Stop letting typosquatted vendors bleed the ledger. — Master-data controls, by the payment.
Vendor master drift — duplicate IDs, typosquat payees, shell-vendor onboarding — is the control failure that hides inside every ERP cutover and every fast-growth onboarding wave. VeraStream runs the same eight production detectors against every vendor and disbursement in the 90-day post-migration window, so a master-data anomaly is flagged the day it posts — not the quarter your auditor opens the file.
The vendor-master signal feeds directly into the CFO spend-trust board — see /solutions/cfo-spend-trust for the Tier-1 KPIs (the v2 vendor-master sub-board isolates detectVendorRisk from the broader spend-trust funnel).
Why vendor-master controls break down
Three real patterns of vendor-master control failure
Each citation below is drawn from public enforcement actions, IIA published findings, and the ACFE fraud handbook — not invented hypotheticals.
Typosquatted vendor paid $48M before anyone noticed
A single-character delta between an approved vendor and a newly-onboarded payer was enough to route a seven-figure disbursement to a typosquatted account. The vendor master had no fuzzy-match dedup against the existing approved list. The external auditor found it in a quarterly sample — not during the window when recovery was possible.
Source: DOJ / FCPA enforcement action — vendor onboarding controls
Shell vendor onboarded without W-9 and paid within the same week
A new vendor was added to the master with no W-9 on file, no beneficial-owner disclosure, and no spend Acknowledgment. The first payment cleared four business days later. The control failure was documented in an IIA material-weakness finding filed the following quarter — the remediation cost was published in the same 10-K.
Beneficial-owner change redirects a recurring vendor payment
A long-standing vendor changed its bank account information mid-cycle — a beneficial-owner update that should have triggered re-onboarding. The AP team processed the change without a full re-verification. The replacement account belonged to an unrelated entity. The loss was discovered only during a routine ERP reconciliation three months later.
What breaks during vendor-master drift
Six specific failure modes that surface in the 90-day window
- Duplicate vendor masters (legacy vs. re-onboarded). The same supplier ends up under two vendor IDs — one carried from a prior system, one created during a recent re-onboarding. Until a reconciliation catches the collision, both IDs pay.
- Typosquat payee (one-character delta from an approved vendor). A new vendor name that is a near-miss of an approved master-data entry — Microsot vs. Microsoft, Acme vs. ACME. The master has no fuzzy-match dedup at onboarding; the payment clears to the wrong account.
- Newly-onboarded shell vendor (no W-9 / no spend acknowledgment). A vendor added to the master without a signed W-9, without beneficial-owner disclosure, and without a documented spend Acknowledgment. The first payment clears before any human reviews the onboarding.
- Sub-threshold structuring (payments split under the master-data approval tier). A single invoice is split into two or three payments, each sitting just below the approval ceiling defined in the master-data tier. The eight production detectors flag the cluster; quarterly sampling never sees it.
- Round-dollar disbursements to first-seen vendor (template / script flag). A vendor first-seen within the last 30 days receives a round-dollar payment — $25,000, $50,000, no cents. The pattern is a signature indicator of a one-line tamper: the disbursement is script-generated, not manually entered.
- Beneficial-owner mismatch (bank-account change mid-cycle). A long-standing vendor changes its bank account information mid-cycle — a beneficial-owner update that should trigger re-onboarding under the same policy as a new vendor. The change is processed without re-verification; the replacement account is unrelated to the vendor.
Detector → vendor-master failure → sample finding
How VeraStream maps each of the eight production detectors to vendor-master risk
The same eight production detectors that run across every VeraStream audit — mapped to the specific vendor-master failure mode each one catches, with a one-line sample finding from a population that mirrors a real AP ledger.
