Onboarding is where you check a new supplier before you start using them. How deep the checks go depends on the supplier's tier. Each team (Finance, Legal, Security, Privacy and so on) works in parallel on its own tasks and forms, and a supplier only goes live when every go-live gate is green and a named person signs it off.
Where to find it
Open the Onboarding tab. You'll see:
- A board with four columns: Intake, Triage, Diligence and Negotiation. Each card shows the supplier, tier, area, "X/Y checks done" (and "blocked" if a task is blocked), coloured pills for each go-live gate, and the owner.
- An Onboarding forms table showing, for every supplier, the portal status and the status of each form (or "Not required").
- The tier model, explaining each tier and how it's managed. See Supplier tiers.
The stages
| Stage | Meaning |
|---|---|
| Intake | Request received and waiting to be triaged. |
| Triage | Deciding the tier, owner and which checks are needed. |
| Diligence | Forms and checks are in progress with each team. |
| Negotiation | Agreeing commercial and legal terms. |
| Active | Live supplier, managed through governance and reviews. |
Change the stage with the Stage drop-down under Edit details on the supplier record. Some moves happen automatically: an award puts the supplier in Diligence and go-live sign-off makes it Active.
Two ways to start onboarding
- From Sourcing (recommended for new spend): awarding a sourcing event creates the supplier in Diligence with its checklist. See Sourcing.
- Add supplier without sourcing: for an existing supplier you're bringing under control, or a low-value buy below the tender threshold.
- On the Onboarding page, select Add supplier without sourcing.
- Enter the Supplier name, Area (or create a new one), an optional Sub-category, Requested by and the Tier (T3 by default).
- Answer Will they hold any of our data? (None / Internal or operational data / Customer data or workloads) and add the Estimated annual spend, Currency and What is it for?
- Select Add supplier and create checklist. The supplier starts in Intake and each team gets its tasks.
To bring in many existing suppliers at once, see Importing suppliers.
The onboarding checklist
The checklist depends on the tier and builds up: T2 gets everything in T3 plus more, and T1 gets everything in T2 plus more. Each task goes to the first person listed for that team on the Stakeholders page, due the stated number of days after the supplier is added.
| Tier | Tasks (team, days) |
|---|---|
| T4 Transactional | Conflict-of-interest declaration (Procurement, 3) · Entity & sanctions screening (Legal, 5) · Supplier setup form (Finance, 7) · Penny test & call-back (Finance, 9) · Code of conduct (Procurement, 7) |
| T3 Approved | Conflict-of-interest declaration from requester (Procurement, 3) · Entity & sanctions screening (Legal, 5) · Financial viability check (Finance, 7) · Supplier setup form completed & approved (Finance, 10) · Penny test & call-back verification (Finance, 12) · Internal privacy assessment (Privacy, 12) · Security questionnaire returned & reviewed (Security, 14) · Supplier signs code of conduct (Procurement, 10) · Agree terms & DPA (Legal, 14) · Create supplier in ERP & raise PO (Finance, 16) |
| T2 Key adds | Enhanced due diligence (Security, 14) · Name commercial & technical owners on both sides (Procurement, 7) · Negotiate terms & rate card (Procurement, 21) · Define SLAs & service-credit structure (Infrastructure, 21) · Agree review cadence (Procurement, 28) |
| T1 Strategic adds | Confirm executive sponsor (Executive, 7) · Schedule first joint QBR (Procurement, 30) · Capacity & roadmap alignment session (Infrastructure, 21) · Exit & continuity plan (Procurement, 35) · Concentration-risk review (Finance, 28) |
Several tasks complete themselves when the matching form is approved: the set-up form, privacy assessment, security questionnaire, code of conduct, conflict of interest and penny test. If you raise a supplier's tier later, the record offers Add N checklist item(s) to add the missing tasks.
The intake form and triage questions
The Onboarding intake request is completed by the requester and approved by Procurement. Its triage answers decide which other checks are needed. It covers:
- Request information: date, requester name and email, department, and the business sponsor (Director or above).
- Supplier details: legal name (as on Companies House), trading name, country, registration number, main contact and website.
- Engagement scope: what's being bought, the business case, contract type, start date, initial term, auto-renewal, annual spend excluding VAT, VAT, total contract value and payment currency.
- Triage flags, each answered Yes, No or Unknown:
| Question | If Yes |
|---|---|
| Will the supplier use AI with our data, or to make or support decisions about people? | An AI use assessment is required. |
| Will the supplier process personal data? | An internal privacy assessment is required, and the third-party risk request. |
| Will the supplier access our systems or network? | The security questionnaire and the third-party risk request are required. |
| Is a cross-border data transfer involved? | The privacy assessment is required, so the data protection team confirms the transfer mechanism. |
| Is this a business-critical or essential service? | The third-party risk request is required, and it raises the recommended tier. |
| Is this an existing supplier in our estate? | For information. |
| Will the supplier handle financial data or payments? | For information. It isn't linked to a form by default; you can link it to one in the form editor. |
The intake form also lists Attachments (each Attached, To follow or Not applicable), a Sign-off section, and an automatic Due diligence status panel that lists every other form's status and ends either "Onboarding ready: every required assessment is complete" or "Incomplete".
