Supplier List: How to Build and Maintain One

Almost every organisation has a supplier list somewhere. Far fewer have one they trust. The difference is not software, it is treatment: a good list is a maintained working record with owners, rules and a review cycle, not a spreadsheet somebody exported once. This guide covers the fields a supplier list should hold, how to build your first one from accounts payable and purchase order data, how to deduplicate and normalise names, how to categorise by spend and criticality, and how to stop the whole thing rotting.

What a supplier list actually is

A supplier list is the record of the organisations your business buys goods and services from. One row per supplier, with enough information attached that someone in finance, procurement or operations can act without ringing round to ask who this company is and who deals with them.

That sounds trivial and it is not. In most mid-sized organisations the answer to "how many suppliers do we have?" varies by several hundred depending on who you ask and which system they query. Finance sees everyone who has ever been paid. Procurement sees everyone with a contract. Operations sees the twenty they speak to weekly. The supplier list exists to be the version everybody agrees on, sitting underneath the wider procurement process as the reference layer that requisitions, orders and payments all point back to.

It is worth being clear about what it is not. A supplier list does not grant permission, does not imply preference, and does not certify that anyone has been vetted. It is descriptive. The moment you start using it to answer "may I buy here?" you need a different artefact, which is where the distinction covered later in this guide matters.

The value of having one is mostly quiet. Nobody celebrates an accurate supplier list, but a great deal of routine friction disappears when it exists. Onboarding a new buyer takes hours instead of weeks because the knowledge is written down rather than held in three people's heads. Invoice queries resolve on the first call because the finance contact is recorded. Contract renewals stop arriving as surprises. And when something goes wrong, from a factory fire to a sanctions listing, you can answer "are we exposed?" in minutes rather than spending a day reconstructing the answer from payment runs.

What a good supplier list contains

The fields below are the ones that repeatedly prove their worth. Copy the structure, drop what you do not need, and resist the urge to add columns nobody will maintain. A list with twelve accurate fields beats one with forty fields where thirty are blank.

Two of those fields carry more weight than the rest. The internal owner turns an anonymous row into somebody's responsibility, and the last verified date makes decay visible. A list where half the records were last touched two years ago is telling you something useful, provided you have recorded the dates to see it.

Building your first list from AP and PO data

Do not start with a blank template and a round of emails asking teams who they buy from. You will get the suppliers people remember, which correlates poorly with the suppliers you actually pay. Start with money that has already moved.

• Export twelve months of accounts payable. Every payee, every payment, with amounts and dates. This is your ground truth for who is genuinely being used.
• Export the same period of purchase orders. Suppliers with orders but no payments, and payments with no orders, are both worth flagging early.
• Pull card and expense data. Corporate card spend hides a surprising number of recurring suppliers, especially in software and services.
• Combine into one sheet. One row per payee name, with total spend, transaction count, first and last transaction date.
• Sort by spend, descending. This is your work queue. In most organisations the top fifty names cover well over half the total.
• Enrich from the top down. Fill the full field set for the top tier first, then work down until the effort stops paying for itself.

The point of working top down is that you get a usable list in days rather than a perfect one in months. The long tail of suppliers with a single small transaction each can sit in a holding area with name, spend and status only. If one of them becomes significant, it earns the full treatment then.

This first pass usually produces a second, unplanned benefit: it is often the first honest spend analysis the organisation has seen. Expect to find duplicate suppliers for the same category, forgotten subscriptions, and at least one supplier being paid on three different sets of terms.

Decide up front how much enrichment each tier deserves, because this is where first attempts usually stall. A practical rule is that the top decile by spend gets every field completed and verified with the supplier directly, the middle gets the core commercial fields filled from contracts and invoices, and the tail gets name, spend, category and status only. Write that rule down before you start so nobody disappears for three weeks chasing insurance certificates from a supplier you spent ninety pounds with.

Expect the raw export to overstate your supplier count considerably. Between duplicates, one-off payees, employee expense reimbursements and internal transfers, the list of names in accounts payable is usually far longer than the list of organisations you actually have a relationship with. Reducing that number is not cosmetic. It is the first real result the exercise produces.

Deduplicating and normalising supplier names

This is the unglamorous work that determines whether everything else functions. Raw payee data is messy: the same company appears as "Acme Ltd", "ACME LIMITED", "Acme Ltd." and "Acme (UK)", each with its own spend figure, so no report about that supplier is correct.

