What are supplier onboarding best practices, and how do you apply them?
Short answer
Supplier onboarding best practices keep one way in, set checks by risk, verify bank details independently, publish a time target and fix the process before automating it.
Key takeaways
- Every new supplier comes in through one form or one tool. A supplier created directly in the ERP, outside that route, is where duplicates and unchecked bank details start.
- Set the checks by risk tier, not one list for all. A €400 one-off purchase and an IT provider with access to customer data need different checks.
- Confirm bank details through a channel the supplier did not choose, and keep the person who enters them apart from the person who approves them.
- Publish a time target per tier and run checks in parallel. Speed comes from asking once and checking at the same time, not from dropping checks.
- Fix the process and the forms first, then automate validations, routing and reminders. Automation copies whatever process it is given.
What are supplier onboarding best practices?
Supplier onboarding best practices are the rules that make onboarding both fast and safe: one way in for every request, checks set by the supplier’s risk, independent confirmation of bank details, a published time target, a complete record of each check, and a process fixed before it is automated. Each one removes a known failure.
Supplier onboarding is the process that collects, checks and approves a new supplier’s data before it can receive orders and be paid. The steps, the onboarding form, the checks by country and a checklist are explained in what is supplier onboarding. This guide is about how to run that process well, practice by practice.
Each practice below answers a concrete problem. A requester emails a buyer: “Can you create this supplier today? The work starts tomorrow.” An invoice arrives from a supplier that was never approved. An email on the supplier’s letterhead asks to pay the next invoices into a new account. A best practice is worth adopting when it stops problems like these, and when a figure shows that it did.
Which practices matter most, and what does each one fix?
The table lists the practices that come back in most onboarding programmes, roughly in the order they need to be built. Each line names the problem it fixes and a simple measure that shows whether it works. The formulas for the main onboarding metrics are on the supplier onboarding page.
| Practice | Problem it fixes | What to do | Measure that shows it works |
|---|---|---|---|
| One way in | Suppliers created directly in the ERP by someone in a hurry, with no checks | Route every request through one form or tool; remove supplier-creation rights from everyone else | Supplier records created outside the workflow (target: none) |
| Check the need first | A new supplier added when an existing contract already covers the need | Ask the requester which existing supplier or contract was considered, and show the options in the form | Requests closed because a contract already existed |
| Checks by risk tier | Heavy checks on a one-off €400 purchase, light checks on an IT provider with data access | Classify each request into a tier from a few questions, and attach the checks to the tier | Share of requests sent back for missing tier information |
| Ask once | The supplier sends the same certificate three times to three teams | One form per supplier type; reuse data already held for other entities of the group | Supplier drop-off rate in the portal or form |
| Independent bank confirmation | Payment to a fraudster’s account after a fake change request | Call back on a number taken from an independent source; separate entry and approval | Active suppliers with a recorded bank check |
| Published time target | Requesters bypass the process because they do not know how long it takes | Publish a target per tier and show each request’s status to the requester | Cycle time by tier, read with the first-time-right rate |
| Record every check | Nobody can show an auditor what was verified, or when | Store the result, date and checker of each check in the supplier record | Records with a complete check history |
| Plan expiry at the start | Orders placed after an insurance certificate or a contract has lapsed | Record end dates and block new orders automatically when they pass | Active suppliers with an expired mandatory document |
| Enable, not only approve | An approved supplier still cannot receive purchase orders or send invoices | Test the order and invoice channel before the first real order | First invoices rejected for set-up errors |
| Fix, then automate | A slow process becomes a fast process with the same errors | Simplify fields and owners first, then automate validations and routing | Manual touches per request after automation |
Build the first three practices before anything else: one way in, a need check and risk tiers remove most of the work and most of the exposure.
How do you set onboarding checks by risk tier?
You set onboarding checks by risk tier by asking a few questions at the start of the request, then attaching a fixed set of checks to each answer. The questions are simple: how much will we spend, will the supplier access our systems, sites or personal data, and what happens if it fails. A florist for a one-day event and a payroll provider then follow different routes.