| Detector | Vendor-Master Failure | Sample Finding |
|---|---|---|
evaluatePolicy | Vendor onboarding policy / approval-matrix gaps — new vendors skip required checks | Three vendors added to the master without a signed W-9 or a spend-acknowledgment on file — flagged before first payment cleared. |
findDuplicateInvoices | Same vendor paid twice under typosquatted IDs — legacy master + new onboarding | "Acme Logistics LLC" and "ACME Logistix LLC" both paid in the same week — flagged as master-data collision. |
detectExpenseAnomalies | One-cardholder, two closenames, same weekend — confirm before payment approval | Same employee charged two different merchant categories with conflicting description fields — flagged for confirmation. |
detectVendorRisk | Typosquat / unapproved payee / shell-vendor heuristic — near-miss name matching | New vendor "Microsot Azure LLC" — a two-character delta from "Microsoft Azure" — held for approval before payment posted. |
detectThresholdGaming | Structured sub-threshold payments to evade master-data approval tier | $18,400 × 2 to the same vendor within 3 hours — each below the $25,000 approver threshold, flagged as a split-purchase cluster. |
detectRoundDollar | Round-dollar disbursements to first-seen vendors under 30 days — template / script flag | $50,000 wire to a vendor first-seen 11 days prior — no cents, same memo template as the prior batch — held as a one-line tamper pattern. |
detectGhostEmployee | SOD weakness — new vendor on a new approver in the same week as a master-data change | A new vendor was added to the master and a new approver was granted sign-off rights within the same 48-hour window — flagged for segregation-of-duties review before the payment batch cleared. |
detectDuplicatePayment | Same vendor paid twice with the same or near amount in a short window — recurring SaaS/rent and refund reversals auto-suppressed | Two $28,400 ACH transfers to "Calderon Freight Inc." posted within 36 hours — flagged for duplicate review before the second cleared. |
How VeraStream fits a 90-day vendor-master audit
Three bands: scan, monitor, deliver
The post-migration window is 90 days. Each band runs the same eight production detectors against the vendor-master population — the format of the output shifts as the engagement moves from baseline to formal findings.
Baseline reconciliation scan
Full vendor-master reconciliation against the historical ledger and a 90-day tracking-vendor payment analysis. Output: a master-data collision map, a beneficial-owner change log, and a first-seen vendor risk tiering on day 14.
Monitored detection
Connectors stream new vendor activity from the ERP and corporate card feed. New vendor onboarding, bank-account changes, and approval-chain modifications are scanned in real time. Weekly finding roll-ups with workpapers are delivered to the AP master-data owner.
Formal findings package
Every flagged vendor and disbursement with the receipt, the rule that tripped, the override applied, and a methodology appendix. Sized to hand directly to your external auditor under PCAOB AS 2315 — the same evidence package that feeds your post-cutover SOX 404(b) assessment.
Frequently asked
Common questions from AP and internal audit teams
What the agent does for vendor-master control — plain HTML answers, no JavaScript required to read.
Can we import last quarter's vendor master and payment history?
Yes. VeraStream accepts CSV exports of the existing vendor master and historical disbursements — up to several million rows per file. The reconciliation scan runs fuzzy matching against the current master to surface duplicate masters, typosquat candidates, and first-seen vendors that were onboarded before the window began.
Which ERPs and corporate card feeds do you connect to for vendor activity?
Live deploys use pre-built connectors to NetSuite, SAP, Oracle, Concur, Expensify, Brex, and Ramp. Vendor onboarding events, bank-account changes, and approval-chain modifications are streamed in real time. If your ERP is a different platform, the /audit page lets you drop a CSV of the current vendor master and see the same detectors run in the browser — no integration required.
How do you catch a beneficial-owner change to an existing vendor mid-cycle?
VeraStream monitors the vendor master for change events — bank-account modifications, approval-chain changes, and new signatory disclosures — and re-runs the vendor-risk detector against any changed record. A bank-account change on a long-standing vendor is a first-tier finding: the beneficial-owner update should have triggered re-onboarding under the same policy as a new vendor.
What does the workpaper for a flagged vendor look like to our external auditor?
Every flagged vendor ships a workpaper with the receipt (the vendor record, the change event, the payment that triggered the flag), the rule that tripped (the detector name, the threshold or heuristic that fired), and any override applied. Sized to PCAOB AS 2315 — your external auditor receives the same evidence package they would demand from a manual control test, but produced continuously rather than once a quarter.
How long does a 90-day vendor-master reconciliation take, and what does it cost?
A baseline scan against a full vendor master and 90-day payment history returns flagged findings in under 90 seconds in the browser. A monitored live deployment — connectors to the ERP and card feed, eight production detectors, weekly finding roll-ups — typically launches within two weeks of data access. Use /roi to estimate your post-cutover vendor-master exposure.
Test it on your own vendor master
Catch the vendor-master control failure the day it posts
Drop a CSV of your vendor master and 90-day disbursements at /audit, or browse a worked sample report at /sample-report. Use /roi to estimate your vendor-master exposure before the next ERP cutover. See /regulatory-coverage for the FCPA, VAT, and Sunshine Act detector-coverage matrix — detectVendorRisk sits on the FCPA shell-vendor heuristic row.