Approved supplier list: how to create it and keep it up to date

Working with reliable suppliers is a precondition for working well. But how do you prove that a supplier is reliable? By collecting its documents, checking them and keeping them up to date over time. That is what a company's approved supplier list is for.

In this guide we look at how to build one step by step and how to stop it becoming a forgotten list. The approved supplier list is one of the most common use cases of business document management.

What it is and what it is for

The approved supplier list is the list of qualified suppliers an organisation can work with. For each supplier it collects master data, documents and compliance status.

A well-managed list helps you:

• choose suppliers on the basis of clear, shared criteria;
• check that documents and requirements are valid before awarding work;
• monitor each supplier's compliance over time;
• prove, in the event of audits or inspections, that the necessary checks were carried out.

The list is not just an archive: it is a decision-making tool. When an office needs to award work, it can choose from suppliers that are already qualified, knowing their documents have been checked, instead of repeating the same checks every time. This way purchasing, the technical department and administration work from the same information.

Which suppliers to include

Not all suppliers carry the same weight. It makes sense to start with those that have the greatest impact on the company's business or risks:

• suppliers of goods and services that go directly into the final product or service;
• contractors and subcontractors working on company premises or construction sites;
• suppliers that process personal data on behalf of the company;
• consultants and professionals with access to confidential information;
• recurring or high-value suppliers.

For occasional, low-impact suppliers you can set up a simplified procedure with fewer documents required.

A practical approach is to divide suppliers into categories, for example by type of supply or level of risk, and link a set of requirements to each category. This makes qualification faster and more consistent, because each new supplier is placed in the right category and receives the request for the documents required.

Documents to collect

The documents required vary by sector and type of supply. Some common examples:

• Company registry extract (in Italy, the visura camerale), to check the company's details and business.
• DURC, the Italian certificate of social security contribution compliance.
• Insurance policies relevant to the activity carried out.
• Certifications for management systems or products, if relevant to the supply.
• Health and safety documentation, where relevant, for example for those working on company premises or construction sites.
• Privacy notices and appointments for suppliers that process personal data.

For each supplier category, define a precise list of mandatory and optional documents: it is the foundation of the whole qualification process.

For each document it is useful to record at least the issue date, the expiry date, who checked it and the outcome of the check. This information lets you know at any time whether a supplier is compliant and, if necessary, reconstruct the checks carried out.

How to qualify suppliers

Supplier qualification is the process used to decide whether a supplier can join the list, and on what terms.

Criteria

Set objective criteria: completeness and validity of documents, technical requirements, reliability in previous supplies, meeting deadlines, quality of service. The criteria must be written down and applied to everyone in the same way.

Scores

Assigning a score to each criterion lets you compare suppliers and set thresholds: for example qualified, qualified with reservations, not qualified. A simple, understandable system is more useful than a complex one nobody updates.

Periodic assessment

Qualification is not permanent. Plan a periodic reassessment based on experience gained and updated documents, and keep a history of assessments.

Expiry dates and reminders

Many supplier documents have limited validity: the DURC, insurance policies, certifications. An approved supplier list is only reliable if these expiry dates are checked regularly. For each document, record the expiry date, set a notice with enough advance warning and send the supplier a reminder if the updated document does not arrive. With many suppliers, this work is only sustainable if it is automated.

Also define what happens when a document expires: does the supplier remain qualified for a grace period, is it suspended, or can it not receive new assignments until it sends the updated version? Clear rules avoid case-by-case decisions and make the process more transparent for suppliers too.

Finally, tell suppliers which documents you need and why. A supplier that knows the rules from the start sends more complete documents and responds faster to reminders.

Common mistakes

• Creating the list and not updating it: a list with expired documents gives a false sense of security.
• Asking everyone for the same documents: it burdens smaller suppliers and slows down qualification.
• Unwritten criteria: subjective assessments are hard to defend and to repeat.
• Collecting documents by email: scattered attachments, duplicate versions and no record of who checked what.
• Not keeping the history: without previous revisions you cannot reconstruct the history of the relationship.

Excel or software compared

An Excel sheet may be enough for a few suppliers. As the number grows, its limits quickly become apparent.

IntraThor supplier qualification software collects documents via a password-protected link, without the supplier having to register, sends automatic alerts and reminders and keeps the revision history. It is part of the IntraThor DMS document management system, together with the modules for staff, fleets and PPE.

Whatever tool you choose, the value of the list depends on how consistently it is updated: clear criteria, checked documents and monitored expiry dates are what make it truly useful.

Where to start: three steps

1. Start with the most important suppliers by volume or criticality, not all of them at once.
2. Define the documents required for each category.
3. Send the requests and record expiry dates as the documents arrive.

F.A.Q. - Frequently asked questions

General information only, not legal advice: always check the current legislation.