Regulators take the same view. US banking regulators’ 2023 guidance on third-party relationships says that not all third-party relationships present the same level of risk or criticality, and it describes due diligence as one stage of a life cycle that continues with monitoring and termination. The US Treasury’s sanctions compliance framework says the risk assessment generally informs how much due diligence is done, including at onboarding. ISO 9001 asks organisations to set criteria for evaluating and selecting external providers, and to keep records of those evaluations.
| Tier | Typical supplier | Checks | Approvals | Example time target |
|---|---|---|---|---|
| Low | One-off purchase below a set amount, no access to systems, sites or personal data | Legal name and tax number, sanctions screening, bank confirmation if paid by transfer | Buyer; finance for bank details | 2 working days |
| Standard | Recurring goods or services with no data or system access, such as office supplies | Low-tier checks plus company register, insurance certificates and agreed terms | Buyer and finance | 5 working days |
| High | Access to personal data, IT systems or sites, such as a payroll provider or an IT service desk | Standard checks plus information security questionnaire, data processing agreement and financial health | Buyer, finance, IT security and data protection | 15 working days |
| Critical | Failure would stop operations or harm customers, such as a sole source for a key component | High-tier checks plus business continuity, an exit plan and, if needed, a site visit | As above, plus the budget owner’s director | Set case by case |
Four tiers are enough for most organisations; what matters is that the tier is decided from answers in the form, not by whoever handles the request.
Some checks come from law, not from choice. Under the EU GDPR (Article 28), an organisation may use only processors that give sufficient guarantees, and it needs a contract with specific terms before a supplier processes personal data on its behalf. That is why the data processing agreement sits in the high tier. For a low-value, one-off need, the cheapest route can be to skip onboarding entirely: the US federal rules, for example, make the government purchase card the preferred method for micro-purchases. How cards work is explained in what is a P-card.
Deeper risk work, such as scoring, monitoring and reviews after onboarding, belongs to vendor risk management. Onboarding only needs to decide the tier and collect the evidence that tier requires.
How do you protect bank details during onboarding?
You protect bank details by confirming them through a channel the supplier did not choose, and by treating every later change as a new onboarding check. The typical attack is simple: an email that looks like it comes from a known supplier asks to pay future invoices into a new account. If accounts payable updates the record from that email, the next payment goes to the fraudster.
The risk is common. In the 2025 Payments Fraud and Control Survey of the Association for Financial Professionals (AFP), 79% of 521 responding organisations reported attempted or actual payments fraud in 2024, and 45% reported vendor impostor fraud, up 11 percentage points on the previous survey. The FBI’s Internet Crime Complaint Center recorded about $3.05 billion of reported business email compromise losses in 2025, from complaints filed with it alone.
- Call back on a known number. Take the phone number from the contract, the supplier’s official website or an earlier verified record, never from the email or letter that asks for the change.
- Use the checks banks offer. In the UK, Confirmation of Payee checks the account name before a payment is sent. Where no such service exists, ask for a bank letter and confirm it by phone.
- Separate the roles. The person who enters bank details does not approve them. The GAO’s internal control standards describe this segregation of duties so that no single person controls all key steps of a transaction.
- Treat changes like new suppliers. A change of bank account follows the same confirmation as the first set-up, even for a supplier paid every month for ten years.
- Record the check. Write in the supplier record who confirmed the details, on which number and on which date.
How do you speed up supplier onboarding without dropping checks?
You speed up supplier onboarding by asking for each piece of data once, filling what you can from official registers, and running independent checks at the same time instead of one after the other. Most delay comes from waiting: a form sent back for a missing field, a certificate chased by email, a check that starts only when the previous one ends.
- Validate data as it is typed. A VAT number can be checked against VIES in the EU or the GOV.UK service in the UK; in the US, payers that file information returns can use the IRS TIN Matching service. Sanctions lists from OFAC, the EU and the UK can be screened at the same moment.
- Run checks in parallel. Insurance, bank confirmation and tax checks do not depend on each other. Start them together once the form is complete.
- Show the status. A requester who can see “waiting for the supplier’s insurance certificate” chases the supplier, not procurement.
- Give suppliers one contact and plain instructions. A short guide with the documents per tier, in the supplier’s language where possible, reduces back-and-forth.
The worked example below follows one standard-tier supplier, a facilities maintenance company, before and after these changes. The company and its figures are fictional.
| Step | Before (days) | After (days) | What changed |
|---|---|---|---|
| Request and supplier form | 6 | 2 | One form per supplier type; register data filled automatically |
| Procurement review | 3 | 1 | Tier decided by the form; review only of exceptions |
| Tax number and sanctions checks | 2 | 1 (during the review) | Automatic checks run while procurement reviews |
| Insurance certificate | 5 | 4 (with the bank check) | Requested in the form; chased automatically |
| Bank confirmation | 4 | 4 (with the insurance) | Started at the same time as the insurance check |
| Record creation in the ERP | 2 | 1 | Record created from the approved form, no retyping |
| Elapsed time | 22 | 8 | Steps run in parallel instead of in sequence |
The checks did not change; the elapsed time fell from 22 to 8 working days because waiting time and retyping were removed.
