Approved Supplier List: Build, Onboard and Keep It Current

Administrator reviewing a dealership supplier file

An approved supplier list (ASL) is the controlled record of suppliers your business has vetted and authorised to supply specific goods or services. Oracle’s procurement documentation describes it as a way to track suppliers authorised to supply critical items and services, with entries reviewed periodically so they reflect current business status. For an Australian equipment dealership, that means a short, owned, dated list of the parts, freight, subcontract and service suppliers you are allowed to raise purchase orders against, and the evidence behind each name.

This guide covers what the list must contain, an onboarding checklist built around Australian checks, how to approve and review suppliers, and where AI and a dealer management system (DMS) take the admin out of it.

Moderndms

moderndms.com.au

Keep Dealership Workflows Connected

MDMS brings sales, service, parts, rental and finance workflows into one system, helping equipment dealerships reduce administrative work.

Book a demo

TL;DR

An ASL limits purchase orders to suppliers who meet your own criteria, so every entry needs an approved scope, a status, an expiry date and a named owner.
Onboard in a fixed order: identity (ABN, ACN), compliance (insurance, WHS, certifications), commercial terms, then bank details verified independently before the first payment.
Rank suppliers by risk. Critical parts and subcontractors get deeper checks and more frequent reviews than routine consumables.
A spreadsheet emailed around goes stale. One master record, expiry alerts and an audit trail keep the list honest.
AI is most useful for chasing expiries, flagging exceptions and checking documents. A person still signs off the approval.

What an approved supplier list is for
What to record against each supplier
Approved supplier criteria that work in practice
Supplier onboarding checklist for Australian dealerships
The supplier approval process, step by step
Keeping the list current
Where AI and a DMS take the admin out
Build your ASL in MDMS
FAQ
Sources

What an approved supplier list is for

The purpose is control at the point of purchase. As Arena’s glossary puts it, an ASL is a compiled list of suppliers approved as sources from which to buy parts or materials, and it keeps purchase orders and contracts limited to suppliers who meet the company’s criteria for selection, evaluation and re-evaluation.

For a dealership, that control matters in several places:

Parts: OEM and aftermarket sources with a defined product range, so a counter or workshop does not buy a lookalike filter from an unvetted source.
Service and field service: subcontractors, calibration providers, towing and mobile mechanics who work on customer machines or sites.
Rental: repair, transport and inspection providers for fleet units.
Finance: a clean supplier master means fewer duplicate or fraudulent payees reaching accounts payable.

There is a commercial benefit too. Visibility of supplier performance and established relationships can give buyers more leverage in negotiations, as one procurement guide notes.

Approved supplier list, approved vendor list and approved supplier register all describe the same idea. Pick one term, use it in your procedures and stick to it.

What to record against each supplier

A list of names is not a control. JAGS Assurance advises documenting the specific scope of work, standards and specifications for each entry, so procurement has data it can act on. The Victorian Government’s prequalified supplier guide lists the kinds of information worth requesting: capability, expertise, financial capacity, insurance, relevant experience and compliance details. It also says the amount you ask for should match the complexity of what you are buying.

A workable minimum for a dealership:

Field	Why it matters
Legal entity name, trading name, ABN, ACN	Matches the payee to a real entity
Approved scope	Which parts, brands or services the supplier may supply, not just the name
Risk class (critical, standard, low)	Decides depth of checks and review frequency
Status	Approved, conditional, suspended, delisted
Approval and expiry dates	Triggers re-checks before documents lapse
Insurance and certificate dates	Public liability, professional indemnity where relevant
Payment terms and bank details verification	Supports clean AP and fraud control
Named record owner	One person accountable for the entry

That set follows the critical fields Evidash describes for a controlled ASL: legal name, approved scope, risk classification, current status, approval and expiry dates, and an owner who prevents lapses.

Approved supplier criteria that work in practice

Criteria should be written down before the first application arrives, otherwise approvals become a matter of who rang last. The ISO 9001 Auditing Practices Group guidance says documented information should identify approved external providers, stay up to date and show that orders go only to providers who meet the defined criteria. It also says controls should be risk-based: for critical suppliers, assess the ability to supply consistently to specification, not only price, and check the scope of any certification a supplier claims.

Turn that into four to six criteria your team can score:

Legitimacy: active ABN, correct entity type, GST status.
Capability: can they supply the specific range, to spec, at the volumes you need?
Financial standing: enough capacity to carry the work, proportionate to the risk.
Insurance and WHS: current certificates and a safe-work record where they attend your premises or customer sites.
Quality evidence: relevant certification with the right scope, warranty terms, return handling.
Commercial fit: price, lead times, freight terms, payment terms.

