Every vendor relationship starts the same way. Someone decides the business needs a new supplier. A conversation happens, terms are agreed, and work begins. At some point, an invoice arrives. Finance discovers the vendor is not set up in the system. There is no signed contract on file. Nobody is sure whether a tax certificate was collected.
This is vendor onboarding in the absence of a process. It works until it does not. And it stops working right around the time the vendor causes a problem: a billing dispute, a data incident, a compliance gap, or simply the need to off-board someone who now has system access nobody documented.
A vendor onboarding process is not red tape. It is the set of steps that prevent a routine engagement from becoming an expensive problem.
What vendor onboarding is actually supposed to do
Vendor onboarding accomplishes four things when done well.
First, it establishes that the vendor is who they say they are. ABN verification in Australia, or equivalent tax identity checks in other jurisdictions, is a basic step that many small businesses skip because it seems unnecessary until they encounter a duplicate payment scam or an incorrectly registered supplier.
Second, it captures the commercial terms. What will be delivered, at what price, under what payment terms, and with what notice period for changes or termination. This does not require a 50-page contract. A signed work order or service agreement with these basics documented is enough.
Third, it sets up the operational relationship. Who is the contact on each side? How will invoices be submitted? What does the approval process look like? If the vendor needs system access, what level and for how long?
Fourth, it creates a record. When a vendor's contract comes up for renewal, or a dispute arises, or finance audits the supplier list, the onboarding record is where you go for the baseline facts.
Why this matters more than it used to
The risk profile of vendor relationships has changed. Suppliers increasingly touch sensitive data, have access to internal systems, or sit in the path of a financial transaction. That creates an exposure that most SMBs underestimate.
Third-party involvement in data breaches doubled year-on-year in 2024, reaching 30% of all confirmed breaches according to Verizon's annual breach report.
That shift is not confined to large enterprises. SMBs use SaaS tools that hold customer data. They engage contractors who have admin access to production systems. They work with accounting firms that can see their full financial picture. Each of those is a vendor relationship, and each carries third-party risk.
The onboarding process is where you establish whether a vendor's security posture is sufficient before they have access, not after an incident.
There is also a broader visibility problem. Most organisations can account for their largest direct suppliers. Beyond that, the picture gets murky quickly.
Deloitte's 2021 Global CPO Survey found that while approximately 70% of procurement leaders felt they had good visibility into their direct Tier 1 suppliers, just 15% claimed visibility into Tier 2 suppliers and beyond.
For an SMB, that Tier 2 problem looks different but the principle applies. The contractors you engage might subcontract work. The agencies you use have their own technology vendors. A structured onboarding process that captures basic vendor information, scope of access, and commercial terms is the foundation for understanding who is actually in your supply chain.
A practical onboarding process for a business without a procurement team
The following process works for a company in the 50-200 employee range that does not have a dedicated procurement function. It is designed to be repeatable without being bureaucratic.
Step 1: Pre-approval check
Before a new vendor is approved, establish whether you already have an existing supplier who can provide the same service. Vendor sprawl is real. A new supplier creates onboarding effort, an additional invoice stream, and another vendor relationship to manage. If an existing, trusted supplier can do the work, that is usually the better choice.
Step 2: Verify vendor identity
Collect the vendor's ABN (in Australia), legal business name, trading name if different, registered address, and principal contact. Run an ABN lookup via the Australian Business Register. This takes two minutes and eliminates a category of risk. For international vendors, equivalent tax registration details apply.
Step 3: Collect a signed agreement
For routine services under a defined value threshold, a standard service agreement covering scope, price, payment terms, and termination is sufficient. Most finance teams set this threshold somewhere between $10,000 and $20,000 annually, below which a signed work order or purchase order is used instead. For anything above that threshold or involving sensitive data or system access, a proper contract is warranted.
Step 4: Set up in your accounting system
For businesses using Xero, this means creating the vendor as a contact with their bank details, payment terms, and currency. If your vendor spend management tool links to Xero, the vendor should be created there too, establishing the link between contact details, contracts, and payment history in one place.
Step 5: Assign an internal owner
Every vendor should have someone internally who owns the relationship. That person approves invoices from that vendor, handles service issues, and makes the call on whether to renew. If that person leaves the company and no one knows who owned the vendor relationship, you have a management gap.
Step 6: Document any system access
If the vendor requires access to your systems, document what access, at what level, and until when. Schedule a review at the end of the engagement. Access that persists after a relationship ends is a security risk, and a surprisingly common one.
What good onboarding looks like at different vendor tiers
Not every vendor warrants the same effort. A reasonable tiered approach:
Tier 1 (high value or high access): Full onboarding including formal contract, security review, and documented access. Annual review. Applies to key agencies, software vendors with admin access, and advisors with access to sensitive financial data.
Tier 2 (standard recurring): Signed work order or service agreement, ABN verification, payment terms documented. Applies to most professional services and regular contractors.
Tier 3 (low value, one-off): Basic identity verification and documented approval. Applies to ad hoc purchases below your defined threshold.
This tiering means most vendor onboarding can be completed in minutes. Only Tier 1 vendors require meaningful time investment.
The connection to vendor contract management
Onboarding is the beginning of a vendor lifecycle, not a standalone process. The information collected at onboarding feeds directly into vendor contract management: when the contract was signed, what it covers, when it expires, and who owns the renewal decision.
It also feeds into vendor spend management: whether the vendor is generating value, whether spend is staying within agreed terms, and whether the relationship warrants continued investment.
Businesses that treat onboarding as a one-time admin task tend to accumulate vendor sprawl and contract management gaps. Businesses that treat it as the start of a structured relationship have a cleaner, more manageable vendor roster and fewer surprises when something goes wrong.
The bottom line
You do not need a procurement team to have a good vendor onboarding process. You need a standard set of steps, consistently applied, with the right information recorded in the right place.
The payoff is not just risk reduction. It is the ability to answer basic questions quickly when it matters: Who is this vendor? What did we agree to? Who owns this relationship? What do they have access to? A good onboarding process makes those questions trivial. The absence of one makes them expensive.
