Hiring a provider to maintain vendor records

A vendor-maintenance engagement should name the systems and records the provider will maintain. Define whether it covers new suppliers, existing duplicates, inactive records or changes to established vendors. Different tasks require different evidence and approval. A proposal for vendor onboarding may exclude cleaning years of inconsistent records.

Identify the fields the provider may create, propose or change directly. Supplier names, addresses, tax records and payment instructions should not be treated as one undifferentiated profile. Assign the appropriate business owner for each sensitive decision and record the evidence needed before it can be accepted.

Ask the provider how it obtains source documents and resolves conflicting information. Require a distinction between information received and information verified under the company's approved process. A completed form can still contain an error. The engagement should explain what the provider checks and which assertions it cannot independently establish.

For payment details, have your security and finance control owners specify the verification and approval requirements. Keep the provider's preparation role separate from any authority to release funds. FTC guidance supports restricting system access to need. Use that principle to review whether the proposed role grants more power than vendor maintenance requires.

Give the provider criteria for identifying possible duplicates and a process for proposing mergers or deactivation. Similar names do not prove two records belong to the same supplier. Ask it to preserve transaction history and route uncertain cases for review before changing live master data.

Require an exception record for conflicting legal names, missing documentation or a request that cannot be verified. Name the internal contact who can resolve each category. Do not measure service performance solely by how quickly every record becomes active; that can reward bypassing the evidence requirements the company intended to buy.

IRS recordkeeping guidance identifies payee information and supporting purchase documents as relevant records. A maintained vendor file should help the company connect those documents to the correct supplier. It should not be presented as a guarantee that every tax classification or reporting obligation has been settled.

Request the old value, new value, request source, verification performed, approval and effective date for material changes. Decide which information belongs in the accounting system and which should remain in a more restricted repository. Sensitive documents should not be attached indiscriminately to records visible to every user.

Before recurring service starts, test a new supplier, a possible duplicate and a change request that fails verification. Confirm that the provider can leave a record pending and communicate the reason. A useful service preserves unresolved status when evidence is incomplete instead of forcing every case into an approved category.

Agree the export or handoff format, permitted retention and location of supporting evidence. Identify any vendor portal controlled by the provider and how the company obtains the information it is entitled to retain. Include pending requests in the handoff so the successor does not restart sensitive verification without context.

Price the service by a unit both parties can count, with separate treatment for historical cleanup and investigations. Review error corrections, rejected requests and repeat submissions in the first billing cycle. The company should be able to explain what work it bought and why a vendor record was approved, changed or held.