Before, the six steps ran one after the other: 6 + 3 + 2 + 5 + 4 + 2 = 22 working days. After, the automatic checks run during the one-day review, and the insurance and bank checks run side by side for four days: 2 + 1 + 4 + 1 = 8 working days. Read cycle time with the first-time-right rate and the share of bank details verified, so that speed is never bought by skipping a check.
What are the best practices for automating supplier onboarding?
The best practices for automating supplier onboarding follow one order: standardise the forms and the tiers, decide who owns each check, then automate the checks and the routing. Automating a form with ten optional fields and no owner for bank changes only produces the same mistakes faster.
- Write down the current process and cut what nobody uses: fields never read, approvals that never refuse anything, copies sent “for information”.
- Fix the tiers and the checks per tier, with an owner for each check.
- Automate validations that have a reliable source: tax and VAT numbers, company registers, sanctions lists, bank account name checks where available.
- Automate routing and reminders: send each request to the right approvers for its tier, and chase suppliers and approvers after a set delay.
- Automate expiry: alert the owner before a certificate or a contract ends, and block new orders when it does.
- Keep people for exceptions: a sanctions match, a bank detail that does not match, a supplier that refuses a contract clause.
A supplier portal lets the supplier enter and update its own data, which cuts typing errors; see what is a supplier portal. How to compare dedicated tools is explained in supplier onboarding software. Whatever the tool, the supplier record it produces must stay clean over time, which is the job of supplier master data management.
Who owns which part of supplier onboarding?
Supplier onboarding works when each check has one owner and nobody can approve their own request. Procurement usually owns the process and the timeline, finance owns tax and bank data, and specialists review only the tiers that need them.
| Role | Owns | Does not do |
|---|---|---|
| Requester | The need, the check that no existing supplier fits, the business contact at the supplier | Promise orders before the supplier is approved |
| Procurement | The tier, the data review, the contract or terms, the timeline | Approve bank details |
| Finance and accounts payable | Tax data, bank confirmation, payment terms | Create a supplier without an approved request |
| Compliance, legal, IT security, data protection | High and critical tier checks, sanctions matches, data processing terms | Review low-tier suppliers by default |
| Supplier | Complete and correct data and documents, and updates when they change | Change bank details by email |
Give each check one owner, and keep the person who requests or enters a supplier away from the approval of its bank details.
What mistakes undo supplier onboarding best practices?
- A back door that stays open. One manager keeps the right to create suppliers in the ERP “for emergencies”, and emergencies become weekly.
- One form for everyone. Small suppliers give up halfway, and buyers start paying them through expense claims instead.
- Checks done once and never again. Insurance certificates and sanctions results age. Without end dates and re-checks, the record shows a supplier that was safe two years ago.
- Measuring speed only. A team rewarded on cycle time alone learns to skip the slowest check, which is often the bank confirmation.
- Onboarding suppliers nobody uses. Records created for a single quote and never used stay active and become a target for fraud. Block or archive them after a set period without orders; supplier lifecycle management covers these status changes.
Questions
How long should supplier onboarding take?
No public benchmark compares organisations on the same definition, so set your own target per risk tier and publish it. For example, a team might start with a few working days for a low-risk supplier and two to three weeks for a supplier with access to data or systems, then adjust. Track the trend in your own data.
Do one-off suppliers need full onboarding?
No. A low-risk, one-off supplier needs only the checks that protect payment: identity and tax number, sanctions screening and bank confirmation if paid by transfer. For very small amounts, paying by purchasing card can avoid creating a supplier record at all.
How often should supplier checks be repeated?
Repeat each check when its evidence expires or the risk changes. Insurance and certificates have end dates; sanctions lists change constantly, so screening is usually repeated on every list update or at a fixed interval; bank details are rechecked at every change request.
What is the first best practice to put in place?
One way in. As long as people can create suppliers directly in the ERP, every other practice can be bypassed. Remove creation rights from everyone outside the workflow, and give requesters a form that is easier than the back door.
New guides on the supplier management line
One short email when a guide on this line is added or revised. Nothing else.
Coming soon: sign-up opens with the first email.