New Supplier Onboarding
The end-to-end procedure Procurement follows to vet, approve, and activate a new supplier in the vendor master — from intake request through first purchase order.
Revision History
| Version | Date | Author | Approver | Summary |
|---|---|---|---|---|
| 2.0 | 2026-07-04 | Lina Okada | Marcus Tan | Added mandatory sanctions-screening step and moved banking verification ahead of first PO. |
| 1.3 | 2025-11-02 | Lina Okada | Marcus Tan | Introduced tiered risk review (Low / Medium / High) replacing single checklist. |
| 1.0 | 2025-02-18 | Dev Patel | Marcus Tan | Initial publication. |
Purpose
This procedure standardises how Ashford Regional Health vets and activates a new supplier — covering intake, due-diligence, contract execution, and vendor-master setup — so that no purchase order is issued to an unverified or non-compliant supplier.
Scope and Out-of-Scope
In Scope: All new suppliers of goods or services above $5,000 annual spend, across all business units and regions.
Out of Scope: One-time purchases under $5,000 (see SOP-PRC-002, Petty Procurement). Existing suppliers requesting a banking-detail change (see SOP-PRC-011). Intercompany suppliers (see POL-PRC-001 §4).
Trigger / When to Execute
Triggered whenever a business unit submits a Supplier Intake Request in Coupa that does not match an existing vendor-master record. The Procurement Analyst on rotation begins triage within 1 business day; the full onboarding must complete within 10 business days for Low risk suppliers, 20 for Medium, and 30 for High.
Roles and Responsibilities
| Role | R | A | C | I | Responsibility |
|---|---|---|---|---|---|
| Procurement Analyst | ● | ○ | ○ | ○ | Executes intake, due-diligence, and vendor-master setup steps. |
| Procurement Ops Lead | ○ | ● | ○ | ○ | Reviews risk tier, approves contract terms, signs off on activation. |
| Legal / Compliance | ○ | ○ | ● | ○ | Consulted on contract redlines and sanctions-screening results. |
| Requesting Business Unit | ○ | ○ | ○ | ● | Informed of activation and cleared to issue the first PO. |
R = Responsible A = Accountable C = Consulted I = Informed
Prerequisites / Preconditions
- Coupa role PROC-INTAKE granted (request via ServiceNow CAT-0031).
- Supplier has provided a completed W-9/W-8BEN (or local equivalent) and certificate of insurance.
- Requesting business unit has confirmed a budget code and estimated annual spend.
- No existing vendor-master record matches on tax ID or D-U-N-S number.
Inputs
Supplier Intake Request (Coupa); completed W-9/W-8BEN; certificate of insurance; proposed contract or quote; sanctions-screening tool (Descartes Visual Compliance); D&B risk report.
Procedure
Open Coupa → Supplier Intake → New Requests. Review the requested spend, category, and country. Assign risk tier: Low (domestic, non-critical goods, <$50k), Medium ($50k–$500k or handles Ashford data), High (>$500k, critical logistics infrastructure, or international with sanctions exposure).
In Descartes Visual Compliance, search the legal entity name and all listed beneficial owners. A clean result shows 0 matches across OFAC, EU, and UN lists. Any partial match must be manually reviewed and documented before proceeding — do not rely on the automated "likely false positive" flag alone.
Request a D&B Supplier Risk Report using the supplier's D-U-N-S number. A PAYDEX score below 50 or a Viability Rating of 4–5 requires escalation to the Procurement Ops Lead before continuing; note the outcome in the intake record regardless.
Confirm the W-9 (or W-8BEN for foreign suppliers) has a matching legal name and TIN, and that the certificate of insurance meets the minimums in POL-PRC-001 §6 (general liability ≥ $1M, auto ≥ $1M if the supplier delivers to Ashford sites). Reject and request corrected documents if either is missing or expired.
Attach the proposed contract or MSA to the intake record and route to Legal via the DocuSign CLM workflow. Legal targets a 5-business-day turnaround for Low/Medium tier, 10 for High tier. Do not skip redline review even for a supplier's "standard" paper.
Call the supplier's finance contact using a phone number sourced independently (not from the email that supplied the banking form) and verbally confirm the bank name, account number, and routing/SWIFT code before entering them into the vendor master. This step exists specifically to block business-email-compromise fraud.
In NetSuite → Lists → Vendors → New, create the record using the legal entity name exactly as it appears on the W-9. Set default payment terms to Net 30 unless the contract specifies otherwise, and attach the signed contract, W-9, and insurance certificate to the record.
Submit the completed intake packet (screening results, D&B report, signed contract, banking verification log) for sign-off. Once approved, flip the vendor-master status from Pending to Active. This unlocks the requesting business unit's ability to raise a PO.
Email the requestor with the new vendor number and payment terms, and close the Coupa intake request with a link to the vendor-master record. Archive the full packet in /procurement/vendor-onboarding/2026/.
Outputs
Active vendor-master record in NetSuite with vendor number; signed contract or MSA; completed sanctions-screening log; D&B risk report; banking-verification callback log. All artefacts archived and retained for 7 years per POL-PRC-001.
Success Criteria / Postconditions
- Vendor-master record status is Active with a valid vendor number.
- Sanctions screening shows 0 unresolved matches.
- Banking details verified via callback and logged.
- Signed contract or MSA attached to the vendor record.
- Requesting business unit notified and able to raise a PO.
Exception Handling
| If… | Then… |
|---|---|
| Sanctions screening returns a confirmed match | Halt onboarding; escalate to Legal/Compliance; do not resume without written clearance. |
| D&B PAYDEX score is below 50 | Escalate to Procurement Ops Lead; may require prepayment or a parent-company guarantee. |
| Legal review exceeds the target SLA by 5+ business days | Ping #legal-ops; escalate to VP Procurement if the requesting BU has an urgent operational need. |
| Banking callback number is unreachable after 3 attempts | Request an alternate verified contact from the supplier's finance leadership directly; do not proceed on email alone. |
Notes and Tips
- Use Coupa's Supplier Self-Registration link to save manual data entry — the supplier fills their own profile and compliance documents.
- For Tier-1 suppliers (projected spend >$1M/year), involve Legal at step 03 rather than waiting for the contract stage — it shortens the overall cycle by up to 5 days.
- Sanctions screening results expire after 90 days; if onboarding stalls past that window, re-run the check before activating the vendor record.
References
- SOP-PRC-002 — Petty procurement (under $5,000)
- SOP-PRC-011 — Existing supplier banking-detail change
- POL-PRC-001 — Supplier risk tiering & insurance minimums
- SOP-FIN-005 — Vendor payment-terms exceptions