Control Supplier W-9 Refresh Without Guessing

Scope the refresh population

Start with a defined population, not the whole vendor master. Include suppliers paid reportable amounts, suppliers with a missing or stale form, suppliers whose legal name or TIN changed, and dormant accounts being reactivated. Record the entity, payment type, and period that put each supplier in scope.

State the source of the population and the date it was pulled. If the list comes from a payment report, reconcile it to the vendor master count so the team knows which records are missing from the extract. A refresh list without a denominator cannot be reported or sampled.

Choose the refresh trigger

A new supplier needs a form before the first reportable payment. An existing supplier needs a new form when the current one is missing, the legal name changed, the tax classification changed, or the company's own review cycle comes due. A reactivated dormant account needs a fresh check even if an old form exists.

Write the trigger beside each request. Two suppliers may need the same form for different reasons, and the reason determines how urgently the item should be handled and whether payment can proceed in the meantime. Keep the trigger in the record so the next reviewer does not have to guess.

Request through a controlled channel

Send the request through the supplier portal, a verified supplier email, or the established onboarding contact. Do not use a new address supplied in the same message that asks for the form. Record the recipient, channel, date, and the request reference.

Explain what is needed in plain terms: a complete Form W-9 for the legal entity that will be paid. Do not request a Social Security number by ordinary email when a secure portal is available. If the supplier asks which form applies, route the question to the tax owner instead of improvising an answer.

Check the form before keying

Inspect the form revision, legal name, business name if any, tax classification, address, TIN, signature, and date. Check that the name and TIN belong together and that the certification is signed. A form with a missing signature or an unclear entity type is not ready to key.

Do not correct the supplier's form. If a field is blank or inconsistent, return it with a specific note and keep the original image. Record what was checked, by whom, and on what date so an auditor can see that acceptance was based on the document rather than a memory of a phone call.

Keep a small acceptance checklist beside the review step so the same fields are checked every time. When a form is rejected, record the exact field and the message sent to the supplier, because a later reviewer will want to know whether the problem was the document or the request.

Reconcile TIN and legal name

Compare the form to the vendor master: legal name, doing-business-as name, address, TIN type, and tax classification. Record each match and each difference. A name change may require a vendor master change and a new approval, not just a new attachment on the old record.

Do not give tax advice about withholding, backup withholding, or reportability. Route those questions to the tax owner with the form and the payment facts attached. The AP role can confirm that a document is complete and consistent; it cannot decide the company's tax position.

Handle refusal, delay, and closure

Some suppliers will refuse, delay, or send an incomplete form. Record the request history, the reason given, and the next date. Apply the company's written rule for payment holds or escalation, and let the owner decide whether an exception is allowed.

Close a refresh only when the accepted form is stored in the approved location, the vendor master reflects the accepted data, and any remaining discrepancy has an owner. A closed ticket with no stored document is not closure. Keep the request history for the same retention period as the vendor record.

Protect the data and limit access

Tax forms contain personal and financial identifiers. Store them in the approved repository, restrict access to the roles that need them, and avoid attaching them to broad distribution lists. Remove the file from temporary download folders after it is filed.

Review who can read or change vendor tax data as part of the access recertification. Offboard departed users promptly. A refresh project can expand access quickly; the control is to remove it when the project ends and to keep the evidence of both the grant and the removal.

Document the acceptance decision

The acceptance record should show the supplier, form revision, date received, fields checked, comparison result, reviewer, and the storage location. If the form was rejected, record the reason and the date the supplier was notified. If an exception was approved, record the approver and the scope.

Separate document acceptance from vendor activation. A complete form does not prove the bank account is correct, and a verified bank account does not prove the tax form is complete. Keep the two decisions in their own records so one cannot substitute for the other.

Review the cycle and the backlog

Report the in-scope count, forms received, forms accepted, forms rejected, outstanding requests, and aging by trigger. Compare the closing list to the opening list and explain large movements. Sample a few accepted forms each quarter and recheck the name and TIN comparison.

Refresh the trigger rules annually or when the payment mix changes. If a new entity, payment type, or portal is added, update the population definition before the next cycle. The goal is a repeatable records process, not a one-time cleanup.