make sure you have the Legal Name and not the DBA. 

    • Search by the Legal Name and if the vendor appears on this list do not set them up in your vendor master file and notify leadership. 

    • Search the vendor Bank Name if the vendor will receive ACH payments. 


  • If payment by ACH:  Verify Banking Information to Avoid EFT Returns

    •  Collect the banking data and validate the ABA Routing#/Swift/BIC or the IBAN format for foreign banks.  To reduce the potential for fraud and protect what is considered sensitive data, confirm that the banking data came from the vendor when received. Verify the banking data then reach out to the vendor to verify the banking information received. 

  • Address

    •  Validate with USPS or Postal Union (Intl) to confirm that vendor is not fraudulent and using an address that does not exist.  Critical if the vendor will receive payment via check since you don’t want the check returned.

  • System for Award Management (SAM)

    •  Governments are prohibited from awarding contracts to contractor entities that are on this exclusion list.  If you are a Government, search using the vendor legal name.

 Include any additional validations or collect any documents that may be specific to your company or industry for vendor setup, and check with leadership and/or as needed.

Have a vendor self-registration portal? Great.  This information can still be useful for those scenarios where the vendor has opted out of the portal (can you say GDPR?), or if the vendor is not in a position to log on register yet.  Also, make sure you are reviewing all authentication, validation and management recommendations to fill any gaps in your vendor portal solution.

Want a handy Cheat Sheet that includes the links to the validation resources?  Sign up for my mailing list below, download the Vendor Validation Reference List and share with your entire team!

 Protect the Vendor Master File from Fraud.  Keep it Clean. 

 #stayhappy #puttingtheapinhappy #Vendorsetup #vendormasterfile #accountspayable

Debra R. Richardson,


Debra is an accounts payable speaker, consultant, and trainer with over 20 years of experience in AP, AR, general ledger, and financial reporting for Fortune 500 companies including Verizon, General Motors and Aramark.

For the past eight years, Debra has focused on Global Vendor Maintenance, and implemented a vendor self-registration portal for 140k+ global vendors across five Accounting Systems/ERPs. In her consultancy, she focuses on internal controls and authentication to prevent fraud in the vendor master file.