Weight them by risk class. A supplier of workshop rags does not need the same file as a subcontractor welding on a customer’s loader.

Supplier onboarding checklist for Australian dealerships

The sequence matters: cheap checks first, so you do not spend time on a supplier who fails on identity.

Step 1: Confirm the business exists

Search the ABN, ACN or name on ABN Lookup, which is free and shows whether an ABN is active or cancelled, the business type, GST status and historical trading names. business.gov.au also recommends checking legitimacy through the Australian Business Register, seeking references and reviews, and considering the Personal Property Securities Register before you contract.

Public-sector practice is a useful benchmark. Transport for NSW’s procurement policy requires new suppliers to pass compliance checks, including ABN verification, before being added to a vendor master list. It also expects new engagements to be with entities holding an ACN, with sole traders or trusts needing a risk-based exception. Your dealership is not bound by that policy, but the logic transfers: the entity you pay should be the entity you vetted.

Step 2: Collect the documents

Request what the risk class justifies:

Completed supplier application form with legal and trading names
ABN and GST registration confirmation
Certificates of currency for public liability, and professional indemnity or workers compensation where relevant
Relevant licences, trade qualifications and certifications, with scope stated
Safety documents (safe work method statements, induction records) for anyone attending site
Trade references
Price list or rate card, terms of trade, warranty and returns terms

Step 3: Check safety duties where people are involved

If a supplier’s people work on your site or your customers’ machines, WHS applies. Safe Work Australia states that contractors and subcontractors are workers under the model WHS laws, and that an officer of a person conducting a business or undertaking must exercise due diligence to ensure compliance with its WHS duties. Confirm the legal position for your state or territory with your WHS adviser or regulator.

Step 4: Agree the commercial terms

Business.gov.au says a supplier contract should cover the goods or services, price and payment, timeframes, delivery, quality, warranties, insurance, disputes and termination. Capture the same points in your supplier file even when the relationship runs on standard terms of trade.

Step 5: Verify bank details independently

This step stops payment fraud. The Australian National University’s supplier record procedure requires new supplier details and bank information to be independently verified before the record is created, and if they cannot be verified, the record is not created and payment is blocked. Adopt the same rule: call a number you already hold or found yourself, never one from the email that asked you to change the account.

Step 6: Approve, record and communicate

Assign the risk class, set the review date, name the owner, publish the entry and tell purchasing and goods-in. Shilux makes the point that the list should be accessible to both purchasing and goods-in, so controls are enforced where deliveries arrive.

Supplier verification checks like these are a form of gating: nothing proceeds until proof is on file. Installer.com’s write-up on onboarding shows the same principle applied to installer networks, where payment follows verified completion.

The supplier approval process, step by step

For a small dealership, a one-page workflow is enough:

Request: the department manager states the need and scope (for example, hydraulic hose assemblies for the service department).
Screen: purchasing runs the identity checks and risk-classes the supplier.
Evaluate: the owner reviews documents and scores criteria. Critical suppliers may get a questionnaire, references or a site visit.
Approve: a manager with the right authority signs off. Finance confirms the bank verification.
Activate: the supplier appears in the supplier master with its approved scope.
Monitor: performance is tracked and the review date is set.

Larger programs go further. The Australian Submarine Corporation’s supplier quality manual requires a supplier qualification questionnaire with supporting documents, systematic reviews and possible on-site quality audits before a supplier gains approved status. You do not need that depth for shop consumables, but it is a fair model for a critical subcontractor.

When you do audit on site, JAGS suggests assessing process control independently of the supplier’s sales objectives, looking at records such as test certificates, rather than relying on a checklist alone.

Keeping the list current

The list loses value the day it stops matching reality. Evidash, JAGS and Shilux all point to the same habits: a named owner, automated alerts for document expiry, re-evaluation scheduled by risk profile, and formal re-approval when something changes, such as an ownership shift or a performance incident. Every decision should sit in an audit trail.

The ISO guidance adds a warning: a list alone is not enough. Effective control also needs risk-based selection, current records, purchasing that complies with the list, ongoing monitoring and checks that requirements were actually met.

Practical rules:

One master version. Shilux advises a single controlled record with a defined change route, not a spreadsheet copied into email threads.
Review by risk. Critical suppliers annually or on any incident, standard suppliers on a longer cycle, low-risk suppliers when documents expire.
Close corrective actions. Record the performance gap, assign an owner and a deadline, and verify closure with evidence.
Delist deliberately. Address stock on hand, approve an alternative source and tell purchasing before the next order cycle.
Retain records. Retention periods vary by industry and obligation. ASC’s manual requires 12 years for order records, but check what applies to you with your accountant or legal adviser.

