What is supplier master data management?

What does supplier master data management mean?

Supplier master data management is the ongoing work of keeping each supplier’s record complete, correct and unique, and of controlling every change to it. The record holds the data that ordering and payment use again and again: legal name, tax ID, addresses, contacts, bank account, payment terms and status.

A simple case. A supplier of cleaning services moves office and changes bank. Two weeks later its invoice is paid to the old account and comes back, while a second invoice arrives at the old address. Supplier master data management is the routine that prevents this.

The same work goes by several names. Finance and ERP teams say vendor master data, procurement teams say supplier data management, and software vendors sell supplier information management. The idea is the same: one trusted record per supplier, used by procurement and accounts payable alike.

It is different from the steps around it. Supplier onboarding collects and checks the data once, when a supplier is added. The supplier lifecycle describes the statuses a supplier moves through. Master data management keeps the record right in between, when names, owners, addresses and bank accounts change.

What is in a vendor master record?

A vendor master record is the file an ERP keeps for each supplier. Most ERPs split it into layers, because one supplier can sell to several companies of a group and to several buying teams.

SAP S/4HANA keeps suppliers as business partners, in three levels. General data, shared by the whole system, holds the name, address, tax number and bank details. Company code data holds the accounting side: the reconciliation account, withholding tax and payment methods. Purchasing organisation data holds the order currency, Incoterms and payment terms. Oracle Fusion Cloud Procurement keeps a supplier profile with addresses and sites. A bank account can be attached to the supplier, to one address or to one site.

Disclosure: the author works as an Ivalua consultant. SAP and Oracle are cited from their public documentation only, to show how ERPs structure the record; this is not a comparison.

Who owns supplier master data?

Supplier master data needs one owner for the rules and a small team for the changes. In most organisations the master data team, often inside accounts payable or a shared service centre, creates and changes records. Procurement decides whether a supplier should be used at all. Treasury or finance approves bank details. Requesters and buyers report changes; they do not type them into the ERP themselves.

The key rule is segregation of duties: the person who creates or changes a supplier must not also be able to enter its invoices or release its payments. US federal internal control standards (the GAO Green Book) describe the principle: split authority, custody and accounting so that no one person controls all key parts of a transaction. A small organisation that cannot split the roles adds a monthly review of all supplier changes by a manager.

• Data owner: writes the rules and decides what is mandatory.
• Master data team: checks requests, searches for duplicates, creates and changes records.
• Bank approver (finance or treasury): approves bank changes, never entered by the same person.
• Requesters and buyers: report changes through one form or the supplier portal, never by email to a colleague.

Why do duplicate suppliers happen, and how do you prevent them?

Duplicates happen when a new record is created for a supplier that already exists. The causes are ordinary: “Acme Ltd” and “ACME Limited” look different to a search by name, a site creates its own record because it cannot find the group one, or a supplier is added again after a merger.

The same invoice can be paid twice, once on each record, without any duplicate check noticing. Spend is split, so the organisation does not see how much it buys from one company. And duplicates give cover to fraud. In the ACFE’s 2024 study of 1,921 occupational fraud cases, billing schemes, such as invoices from a shell company created by an employee, were 22% of cases, with a median loss of $100,000.

1. Search by identifiers, not names. Before creating a record, search by tax number, company registration number and bank account. A match on any of them stops the request.
2. Standardise names on entry. Use the name in the official company register, without abbreviations, and record trading names in a separate field.
3. Run a duplicate report each month. List records that share a tax number, a bank account or a postcode and similar name, and send them to the master data team.
4. Merge with care. Block the duplicate for ordering and payment, move open orders and invoices to the record you keep, and keep the old record for the audit trail rather than deleting it.
5. Compare suppliers with staff. Check from time to time that no supplier shares a bank account or an address with an employee in the payroll system.

How do you control changes to a supplier’s bank details?

