Vendor onboarding checklist: the checks to complete before you pay a new supplier

Supplier onboarding is the control point between a buying decision and the first payment. It is also one of the most common points for payment fraud, duplicate suppliers and unmanaged risk. A tiered checklist keeps low-risk suppliers moving quickly and gives critical ones the scrutiny they need.

Before onboarding starts

Ask for a justification. Can an existing supplier meet the need? Has the right route to market been followed? A new supplier request form stops duplicate suppliers and late surprises.

The core checklist for every supplier

• Legal entity name, registration number and registered address checked against a company register
• Tax registration and tax forms collected
• Bank details received on supplier letterhead and verified by a call-back to a known number
• Sanctions and watchlist screening
• Conflict of interest declaration from the requester
• Supplier code of conduct acknowledged
• Payment terms and contract or purchase terms agreed

The bank call-back matters most. Changed bank details are the classic route for invoice fraud, so the same verification applies to every later change request.

Tier the risk

| Tier | Typical profile | Additional checks | |---|---|---| | Low | Low spend, no data access, easily replaced | Core checklist only | | Medium | Moderate spend or limited data access | Financial check, insurance certificates | | High | Critical service, personal data or regulated activity | Cyber and data security questionnaire, ESG and modern slavery assessment, business continuity check |

Define the tiering rules in a matrix so the requester and procurement reach the same answer.

Supplier risk assessment for high-tier suppliers

Review financial stability, insurance against your requirements, information security controls, data protection terms, business continuity and labour and environmental practices. Record findings, the risk rating and any conditions of approval. Set a review date in a monitoring calendar.

After onboarding

Master data changes go through a controlled form with independent approval. High-risk suppliers are re-assessed on a schedule. Suppliers no longer used are deactivated through an offboarding checklist so dormant records cannot be misused.

Onboarding and risk templates

The [Supplier onboarding and risk toolkit](/toolkits#toolkit-06) includes a new supplier request and justification form, a supplier onboarding form, a bank verification procedure, a master data change form, a risk tiering matrix, a due diligence checklist, an insurance requirements matrix, risk and ESG, cyber and modern slavery questionnaires, a business continuity checklist, a supplier risk register and monitoring calendar, and a supplier offboarding checklist.