Method
The tool turns each name, tax ID, address and bank account into a cleaned key, groups records on the key, and reports groups of two or more. Address groups are reported only when the vendor names differ, because the same vendor at one address is not a finding. Employee-vendor findings pair a vendor group with the employees that share the same cleaned key.
Source
Master-data matching is a procedure an auditor can use when responding to assessed fraud risks (AU-C 240) and risks of material misstatement (AU-C 315). The standards do not prescribe which fields to match or how to clean them; those choices belong in your methodology and the workpaper.
When to use it
Use it on the full vendor master before selecting payments to test, when vendor setup controls are weak, or when a hotline tip or an inquiry points at a purchasing relationship. Follow a hit into the duplicate transaction finder to see the payments.
Limits
Exact matching on cleaned values misses transposed digits, misspellings and a P.O. box that stands in for a street address. A match is a lead and may have a harmless explanation. The test cannot see ownership, so an employee who owns a vendor under another name and address will not appear. Check the result against your firm's methodology before relying on it.
Common questions
What does the test compare?
Within the vendor file: shared tax IDs, shared bank accounts, names that match after cleaning, and different vendor names at one address. Between the files: a vendor and an employee that share a tax ID or SSN, a bank account or an address. Each comparison needs its column mapped.
How are the values cleaned before matching?
Tax IDs, SSNs and bank accounts compare on digits only and need at least four. Addresses are lower-cased, punctuation is removed and common words shorten to the usual postal forms, so 5 Far Lane and 5 Far Ln match. Vendor names lose case, punctuation and endings such as Inc, LLC and Co. Matching is exact on the cleaned value, so a typo will not match.
Is an employee-vendor match a conflict of interest?
It is a reason to ask. Employees can legitimately own a supplier, and an address match can be a shared building. The finding becomes a problem when the relationship was not disclosed or approved and the vendor was paid. Ask for the disclosure, the vendor setup form and the approver of its invoices.
Why look at duplicate vendor records?
Two records for one payee make a duplicate payment possible, split year-end totals for information reporting, and can hide a payee that was set up to dodge a review. Pair this with the duplicate transaction finder to see whether payments actually went out twice.
How should I handle SSNs and bank accounts?
Paste the least you need. The tool runs in your browser and sends and stores nothing, but you can keep only the last four or more digits for matching, and follow your engagement's data handling rules for the source file.
Runs in your browser. The figures you type are not sent to CORAA or stored. Check the result against your firm's methodology before relying on it.