Who Should Be Allowed to Create Vendors? Vendor Setup Controls

Quick answer: The person who creates a vendor should not be the person who approves the purchase or releases the payment. Split the work into four duties (request, create, verify, pay), give each to a different person where you can, and check every new vendor's registration, tax number and bank account before the first transfer. Treat any change of bank details as a new set-up, confirmed by phone on a number you already hold, and review the vendor list at least once a year for vendors nobody uses.

The problem: a vendor record is a licence to be paid

Payment fraud does not always start with a fake invoice. It can start earlier, when a name is added to the list of people the business pays. Once a vendor exists in your records, its invoices look routine and its bank details are where the money goes.

That makes vendor set-up a control point in its own right. The US Government Accountability Office (GAO) lists fraudulent payments among the ways an organisation's assets can be misappropriated. At vendor set-up, two risks stand out:

• A vendor that does not really exist, set up by someone inside the business who can then approve and pay its invoices.
• A real vendor with the wrong bank account, changed after a convincing email that "our bank details have changed".

Errors cost money too: a supplier entered twice can be paid twice. Put simply, whoever controls the vendor list and the bank details controls where your money goes.

Separate the four duties

The GAO's internal control standards, known as the Green Book, describe segregation of duties as separating the responsibilities for authorising transactions, processing and recording them, reviewing them, and handling the related assets, so that no one individual controls all key aspects of a transaction. For vendors, that becomes four duties:

1. Request. A member of staff asks for a new vendor and says why an existing vendor will not do.
2. Create. One designated person (often in procurement) collects the documents and enters the record.
3. Verify. A different person, usually in finance, checks the documents and the bank account and marks the vendor as approved for use.
4. Pay. Payment is released by someone who did not create the vendor and cannot change its bank details.

In a business of five people this may feel heavy. The Green Book accepts that full separation is not always practical with limited staff and says management should then design alternative controls. In practice, the owner reviews and signs a short monthly list of every vendor created and every bank detail changed. The Green Book also warns that two or more people acting together can defeat segregation, which is why the periodic review below still matters.

What to check before the first payment

There is no single legal checklist for a private business, but the federal public sector gives a useful model. Under Nigeria's Public Procurement Act 2007, bidders for federal contracts must, among other things, have the legal capacity to enter the contract, not be insolvent or in receivership, have paid their taxes, pensions and social security contributions, and have no director convicted of fraud or financial impropriety. Bidders must also file an affidavit disclosing whether any officer of the procuring entity's relevant committees, or of the Bureau of Public Procurement, is a director or shareholder of the bidder or has a financial interest in it, and the procuring entity may ask for documentary evidence that the bidder qualifies.

The Act also gives the Bureau of Public Procurement (BPP) the power to maintain a national database of federal contractors and a list of debarred firms. A 2014 circular from the Secretary to the Government of the Federation directed that contractors not registered on that database may no longer do business with the federal government, and that ministries and agencies ask bidders for evidence of registration.

These rules apply to federal public procurement, not to a private company, but they are a sound model. For a private business, a reasonable minimum before the first payment is:

• Registration: a copy of the company registration certificate or business name registration, with a legal name and registration number that match the invoice.
• Tax: the vendor's tax identification number (TIN).
• Bank account: a letter on the vendor's letterhead or a bank reference showing an account name that matches the legal name. An account in an individual's name for a limited company is a question to ask, not a detail to accept.
• Contact details: a phone number and address you have confirmed yourself, not only the ones printed on the invoice.
• Conflict of interest: a short declaration that no member of your staff owns or works for the vendor, borrowing the idea behind the Act's affidavit.
• Duplicates: a search of your existing list for the same name, tax number or bank account.

Collect the evidence once, keep it in the vendor's file, and record who checked it and when.

Who may change bank details

A change of bank details needs more care than a new vendor, because it comes from a supplier you already trust. The UK National Crime Agency's guidance on invoice fraud lists "messages stating a regular supplier's bank details have changed" as a warning sign, advises verifying by calling the genuine supplier on a previously used phone number before transferring money, and suggests asking another colleague to authorise high-value payments.

Turn that into a rule: bank details change only on a written request from the vendor, confirmed by a call to a number already on file, made by someone other than the person who received the request, and approved by a second person before the next payment. Urgency is not a reason to skip the call; it is a reason to make it.

An illustrative example: two days before a ₦2,850,000 payment to your diesel supplier is due, an email on the supplier's letterhead gives a new account number. Your finance officer calls the supplier's sales manager on the number used for the last three orders. The supplier has not changed banks. One call has kept ₦2,850,000 out of a stranger's account.

Review dormant and duplicate vendors

Vendor lists only grow. When the City of Madison in the United States audited its vendor master file in 2025, it found that 9,927 of its 19,629 active vendors had no transactions for more than four years, found six duplicate records, and noted that vendors marked inactive could still be invoiced or paid. It recommended moving them to a status that stops their use, and noted that an annual review of vendor records would help.

A dormant vendor with valid bank details is easy to misuse because nobody is watching it. Review the list at least once a year: remove or block vendors with no purchases in the past 12 months, merge duplicates, and check that each remaining vendor's bank details still match its file.

A vendor control checklist you can copy

The roles are illustrative; match them to your own team. For the wider habit of keeping a supplier register and reviewing performance, see how to manage suppliers. A first order from a new vendor is also a good trigger for an extra approver in your spending authority matrix.

How RequisitionPro helps

Difficulty: anyone can add a vendor. In RequisitionPro, only Company Admins and Department Heads can add vendors; staff with the User role cannot. Each person can edit only the vendors they created. The benefit is a short, known list of people who can create vendor records. The platform will also not accept a second vendor with the same vendor code or email address in your company, though a duplicate entered with a different email still needs your own search.

The Add New Vendor form has fields for legal name, tax ID and registration number, and a Banking Information section for bank name, account name, account number and SWIFT code. Tax ID and registration number are optional in the form, so make them mandatory in your policy.

Difficulty: no record of who approved a vendor. Only a Company Admin can mark a vendor as Verified, using the Verify Vendor action on the vendor's page. The page then shows Verified On and Verified By, so you can see who signed off and when.

Be clear about what Verified means. It records a person's decision; it is not a check. The platform does not verify bank details, company registration or tax numbers, and it does not detect fraud. The dialog speaks of eligibility for official transactions, but an unverified vendor can still be chosen on a requisition, so your rule ("no purchase order or payment to an unverified vendor") has to be applied by your approvers. Three more gaps to cover in your policy:

• A Company Admin can verify a vendor they created themselves, so state that the verifier must be someone other than the creator.
• If the creator later edits the vendor, including its bank details, the Verified mark stays in place. Treat every bank detail change as a fresh verification under your call-back rule.
• RequisitionPro's audit log records requisition and user activity, not vendor creation, edits or verification. Keep your own written log of new vendors and bank detail changes (the evidence column above) and review it monthly.

RequisitionPro does not make payments, so the "pay" duty stays in your bank and accounting process. New vendors start as Active, and the vendor screens do not currently offer a way for your team to mark a vendor inactive, so keep your dormant-vendor list in your review sheet and tell buyers which vendors not to use.

Related questions

Should procurement or finance create vendors? Either can, as long as the other one verifies. A common split is procurement collecting documents and creating the record, and finance checking the bank account and approving the vendor for payment.

Can the owner both create and pay vendors? In a very small business it often happens. Keep the documents for every vendor and have an accountant or a second director review new vendors and bank changes every quarter.

Next step

Watch the "Vendor Management" video (2:05) on our tutorials page to see how vendors are added and managed in RequisitionPro.