Match on identifiers rather than strings wherever you can. Company registration numbers, tax numbers and verified bank references are far more reliable than names, because names are typed by humans in a hurry. Where you only have names, normalise before comparing: strip punctuation, standardise legal suffixes, fold case, remove leading articles, and only then look for near matches.

Then decide your naming convention and write it down. Registered legal name in a defined format, trading names in a separate alias field, no abbreviations invented by whoever typed the record. Parent and subsidiary relationships need a decision too: if you buy from three entities in one group, you either hold them as three records linked to a parent, or as one record with sites. Either works. Mixing both does not.

Finish by putting a gate on creation. Most duplicate problems are not historic, they are ongoing, because anyone can add a supplier and nobody checks first. A required search step, a mandatory registration number, and a single team that approves new records will prevent more mess than any amount of periodic cleanup.

Budget realistically for this stage. Deduplicating a few thousand payee names is typically a week or two of concentrated work for one person who knows the business, plus review time from finance. Tooling helps with the matching, but the judgement calls, deciding whether two similar names are the same company, a subsidiary or a coincidence, still need somebody who understands what you buy and from whom.

Categorising by spend and criticality

An undifferentiated list of eight hundred suppliers gives you no guidance about where to spend your attention. Two dimensions solve that, and they need to be kept separate because they answer different questions.

Spend tells you where the money is and therefore where negotiation and consolidation pay off. Rank suppliers by annual value and you will typically find a small group accounting for most of it. Those are the relationships worth managing actively, with reviews, performance data and contract discipline.

Criticality tells you where the risk is, which is a different list entirely. The supplier who provides a small annual quantity of a single certified component, with no qualified alternative and a four month lead time, may be trivial in spend and existential in exposure. Rate each supplier on how quickly you could replace them, whether an alternative is already qualified, and what stops if they fail.

Add a consistent category taxonomy on top and the list starts answering real questions: how many suppliers do we use for packaging, what do we spend across all of them, and could three do the work of eleven. That is where a supplier list stops being an address book and becomes an input to supplier management.

Keeping contacts and documents current

Contact data is the fastest-decaying part of any supplier list. People change jobs, companies restructure, email domains change after acquisitions. A reasonable assumption is that a meaningful share of your contacts go stale each year, and you will not notice until you urgently need one of them.

Hold roles rather than only people. A record that names the account manager, the finance contact and the escalation point is more resilient than one holding a single mobile number for someone who left. Where a supplier offers a shared team address for orders or invoicing, capture it alongside the individual, since the shared address usually outlives the individual.

Documents need a different discipline because they have hard dates. Insurance certificates, quality certifications, tax registrations and licences all expire, and an expired document is only a problem at the moment you discover it, which is invariably the worst moment. Store the expiry date as a field, not as text inside a PDF, and let it drive a reminder well before the deadline.

The most effective fix is to stop being the sole author of the record. Supplier self-service, where the supplier maintains their own contacts, addresses and documents against a record you control, shifts the maintenance burden to the party who knows first when something changes. In ProcureWave, expiry dates and contact changes sit on the supplier record itself and surface at the point an order is raised, so a lapsed certificate is caught before it matters rather than during an audit.

Supplier list, approved vendor list and supplier master

These three terms get used interchangeably and they should not be, because each answers a different question and each has a different owner.

The supplier list is descriptive. It answers "who do we buy from?" and includes everyone with a trading relationship, active or dormant. It is the widest of the three and usually the most useful day to day, because most questions people ask are lookups rather than decisions.

The approved vendor list is prescriptive. It answers "who are we allowed to buy this from?" and contains only the subset that has passed defined checks for defined categories, with approval dates, scopes and expiry. It should always be shorter than the supplier list, and the governance behind it is covered properly in our guide to the approved vendor list.

The supplier master is the system of record. It is the authoritative data set inside your ERP or finance platform that payments actually run against, typically controlled by finance with strict change rules around banking details. The supplier list may be a view of it, but the master is the one with the tightest controls, because that is where payment fraud is prevented.

The failure mode is letting all three drift apart, so procurement's list, finance's master and the approved list each describe a different population. Keep one authoritative source per fact, decide which system owns which field, and make the others read from it rather than keeping their own copy.

In practice a supplier usually appears in all three. They join the supplier list from the day someone first buys from them, they enter the supplier master when finance sets them up for payment, and they reach the approved list only once the relevant checks are complete for a named category. Thinking of that as one record wearing three hats, rather than as three separate lists, is what keeps them aligned.

Access, ownership and change control

A supplier list that everybody can edit becomes unreliable, and one that only one person can edit becomes out of date. The answer is granular rather than binary access.

