PayeeGuard

Accounts payable · checked 19 October 2026

Vendor master file audit: a checklist

Every payment you make goes to the bank details stored in your vendor (supplier) list. If a fraudster changed one of those records, or an old one is wrong, every future payment follows it. A short audit once or twice a year finds the problems before money moves.

Before you start

Export the vendor list from your accounting system (Xero, QuickBooks, Sage, NetSuite or similar) with: vendor name, bank details, date created, date last changed, who changed it, and last payment date. Most systems can also export an audit log of changes.

The 8 checks

  1. Recent bank changes. List every bank-detail change in the last 12 months. For each one, is there a record of a call-back to a number you already had? If not, verify it now.
  2. Same bank account, different vendors. Sort by account number. Two suppliers sharing one account is a classic sign of fraud or a duplicate.
  3. Vendor bank account matches an employee's. Compare against payroll bank details. A match needs an explanation.
  4. Duplicates. Look for near-identical names ("Acme Ltd" and "ACME Limited"), the same tax ID or the same address. Duplicates make double payments easy.
  5. Dormant vendors. Block anyone not paid in 12 to 18 months. Fraudsters target old records because nobody is watching them.
  6. Personal or unusual accounts. A company paid into an account in a person's name, or at a bank in a different country from the supplier, needs checking.
  7. Missing information. Vendors with no tax ID, no phone number or no address can't be verified when something changes. Fill the gaps.
  8. Who can edit. Check which users can change vendor bank details. The person who enters a change shouldn't be the one who approves the payment.

Keep it clean afterwards

  • A written rule for every bank-detail change: call back on a known number, second-person approval, and a note of who checked what. Free change form and policy.
  • A hold on the first payment to new or changed details until it's been verified.
  • Use the name check your bank offers where there is one: UK Confirmation of Payee, EU Verification of Payee, or the US options.
  • Repeat the audit at least once a year, and after any staff change in finance.

If you find a bad record

Don't contact the supplier through the details in the record. Call them on a number from an old invoice or their website, confirm the correct bank details, fix the record, and check whether any payments already went to the wrong account. If they did, act fast: paid a fake invoice? The first 24 hours.

Bookkeeper looking after several clients? PayeeGuard for bookkeepers keeps a verification record for every client's changes.

Check a suspicious email free Set up call-backs and approvals