Third-party risk taught me identity comes first
A third-party risk review needs to identify the legal entity behind a vendor relationship, the systems it touches and the person responsible for it. I had to answer those questions as the bank grew. A spend report grouped by similar supplier names was not enough. The same issue comes up when an assistant is asked to summarize supplier exposure: the grouping rule needs to be settled before anyone trusts the total.
Legal entities, trading names, regional subsidiaries and duplicate vendor records coexist in nearly every ERP I have seen. Before an assistant produces a supplier total, it needs a defined grouping rule and someone accountable for it.
Match the identity boundary to the decision
Consolidating spend for a sourcing negotiation is different from validating a payment destination or assessing a specific legal entity for risk. A grouping that suits one purpose can mislead another. The pilot should state which boundary applies and who owns the rule.
Collect sanitized examples of known duplicates and related entities, including at least one pair with similar names that must stay separate. Test both wrong separation and wrong merging. A total can look plausible while the identity decision underneath is wrong.
In healthcare and life sciences, this matters more than it first appears. A distributor, a manufacturer and a contract research organization can share a corporate parent yet carry very different contractual, quality and compliance obligations. Merging them for a spend view may be fine; merging them for a supplier qualification question is not.
Let master data, not language, decide a match
Ask the data owner which identifiers and relationships are authoritative: a stable vendor ID, an approved parent mapping, a maintained master data management hierarchy. Those beat name similarity every time. Document the source of each mapping and how unresolved cases are handled.
Confident language must never substitute for a verified match. When evidence is thin, the output should flag the ambiguity and route it to the owner. A guessed match can combine unrelated spend or hide exposure across records that should have been linked.
Keep mapping review separate from the analysis. A procurement specialist may understand the relationship, but the master data team owns the record change. The workflow should allow investigation without implying the assistant can edit the vendor master.
Keep payment data out of spend analysis
Security comes first in every enterprise AI deployment I lead, and payment data is where that principle gets tested. A spend-summary pilot rarely needs bank account details. Use the minimum fields the question requires; expanding access because a field exists creates exposure without improving the decision.
Anything touching payment instructions needs its own control and authorization review. Changed vendor bank details are a well-known fraud pattern, and supplier identity analysis must never be presented as evidence that a payment destination is safe. Test access by category, region and business unit too, since a consolidated summary can reveal negotiating positions.
Follow the vendor onboarding and approval controls already in place. An assistant may identify records that appear related, but someone authorized to maintain supplier data should review a proposed merge. Preserve the original identifiers and the reason for the decision. Otherwise a useful conversational summary can become an undocumented change to the supplier record that later reviewers cannot reconstruct.
Run an exception process with owners and due dates
Separate confirmed matches, unmatched records and ambiguous relationships, with the evidence reviewers need and no more. Give each issue type an owner and a due date, or the ambiguous category becomes a permanent holding area. Sample confidently matched records as well as flagged ones, because reviewing only exceptions misses systematic false matches, and keep a reversible log of mapping changes.
Track how often the same ambiguity returns. Repeated manual fixes point to a master data improvement the organization should fund, otherwise every new conversation reconstructs the same uncertain mapping.
Measure whether the workflow improves the speed and quality of a defined sourcing or spend review, and leave negotiated savings to a separate measurement once commercial action follows. The immediate value is knowing which records belong together, which is exactly what an examiner or an audit committee will ask you to prove.