Treat every bank change as a new bank account: verify it outside the request, have a second person approve it, and block payment until both are done. This is the main fraud control in the vendor master. In the typical fraud, an email that looks like it comes from a real supplier says its bank details have changed. If the record is updated, the next payments go to the fraudster.

The losses are large. The FBI’s Internet Crime Complaint Center recorded about $3.0 billion of reported losses from business email compromise in 2025, from 24,768 complaints, and these are only the cases reported to it. The UK National Crime Agency advises confirming any bank change by calling the supplier on a number used before, because emails can be intercepted.

1. Receive the request through one channel: the supplier portal or a signed form, never a reply to an email thread.
2. Verify outside the request. Call a contact already on file, using a number from the record, not from the letter or the email.
3. Check the account name with the bank where a service exists: Confirmation of Payee in the UK, Verification of Payee for euro transfers in the EU since October 2025.
4. Have a second person approve. The person who approves is never the person who entered the change.
5. Block payment until approval. The new account is not used until both checks are recorded.
6. Tell the supplier. Send a notice to the contact on file that its bank details changed, so a real supplier can raise the alarm.

ERPs can enforce these rules. In SAP, the bank fields can be declared sensitive. A change then blocks the supplier for payment until another user confirms it, and the system checks that the person confirming did not make the change. In Oracle Fusion Cloud Procurement, changes to bank accounts are routed for approval in a change request, which can require a document such as a bank letter. Check that these controls are switched on before go-live.

How do you keep supplier data clean over time?

Supplier data decays: companies move, merge, change owners and close. Keeping it clean takes a few rules at every change and a regular review.

• Complete. Mandatory fields depend on the supplier type: a foreign supplier needs a VAT or tax number, a sole trader may need a tax form such as the US Form W-9.
• Valid. Check numbers against official services where they exist: the IRS TIN Matching service for US payers, VIES for EU VAT numbers, the GOV.UK check for UK VAT numbers.
• Unique. One legal entity, one record, with sites or addresses under it.
• Current. Block suppliers with no order or payment for a period the policy sets, for example 18 months, so that old records cannot be reused for a fraudulent invoice.

Personal data adds a legal duty. A sole trader’s record holds a person’s name, address and bank account. In the EU, the GDPR requires personal data to be “accurate and, where necessary, kept up to date” and kept no longer than necessary, so define how long closed records are kept.

What does a supplier data clean-up look like?

A worked example, with fictional figures. A group with three companies has 12,400 supplier records in its ERP. Before moving to a new procure-to-pay tool, it decides to migrate only clean, active suppliers.

The figures check: 12,400 − 7,100 = 5,300; merging 420 records into 190 removes 230, leaving 5,070; 5,070 − 620 = 4,450. Filtering inactive suppliers first shrinks the duplicate check.

How do you choose supplier master data management software?

Supplier master data management software comes in three forms, and the right one depends on where the master record lives. The ERP can manage it with its own workflows. A supplier management suite can collect data through a portal and send the approved record to the ERP. A general master data management platform can manage suppliers alongside customers and products.

Analysts describe supplier information management as software that collects, organises and maintains supplier information through supplier self-service, data enrichment and validation, and internal workflows. The supplier management software guide compares those suites more widely.

1. List the systems that hold supplier data today (ERPs, procure-to-pay tool, contract tool, spreadsheets) and decide which one is the system of record.
2. Count the work: active records, new suppliers per month and changes per month, bank changes in particular.
3. Write test cases from real events: a duplicate under another name, a bank change requested by email, a supplier sold to a new owner, a sole trader asking for its data to be deleted.
4. Ask each candidate to run them on a sample of your data: duplicate found by tax number, bank change blocked until a second approval, approved record reaching the ERP, full audit trail.
5. Check the link to the ERP: which fields are sent, how often, and what happens when the ERP refuses an update.
6. Compare the cost over five years, including integration and the work of bringing existing suppliers into the new process.