Read access should be broad. Anyone raising a request, chasing a delivery or querying an invoice benefits from seeing the record, and restricting visibility just pushes people back to private spreadsheets. Write access should be scoped by field. Relationship owners maintain contacts, notes and category data for their own suppliers. Procurement controls categories, criticality tiers and status. Finance alone changes banking details and payment terms, ideally with dual approval, because that single control prevents the most expensive category of supplier fraud.

Every record needs one named owner. Not a department, a person. Ownership is what converts an annual review from an unassigned chore into a specific task with a specific name on it, and it gives anyone with a question somebody to ask. When an owner leaves, reassigning their supplier records should be part of the leavers process, otherwise the list accumulates orphans.

Keep a change history. Who changed what, when, and ideally why. It is invaluable when a payment goes astray, when a supplier disputes terms, or when an auditor asks how a record came to hold the values it does. This audit trail is also what makes broader vendor management defensible rather than anecdotal.

The review cadence that stops it rotting

Every supplier list decays. Suppliers merge, close, rebrand and change hands, contacts move on, terms get renegotiated in an email nobody copies into the record. Left alone, accuracy falls noticeably within a year and substantially within three. The only defence is a cadence that is proportionate enough to survive contact with a busy quarter.

Run it on three clocks. Event-driven changes happen immediately: a new supplier is created through the proper gate, a bankruptcy or acquisition updates status the day you hear about it, a contract signature updates terms. Date-driven checks fire on their own schedule: document expiries, contract renewals and insurance renewals each raise their own reminder, independent of any review. Cycle-driven reviews cover the rest, with strategic and critical suppliers verified quarterly and everyone else annually.

Add an archiving rule and enforce it. Any supplier with no transactions for eighteen to twenty four months moves to dormant, and dormant records drop out of default views while remaining searchable and fully intact for reporting. Pruning is what keeps the active list small enough to be maintainable, and a list of two hundred verified active suppliers is worth far more than eight hundred names of unknown quality.

Track two numbers to know whether any of this is working: the share of records verified within the review window, and the share of spend flowing to suppliers on the list rather than to names that appear only in accounts payable. Both are easy to measure and both tell you the truth. Where the list is maintained inside the same system that raises requisitions and orders, most of the maintenance happens as a by-product of normal work, which is the point at which supplier relationship management becomes practical rather than aspirational.

If your own list currently lives in a spreadsheet that three people maintain differently, start with the top fifty suppliers by spend, clean those properly, and put an owner and a verification date on each one. You will learn more from that fortnight than from any amount of planning. And if you would like to see what a supplier list looks like when it is connected to requisitions, orders and invoices rather than sitting on a shared drive, get in touch and we will walk through it using your own categories.

One last piece of advice: treat the list as infrastructure rather than a project. Projects finish, and a supplier list that has finished is one that has started decaying. The organisations with genuinely reliable lists are rarely the ones that ran the biggest cleanse. They are the ones that made the record part of daily work, so that raising an order, paying an invoice or renewing a contract each leaves the list slightly more accurate than it found it.

Frequently asked questions

What is a supplier list?

A supplier list is the working record of the organisations your business buys from. It holds one row per supplier with the details anyone needs to trade with them: legal name, category, contacts, payment terms, status and an internal owner. It is a reference tool rather than a permission tool, which is what separates it from an approved vendor list.

What should a supplier list include?

At minimum a unique supplier ID, the registered legal name, any trading names, category, primary and finance contacts, address, tax or registration number, payment terms, currency, status and an internal owner. Most teams then add annual spend, criticality tier, contract reference and document expiry dates, because those four fields are what turn a directory into something you can make decisions from.

How do I build a supplier list from scratch?

Export twelve months of accounts payable transactions and purchase orders, combine them into one sheet, and treat that as your raw population. Deduplicate the names, fill in the missing fields for your highest-spend suppliers first, then work down the list. Starting from money already paid means you capture the suppliers you genuinely use rather than the ones people remember.

Who should own the supplier list?

One team owns the record and several teams contribute to it. Procurement usually owns the structure, categories and review cadence. Finance owns banking and payment terms and normally controls changes to them. Individual category or relationship owners keep contacts, contracts and performance notes current for their own suppliers.

How often should a supplier list be reviewed?

Continuously for changes and on a fixed cycle for accuracy. Critical suppliers deserve a quarterly check on contacts, contracts and documents. Everyone else can be reviewed annually, with dormant records archived once they have had no activity for eighteen to twenty four months. Document expiry dates should trigger their own reminders rather than waiting for the review.