Vendor Empanelment: Procurement's Weakest Control

Owners tend to look for procurement problems late in the cycle: the price paid, the quantity received, the payment released. By then most of the important decisions have already been made. The supplier was approved months or years earlier, usually by one buyer, on a form nobody independently checked. Vendor empanelment is the front door of procurement, and in most owner-managed businesses scaling past Rs 100 crore it is the weakest control in the whole cycle.

What vendor empanelment is meant to establish

Empanelment should settle three questions before a supplier is allowed a code in your system:

• Can this vendor actually do the work, at the quality and volume we need?

• Is the vendor legally and financially clean, and will dealing with them cost us anything in tax?

• Is the vendor connected to anyone inside our own organisation?

Most empanelment files answer the first question partly. The other two are usually assumed.

Documents collected, never verified

A vendor file thick with photocopies is not a control. Verification is the control, and most of it takes minutes.

• GSTIN. Check the registration status on the GST portal at empanelment and periodically afterwards. Under Rule 37A of the CGST Rules, if a supplier has not filed the relevant GSTR-3B by 30 September following the end of the financial year, you must reverse that input tax credit in your GSTR-3B filed on or before 30 November, with interest under Section 50 if you do not. Your supplier's filing discipline is your working capital.

• Udyam registration. The Udyam portal allows free verification of a registration number without an OTP, and shows the micro, small or medium classification and whether the vendor is a manufacturer or a trader. Take the certificate on record and re-verify each year, because classification changes.

• Bank account. The account name must match the vendor's legal name. Not 'close enough', not a proprietor's personal account for a private limited vendor.

• Address, phone and email. The useful test is not whether they are on file, but whether any of them are shared with another empanelled vendor.

The conflict of interest test nobody runs

The Companies Act deals with the obvious case. Under Section 184, every director gives a disclosure of interest in Form MBP-1 at the first board meeting of each financial year; Section 188 governs transactions with related parties; Section 189 requires a register of such contracts in Form MBP-4. That machinery catches directors. It does not catch the purchase manager whose brother-in-law supplies your packing material.

That test is a data exercise your ERP can run. Match the vendor master against the employee master on PAN, address, mobile number, email domain and bank account number, then match the vendor master against itself on the same fields. Ask for that exception report by name. If it has never been run, that is itself the finding.

Pre-qualification proportionate to risk

Not every vendor deserves the same scrutiny, and pretending otherwise is why empanelment becomes a rubber stamp. Set a threshold: above a defined annual spend, or for anything that stops your line if it does not arrive, ask for the last two years' financial statements, evidence of capacity, quality certifications where relevant, and a plant visit report signed by someone other than the buyer who sourced the vendor.

One number is worth pulling out of those financials: your share of the vendor's turnover. Once you are 30 to 40 per cent of their revenue, their solvency has quietly become your supply risk, and your negotiating leverage is no longer free.

Approval with no expiry date

Vendors get approved once and stay approved forever. Two questions worth putting to your CFO this month: how many active vendor codes have had no transaction in the last 24 months, and who can reactivate a dormant code without a fresh approval? A dormant but live vendor code, with bank details already loaded, is the cheapest route a fraudulent invoice will ever find.

The bottom line

• Empanelment fixes quality, price and risk long before a purchase order is raised. Control the front door rather than relying on downstream matching to catch what got through it.

• Verification is not documentation. GSTIN status, Udyam number and bank account name should be checked, not merely filed.

• Run the vendor-to-employee and vendor-to-vendor duplicate test on address, PAN, phone and bank account. It is a database query, not a project.

• Re-validate empanelment annually, deactivate dormant codes, and keep approval of a new vendor with someone who does not raise the purchase order.

• Once a company crosses the thresholds in Section 138 of the Companies Act, 2013 read with Rule 13 of the Companies (Accounts) Rules, 2014, including turnover of Rs 200 crore or more, an internal audit function becomes a statutory requirement. Vendor empanelment is a sensible first place to point it.

By CA Dhruv Seth, Seth & Associates, Chartered Accountants, Lucknow | dhruv@sethspro.com

This article is for general information and does not constitute audit, legal or tax advice. Regulations change; please verify the current position or speak to a qualified adviser before acting.