How SupplierVault decides which forms are required
- The form must be switched on (Use) in Modules & forms, and its module must be on.
- The supplier must match the form's tier and area rule ("Which suppliers can need it?"). No ticks means all suppliers.
- If the form has triage triggers ("Required when"), it's required if any ticked question is answered Yes or is still unanswered or Unknown. It's only skipped when all ticked questions are answered No. The exception is the AI use assessment, which is required only when the AI question is answered Yes.
- A form with no triggers is always required.
Forms that aren't needed are hidden under "N form(s) not needed for this supplier · show".
The standard forms
| Form | Completed by → approved by | Blocks go-live? |
|---|---|---|
| Onboarding intake request | Requester → Procurement | Yes |
| Supplier set-up form (Finance) | Supplier → Finance | Yes |
| Bank verification (penny test) | Supplier and Finance → Finance | Yes |
| Third-party risk assessment request | Business owner → Security | Yes, when required |
| Internal privacy assessment | Business owner and supplier manager → Privacy | Yes, when required |
| Security questionnaire | Supplier → Security | Yes, when required |
| Supplier code of conduct | Supplier (signs) → Procurement | Yes |
| AI use assessment | Supplier → AI governance team | Yes, when required |
| Conflict-of-interest declaration | Requester → Procurement | No |
Your admin can change which forms block go-live, edit their questions and add your own. Compliance packs add more forms for particular areas.
Form statuses and buttons
Each form has a status: Not started, Sent, Submitted, Approved or Rejected. Some forms use their own words: the code of conduct shows Signed, the conflict-of-interest form shows No conflict or Conflict declared, and the bank form shows Verified or Penny test failed.
| Button | What it does |
|---|---|
| Mark sent to supplier / Mark submitted | Records that the form has gone to the supplier, or that an internal form has been filled in. |
| Approve | Approves the form and completes the linked checklist task. The privacy form records who signed and when; the code of conduct records the signed date; the security questionnaire records the returned date. |
| Reject | Sends it back. The next-step guidance then says "Resolve the rejected … and resubmit it." |
| Reopen | Resets an approved or rejected form to Not started. |
| Chase supplier | When a form is Sent and a supplier contact has portal access, opens a reminder email. |
| Download form | Downloads a blank or completed copy, with required fields marked. |
Every decision is stamped "Last decision: … by name on date and time" and logged. The quickest way to get forms back is the supplier portal, where suppliers fill in their own sections.
Evidence
Each form has Evidence for audit. Add a note, an https link or an uploaded file, then Add evidence. Evidence can be added but not deleted, so the record stays complete. Results of UK company and sanctions checks are saved as evidence automatically. Uploads can be up to 10 MB; your admin can choose whether your organisation uploads files, links to them, or both.
Go-live gates
The supplier record shows "Go-live gates" with a tick or circle for each, and the status light shows "X of Y go-live checks". The gates are worked out for each supplier:
- Checklist: there is at least one onboarding task and every onboarding task is Done.
- One gate for each required form that has Blocks go-live switched on. It passes when the form is approved (the bank form passes when the bank details are verified).
- Risk assessed (when Third-party risk is on): a "Last full assessment" date is recorded and the sanctions result is Clear.
- ERP & PO (when Payments & accounts is on): the ERP supplier ID and purchase order are filled in.
Example: a T3 supplier with six required blocking forms and both modules on has 1 + 6 + 1 + 1 = 9 gates.
How to approve go-live
- When every gate is green, select Sign off and go live. If your teams need a second sign-off for this tier, the button says Give the first sign-off and the second team is asked to finish it: see Teams.
- Confirm who you are. Every supplier needs a named sign-off.
- The supplier becomes Active, with the date, your name and your authority recorded in the log.
Who can sign off depends on the tier policy. By default: T1 Executive or senior leader (must be in the Executive team), T2 Senior manager, T3 Department manager, T4 Supplier manager or Procurement. Your admin can change this in the tier policy. The database checks that the person signing off is in the approving team (or covering for someone who is), and it won't let a supplier being onboarded become Active or Under review without a sign-off. With teams set up (Professional plan and above), the procurement team covering the supplier's area can set its own approvers and a second sign-off for each tier, and at go-live the supplier is handed over to the supplier management team for its area. See Teams.
If the approver is away: someone covering for a member of the approving team (for example the Executive team for T1) can sign off on their behalf. The log shows "Approved for go-live (…) by name, covering for name", and reports show the approver the same way. When "A supplier's manager can't approve their own supplier to go live" is on, nobody can approve on behalf of the supplier's manager. The database checks this too.
The next step guidance
Each supplier record shows a Next step: first any rejected form to resolve, then forms to review and approve, then forms still waiting, then overdue tasks, then the first failing gate, and finally "Every control has passed. Approve go-live."
Good to know
- A separate "Checks with evidence" score on the record counts approved required forms, a dated risk assessment, sanctions screening, verified bank details, contract dates and notice period, a named supplier manager and certificates in date.
Related
- Supplier tiers
- Supplier portal
- Bank details and fraud checks
- Company and sanctions checks
- Modules and forms
- Cover while you're away