Research · Published:
When are two AP vendor records the same supplier?
Research on duplicate vendor identities, merge evidence, transaction history, and controlled decision boundaries.
Research question and method
When do two vendor-master records represent the same supplier, and what evidence is needed before an authorized owner merges, deactivates, or preserves them separately? This study examines identity resolution in accounts payable because similar names can conceal different legal entities, branches, remit-to relationships, or historic records. The method draws on GAO control principles, NIST access guidance, IRS Form W-9 information, and SAM.gov entity-registration material. IRS and SAM.gov sources are used only to understand controlled identity fields and public registration context where applicable. They do not validate every supplier or decide private-company master data. The bounded sample includes spelling variants, former names, shared addresses, multiple tax records, acquisitions, branches, and records with different payment details.
Evidence population
Build an evidence table for each candidate pair. Include internal vendor IDs, legal names, trade names, entity relationships, tax-form references, taxpayer identification fields only within approved secure access, addresses, approved contacts, banking references, currencies, purchase history, open transactions, creation events, status history, and prior decisions. Similarity is analysis, not identity. A shared address can be a service location. A matching contact can work for related entities. A legal-name change may create continuity, while two records with the same display name may remain distinct. The packet should state each observed match and conflict without assigning a confidence score unless the company has an approved, documented method.
Case analysis
Transaction history complicates a merge. One record may hold open invoices, credits, tax reporting history, purchase orders, or disputes that cannot simply move. The study maps affected records before any master-data decision. It records whether systems preserve former identifiers and whether links remain searchable after deactivation or merge. An outsourced AP specialist may inventory these dependencies and prepare a side-by-side comparison. The specialist should not select a surviving record, transfer balances, edit tax or bank data, or decide that historic activity belongs to another entity. Those actions need owners from vendor management, procurement, accounting, tax, treasury, or system administration as company policy requires.
Reproduction test
The test deliberately includes false friends. Reviewers examine two suppliers at one building, a supplier and factoring contact, a parent and subsidiary, a renamed company with continuous registration evidence, and a duplicated record created after an invoice arrived through another channel. Each reviewer identifies facts, conflicts, missing evidence, and the next owner. A result of "possibly related" is acceptable when sources do not establish sameness. The research records why. It also tests corrections: when a later document resolves identity, the original ambiguity and interim stop should remain visible. Replacing the old comparison with the final answer would make it impossible to evaluate whether earlier handling followed the evidence available then.
Operating boundary
Independent verification matters when a merge request also changes payment or contact data. The same unsolicited message should not supply both the new value and the only verification channel. FBI business-email-compromise guidance provides risk context for independently checking payment-related requests, but a mismatch or urgent message is not proof of crime. Support should record the observable request, hold the affected change under policy, and use a contact route obtained from an approved source. The identity decision and bank-change decision should remain separate even if the same employee reviews both. A verified legal relationship does not automatically authorize new payment instructions.
Interpretation
Reproducibility is measured by whether a second reviewer can reach the same bounded classification from the retained sources. The reviewer should find every identity field, its source and date, the system history, affected transactions, and employee disposition. Include inaccessible and stale records in the result. If reviewers disagree, identify whether the difference comes from policy, source interpretation, or missing evidence. Do not settle disagreement by using the record with more transactions or the older creation date. Those may guide investigation, but they do not prove identity. The study can count reproducible classifications within its sample; it cannot claim a universal duplicate-vendor detection rate.
Limitations
Access should match the preparation lane. Support may search approved records, collect current forms through approved channels, compare visible fields, flag potential duplicates, and track owner responses. It must not expose tax or bank information broadly, administer master data, approve suppliers, merge histories, decide tax treatment, or release payment. If the role can both change identity fields and clear the duplicate flag, the technical design weakens separation. NIST least privilege supports narrower functions and periodic review, while GAO principles support attributable control activity. Neither source defines the company's legal entity hierarchy or authorizes a particular merge.
Evidence-led conclusion
Limitations: public registration and tax-form resources have jurisdictional and eligibility limits. A valid registration does not prove current bank ownership, commercial performance, or entitlement to payment. Internal records may contain old or erroneous data, and privacy rules may restrict comparison. Corporate reorganizations and tax identities can require legal or professional interpretation beyond AP. A selected sample cannot estimate the population of duplicates or quantify loss prevention. System behavior after merge or deactivation must be tested in the company's own environment. The research conclusion is limited to whether the sampled decision has a traceable evidence path and named authority.
Findings
Evidence-led conclusion: two vendor records should be treated as a decision candidate, not the same supplier, until controlled sources establish the relationship and an authorized employee determines the master-data outcome. Outsourced AP support can assemble identity evidence, map affected transactions, and keep contradictions visible. It should stop before changing the master or moving financial history. The decision record should preserve both former IDs, every material conflict, the approved action, its owner, and later payment-detail verification as a separate event. That makes the outcome reviewable and prevents a tidy vendor list from hiding unsupported identity assumptions.
Sources
These primary sources support the control principles and evidence boundaries in this report.
FAQs
Are the planning numbers benchmarks?
No. They describe a testable workflow shape and are not promises, market averages, or production targets.
What should an outsourced AP assistant own?
Repeatable preparation, documentation, status tracking, and follow-up within least-privilege access. Named finance owners retain approval and payment decisions.
When should an item be escalated?
When evidence is missing, a request changes payment details, a duplicate or fraud signal appears, or the item falls outside the written rule.