How to Build a Finance Department Vendor Master File Governance Process That Prevents Duplicate and Fraudulent Payees

The vendor master file sits at the center of every accounts payable operation, yet it often receives less formal governance than the payment process it feeds. When anyone on the team can add a vendor, when old records are never retired, and when no one routinely checks for duplicates, the file grows into a liability. Fraudulent payees slip in, duplicate records produce duplicate payments, and auditors spend hours untangling a register that should be a clean, authoritative list. A structured governance process addresses all of that before the damage compounds.

Why the Vendor Master File Deserves Its Own Process

Consider a hypothetical mid-size manufacturer whose AP team has grown over five years through turnover and acquisitions. Without a formal intake policy, vendors get added by whoever needs them fastest. A contractor submitting her first invoice might be entered three different ways across three different periods. A terminated vendor stays active. A fictitious payee added by a departing employee never gets reviewed. None of these problems are obvious until a payment run, an audit, or a fraud investigation surfaces them.

That scenario is not unusual. The vendor master file is one of the first places internal auditors and external examiners look when investigating improper payments, and a disorganized file makes every payment look harder to defend than it needs to be. Governance does not require expensive software. It requires defined intake steps, clear ownership, periodic review, and a deactivation routine.

Step One: Define Who Can Request and Who Can Approve

The most important control in vendor master governance is separation of duties. The person requesting a new vendor should not be the same person who approves and activates that vendor. In smaller finance teams where full separation is difficult, a compensating control such as a second reviewer confirming the setup before the first payment runs is an acceptable substitute.

Document the approval chain explicitly. A suggested structure assigns request rights to department managers or procurement contacts, approval rights to the AP manager or controller, and activation rights to a designated AP team member who did not handle either the request or the approval. Write this into your accounts payable policy so the roles survive personnel changes.

Step Two: Build a Standard Intake Form

Every new vendor addition should flow through a single intake document, whether paper or digital. That form should capture at minimum: the vendor's legal name, doing-business-as name if applicable, physical address, remittance address if different, tax identification number, payment method preference, a completed W-9 or equivalent, and the name of the internal requestor and their business justification.

Requiring a W-9 before activation serves two purposes. It gives you the tax identification information you need for 1099 reporting, and it creates a natural friction point that slows down anyone attempting to add a fraudulent payee. Legitimate vendors produce this paperwork quickly. Fictitious ones cannot.

Store completed intake forms in a shared location tied to the vendor record, so future reviewers can see the original documentation without hunting through email threads.

Step Three: Run a Duplicate Check Before Every Activation

Before any new vendor is activated, someone with access to the full vendor master should search for existing records matching the tax identification number, the legal name, and common variations of the name. Many ERP and accounting platforms include duplicate-detection tools that flag potential matches automatically. If yours does not, a periodic export to a spreadsheet with a simple sort-and-filter routine can catch obvious duplicates.

A suggested rule: if a tax identification number already exists in the master file, the new record should not be activated until the team determines whether the existing record is adequate or whether there is a legitimate reason for a second entry, such as a vendor with multiple remittance addresses under separate subsidiaries. Document that determination in the intake file.

Step Four: Verify Banking Details Independently

One of the most common payment fraud schemes involves changing an existing vendor's banking details through a spoofed email or a phone call to AP. Governance over banking changes deserves special attention.

Suggested practice: any change to a vendor's bank account or ACH routing information should require a callback to a phone number sourced independently from your existing vendor records, not from the email or document requesting the change. A callback to a number the vendor provided in the original W-9 or during initial onboarding is more reliable than calling a number included in the change request itself. Document the callback and the person reached before the change takes effect.

Step Five: Establish a Routine Review and Deactivation Schedule

An active vendor master file should reflect vendors you actually pay. A suggested cadence is a quarterly review of any vendor with no payment activity in the past twelve months. The reviewer determines whether the vendor relationship is ongoing but temporarily inactive, whether the vendor should be flagged for deactivation, or whether the record is a duplicate that should be merged or suppressed.

Deactivation should be a formal status change in your system, not a deletion. Retaining the historical record preserves your audit trail while preventing the deactivated vendor from appearing in payment selection runs. Document who deactivated each record and when.

Step Six: Assign a Vendor Master Owner

Governance processes without clear ownership drift. Assign one person the ongoing responsibility for the vendor master file: intake reviews, duplicate checks, banking change verifications, and periodic cleanups. In larger departments, this might be an AP supervisor. In smaller teams, it might rotate quarterly with documented handoffs.

The owner should also maintain a simple log of every addition, change, and deactivation with the date, the person who requested the action, and the person who approved it. This log does not need to be elaborate. A maintained spreadsheet or a notes field in your AP system is sufficient, as long as it is current and accessible during reviews.

What Good Looks Like at Audit Time

When an auditor or examiner asks about your vendor master controls, a well-governed file lets you demonstrate intake documentation for every active vendor, a change log showing who approved every modification, evidence of duplicate checks before activation, callback documentation for banking changes, and a record of periodic deactivation reviews. Each of those pieces is the output of the routine steps described above, not something reconstructed under deadline pressure.

The vendor master file is not glamorous finance work, but it is foundational. Every payment your team issues flows through it. A governed file is a controlled file, and a controlled file is one of the clearest signs that your AP operation is operating with the discipline that executives and auditors expect.