Every accounting system has a list of the companies you pay. Larger finance teams call it the vendor master file. In a small business it’s usually just the contacts or suppliers screen in Xero, QuickBooks, Zoho Books or whatever you run, and it rarely gets any attention until something goes wrong.
What goes wrong is predictable. A supplier gets created twice, once as “Al Noor Trading LLC” and once as “Alnoor Trading”, and bills get split across both, so the duplicate check never compares them. Bank details saved five years ago are still on file for a supplier that has since changed banks. A freelancer you stopped working with is still active, with payment details anyone could reuse. And the spend report says you have 40 cleaning suppliers when you really have six.
None of this is dramatic on its own. Together it makes every other control in accounts payable weaker, because most of those controls assume the supplier record is right.
Why the supplier list matters more than it looks
Duplicate detection usually works by comparing a new invoice against what the same supplier has billed before. If the same company exists twice in your system, the second record has no history, so the check passes. Bank detail checks work the same way: a change can only be flagged if there’s a reliable previous value to compare it to.
Fraud also leans on weak supplier records. The ACFE’s Occupational Fraud 2024: A Report to the Nations, based on more than 1,900 cases, found billing schemes in 22% of cases, with a median loss of $100,000 and a typical duration of around 18 months before detection. Billing schemes include fake suppliers and altered payment details, and both are easier when nobody looks at who is on the supplier list or when records were last changed. The same report put the median loss for organizations with fewer than 100 employees at $141,000, which is a lot of money for a small company to lose.
There is also a plainer cost. Bad master data is one of the reasons invoices drop out of automated processing and land in someone’s queue. Ardent Partners’ State of ePayables 2025 report shows an exception rate of 20.9% for teams outside its Best-in-Class group, against 11.1% for the Best-in-Class teams, and a touchless processing rate of 29.0% against 51.0%. Supplier data is not the only cause of that gap, but an invoice that can’t be matched to the right supplier record is an exception by definition.
Doing the first cleanup
The first pass is the biggest job. After that, it’s maintenance. Plan for an afternoon if you have a few hundred suppliers, longer if you have thousands.
Start by exporting the full supplier list with every field your system holds, plus a report of payments by supplier over the last two years. Keep the export as a backup before you change anything.
Then deal with the inactive suppliers. Anyone you haven’t paid in, say, 18 to 24 months and don’t expect to pay again should be archived or deactivated, not deleted, so their history stays intact. This alone usually shrinks the list a lot, and every inactive record you remove is one less place for old bank details to be reused.
Next, look for duplicates. Sorting by name catches the obvious ones, but the real duplicates tend to hide behind small differences: “LLC” versus “L.L.C.”, “and” versus ”&”, a trading name versus a legal name, or the same company entered once in English and once in Arabic. Sorting or filtering by tax registration number is often more reliable than sorting by name, because the tax ID shouldn’t change between records. Bank account numbers and email domains are good secondary checks. When you find a duplicate, pick one record to keep, move any open bills to it if your system allows, and deactivate the other.
Then check that the important fields are filled and correct for every active supplier. For most SMEs that means the legal name, the tax registration or VAT number, the address, the payment terms, the default expense account, and the bank details. Many records will have gaps, especially suppliers that were created in a hurry to get one bill paid. The IBAN validator and BIC validator are a quick way to catch bank details that are malformed, though a valid format doesn’t prove the account belongs to the supplier.
Finally, verify bank details for your most important suppliers by contacting them through a phone number or contact you already had, not the one on their latest invoice. You don’t need to do this for every supplier on day one. Start with the ones you pay most often and the ones you pay the most.
Keeping it clean
A cleanup that isn’t followed by a few rules will be undone within a year. The rules don’t need to be heavy.
Limit who can create or edit suppliers. In most accounting systems this is a user permission setting. The person who approves payments ideally shouldn’t also be the person who can change a supplier’s bank details, though in a three-person finance team that separation isn’t always possible. Where it isn’t, make sure changes are at least visible to someone else.
Set a short checklist for new suppliers: legal name, tax ID checked against the issuing authority where a public lookup exists, bank details confirmed by a separate channel, and an internal owner who knows why the supplier is being added. That last point matters more than it sounds. A supplier nobody in the business can explain is worth a second look.
Treat bank detail changes as their own event. A supplier asking to update their account should trigger a call-back to a known contact before the change is saved, every time, however routine the request looks. We go through the common warning signs in our post on bank detail fraud.
Repeat the inactive and duplicate review once or twice a year. Quarterly is reasonable if you add suppliers often. It takes a fraction of the time of the first cleanup.
The intake problem
A lot of supplier duplication starts at the moment an invoice arrives. Someone receives a bill from a supplier whose name on the invoice doesn’t quite match the name in the system, can’t find the existing record quickly, and creates a new one. This gets worse when invoices come in through several channels, from different people, in more than one language. A supplier might send a PDF with its legal name to the finance inbox and a photo of an invoice with its trading name to an operations manager on WhatsApp.
There are two ways to approach this with software. Supplier management and onboarding platforms give suppliers a portal to submit and maintain their own details, with verification built in. They suit businesses with many suppliers and enough buying power to ask all of them to register. For a small business paying a few hundred suppliers, many of them small themselves, asking every supplier to log into a portal is often not realistic.
The other approach is to check each incoming invoice against the existing supplier record at the point of capture, using identifiers like the tax ID rather than relying on the name alone. Clearline is built around this kind of check. It reads the supplier name, tax ID and bank details from invoices arriving by WhatsApp, email or upload, checks bank details against what that supplier used last time, checks for duplicates against what they’ve already billed, and posts the bill into your existing accounting system, which stays the place where supplier records live. Nothing about your supplier list moves to a new system.
Whichever route you take, the cleanup itself is the same work, and it’s worth doing before any automation. Software that reads invoices accurately still depends on having one correct record per supplier to match them to.