Performance data is what makes reviews meaningful. Our guide to supplier scorecard metrics for equipment dealers covers on-time delivery, fill rate and return rates, and the supplier RMA process shows how to close returns so the data is clean.

Where AI and a DMS take the admin out

Most of the work in an ASL is chasing: expired insurance certificates, missing ABN checks, stale bank details, purchase orders raised against a supplier nobody approved. That is repetitive, rules-based work, which suits software.

Supplier information platforms already work this way, using online questionnaires, automated approval workflows, supplier-maintained information, update reminders and audit logs to cut manual tasks and keep records current. The same ideas apply inside the system where your dealership buys, services and pays.

In an equipment dealership, the useful AI and ERP-style controls are:

Expiry watch: flag certificates of currency and licences before they lapse, and notify the record owner.
Document checking: read an uploaded certificate and compare the entity name, ABN and dates with the supplier record, leaving a person to confirm.
PO guardrails: warn when a purchase order names a supplier who is suspended, outside their approved scope or missing bank verification. See our guide to purchase order approvals, limits and AI checks.
Exception reporting: surface suppliers with repeated late deliveries or warranty returns so the review is triggered by data, not memory.
Duplicate and change detection: highlight near-identical supplier names or bank detail changes, which are classic fraud signals.
Audit trail: log who approved what and when. Our piece on audit trails in dealership software explains what auditors look for.

The human checkpoints stay. AI can prepare the file, but a manager approves the supplier, and finance verifies the bank account by phone. We make the same argument for quoting, where AI needs human checks.

Good data underpins all of it. A data quality monitor helps catch duplicates and gaps in supplier and parts records before they reach a purchase order. For the wider picture, see our practical operating guide to supplier management for dealerships.

Our perspective

We build MDMS for equipment dealers, and the pattern we see is consistent: the approved supplier list lives in one person’s spreadsheet, the insurance certificates live in someone’s inbox, and the purchase orders live in the accounting package. Three places for one supplier means nobody can answer a simple question: is this supplier approved for this job today?

Our view is that data should travel once. The supplier is approved in the same system that raises the purchase order, receives the parts, books the warranty claim and feeds accounts payable, so the approved scope, status and expiry date are checked at the moment of purchase rather than at the next audit.

That is also why we treat AI as part of the workflow, not a separate tool. MDMS AI is designed to help your team spot expiring documents, unusual purchase orders and supplier performance exceptions, and to prepare the work for a person to approve. You decide who is on the list. The software keeps the evidence and the reminders so that decision stays true.

ModernDMS

Build your ASL in MDMS

MDMS is a dealer management system built for equipment dealerships, with modules for parts, warehouse, service, rental, warranty and finance that you can switch on one at a time. Setup is designed to take under an hour, and you own your data with no lock-in. Modules are listed at 59 AUD per month each on the pricing page. MDMS AI is 449 AUD per month, and AI-enabled users are 29 AUD per month per seat, as listed on the MDMS site. Pricing was read from the site in 2026, so confirm the current figures there.

Moderndms

If your parts department is where unapproved buying starts, look at parts and inventory management first, then add reorder logic from our reorder point guide.

FAQ

What is the difference between an approved supplier list and an approved vendor list?

Nothing in substance. Supplier is the common term in manufacturing and quality systems, vendor is common in finance and IT. Both are a controlled list of sources your business has vetted and authorised for defined purchases. Use whichever your team and auditors already use.

How many suppliers should be on the list?

As many as you actually buy from for each category, and no more. Include a second approved source for critical parts so that delisting one supplier does not stop the workshop. Remove suppliers you have not used in a long time, or flag them dormant until re-checked.

How often should suppliers be reviewed?

Link the cycle to risk. Critical suppliers should be reviewed on a set schedule and after any incident or ownership change. Lower-risk suppliers can be reviewed when their documents expire. Evidash’s guidance says risk classification is what keeps this from becoming administrative busywork.

Do I need an ABN to approve a supplier in Australia?

Checking the ABN is standard practice, and public-sector policies such as Transport for NSW’s require it. Sole traders and trusts can be legitimate suppliers, but treat them as an exception with a risk-based sign-off. Confirm tax treatment with your accountant.

Can AI approve suppliers automatically?

We recommend against it for the final decision. AI is well suited to checking documents, spotting expiries and flagging exceptions. Approval, and bank detail verification, should stay with named people so accountability is clear.

Approved Supplier List: Build, Onboard and Keep It Current