Every organisation verifies new suppliers, but the depth and consistency of that verification varies widely. Some checks are done for every supplier. Others depend on the reviewer, the urgency or whether anyone remembered.
The checks below are a starting point. Not every supplier needs every check. The aim is to decide deliberately, by risk, rather than by habit.
1. Legal identity
Confirm that the supplier is a real, registered entity and that the name you are contracting with matches the registration. Check the registration number against an official registry for the supplier’s country, and record the registered address.
Why it matters: many downstream problems, from payment fraud to contract disputes, start with a mismatch between the trading name and the legal entity.
2. Tax registration
Validate tax or VAT identifiers in the format and registry that apply to the supplier’s country. Confirm that the tax registration belongs to the same entity.
Why it matters: invalid tax details can make invoices non-compliant and create recovery problems later.
3. Bank details
Confirm that the bank account belongs to the supplier, typically with a bank letter or a verification service. Pay particular attention to any change of bank details after onboarding.
Why it matters: bank detail fraud often targets the moment a supplier is set up or updated. A strong control here protects every future payment.
4. Ownership and control
For suppliers above a risk threshold, identify the ultimate beneficial owners and any parent companies.
Why it matters: ownership is the basis for sanctions, conflict of interest and anti-corruption checks. Screening a company without knowing who controls it leaves a gap.
5. Sanctions and watchlists
Screen the entity, and where relevant its owners and directors, against the sanctions lists that apply to your organisation. Decide in advance how often screening is repeated after approval.
Why it matters: screening only at onboarding misses changes that happen during the relationship.
6. Certificates, licences and insurance
Collect the certificates the category requires, such as quality, safety, environmental or professional licences, and the insurance cover your contracts require. Record issuer, scope and expiry date, not just the file.
Why it matters: a certificate is only useful if it is current and covers what you are buying. Expiry dates should drive renewal requests automatically.
7. Policies and declarations
Collect signed declarations for your supplier code of conduct and any category-specific policies, such as data protection or modern slavery statements.
Why it matters: these establish expectations and give you a basis for action if they are breached.
8. Category-specific checks
Some categories need more: information security questionnaires for technology vendors, food safety audits for food suppliers, clinical or regulatory documentation for healthcare.
Deciding how deep to go
A sensible approach is to define two or three risk tiers based on spend, category, country and access to data or sites, and to map each check to the tiers that require it. Write this down. It turns verification from individual judgement into a policy that can be applied, explained and audited.
Recording the decision
Verification is only as good as its record. For each supplier you should be able to show what was checked, against which source, by whom, when, and what decision followed. That is what Skuvet’s verification and audit history is designed to capture, with registry checks where they are enabled and a reviewer’s decision at each exception.
