Define the authoritative record
Assign an immutable internal vendor identifier and separate it from external ERP IDs. Record legal entity, trading names, registrations, addresses, tax identifiers, ownership, contacts, categories, status and provenance. Define which system is authoritative for every field.
Create a controlled data dictionary
For each field specify type, format, permitted values, required or conditional status, authoritative source, validation, owner, sensitivity, retention and downstream mappings. Tenant categories should use the controlled list, with Other as a governed exception rather than invented AI labels.
Prevent and resolve duplicates
Match normalized legal names, registration and tax numbers, domains, addresses, bank details and ownership signals before creation. Potential matches should be reviewed, not silently merged. Preserve merge history and redirects between identifiers.
Protect bank-detail changes
Treat bank changes as high-risk transactions: authenticated request, independent callback using an established contact, name and account checks, maker-checker approval, cooling-off or payment hold where policy requires, and a complete audit trail.
Govern lifecycle status
Use explicit states such as prospect, onboarding, remediation, approved, conditional, suspended, rejected and inactive. Define allowed transitions and consequences for sourcing, contracting and payment. Expired evidence should trigger governed review rather than uncontrolled deletion.
Integrate without losing control
Use tenant-scoped credentials, stable external identifiers, idempotency for writes, pagination for reads, documented schemas, audit logs and clear system-of-record ownership. Synchronise state changes through events or controlled polling and reconcile failures.
Measure data quality
Track duplicates, incomplete mandatory fields, unverified fields, expired evidence, unmatched integrations, bank-change exceptions, stale owners and time to resolve. Report quality by business unit and accountable steward.
Related resources
Sources and research basis
This guide distinguishes general control recommendations from legal requirements. It is general information, not legal advice; applicability varies by entity, sector, jurisdiction and contract.