Vendor Master Data Audit: The Procurement Control Most Businesses Skip

By CA Dhruv Seth, Seth & Associates, Chartered Accountants, Lucknow

Most owner-managed businesses discover the same thing the first time someone actually looks: the vendor master has grown to three or four times the number of suppliers the company really buys from. The same supplier sits under three names, each with a different bank account. Nobody has ever closed a vendor code, because nobody owns the file. That is not a housekeeping problem but a control problem, and usually the cheapest one to fix.

Why the master file matters more than the transactions

Every rupee your company pays a supplier leaves through a vendor code. The purchase order, the goods receipt note and the invoice can all match perfectly, and the money can still reach the wrong bank account, because the control that mattered sat upstream: who could create that vendor, and who could change its bank details afterwards.

That is why a vendor master data audit is the right place to begin a procurement review. Transaction testing samples; master data testing is complete — every vendor record can be examined, not forty of them.

What a vendor master data audit looks for

Four exceptions do most of the work:

• Duplicates on hard identifiers: the same PAN, GSTIN, bank account number or address under two or more vendor codes. The same bank account under different vendor names is the highest-yield exception in procurement audit.

• Overlap with employee records: vendor bank accounts, addresses, phone numbers or PAN matched against the payroll master. A match proves nothing on its own, but it demands an explanation in writing.

• Dormant but active codes: no transaction for eighteen months, still open for payment. These are the codes a dishonest buyer reuses, precisely because nobody watches them.

• Change history on banking fields: who changed a bank account, when, and how close that change sat to the next payment. A bank detail amended days before a large payment, by someone who also releases payments, is the classic pattern.

The reports to ask for, and the question to put

Ask your finance head for three reports this quarter: all active vendors sorted by last transaction date; a duplicate report run on bank account number, PAN and GSTIN; and the master change log for the last twelve months, restricted to bank and address fields, showing the user ID behind each change.

Then put one question to your procurement head. Who can create a vendor code in our system, and can that same person raise a purchase order? If the answer is yes, or if it is “accounts opens the code when purchase sends an email”, you do not have segregation of duties, whatever the policy manual says.

What a dirty master costs in tax and credit

Under Section 37(2)(g) of the Income-tax Act, 2025 — in force from 1 April 2026, and the successor to Section 43B(h) of the old Act — amounts payable to a micro or small enterprise are deductible only in the tax year of actual payment if the supplier is not paid within the Section 15 timeline under the MSMED Act, 2006: 45 days where there is a written agreement, 15 days where there is not. And unlike every other item in that list, this one gets no relief for paying by the return-filing due date. Without a reliable Udyam flag in the master, your team cannot identify which invoices are on the clock.

Under the second proviso to Section 16(2) of the CGST Act read with Rule 37, input credit must be reversed, with interest, if a supplier is not paid within 180 days. Your vendor ageing is a tax report, not merely a treasury one. And credit denied because a supplier’s registration was cancelled is credit lost, so revalidate vendor GSTINs periodically.

The bottom line

• Run the duplicate bank account test first. It is the fastest route to a real finding.

• Whoever creates vendors must not be able to raise or approve purchase orders.

• Confirm every bank account change with the supplier on a number already on record, never on the strength of an email alone.

• Udyam status and GSTIN validity belong in the master as maintained fields, because tax deductions and input credit turn on them.

Procurement controls fail quietly. The vendor master is where the failure shows up earliest, and where it is cheapest to correct.

This article is for general information and does not constitute audit, legal or tax advice. Regulations change; please verify the current position or speak to a qualified adviser before acting.