Approving a supplier is not a judgement about whether they are good. It is a decision to trade with a legal entity, taken on a file of evidence that a person has read, and it holds only for as long as the evidence in that file holds. Those two sentences do most of the work in this piece. The checks themselves are ordinary — registration, insurance, sanctions screening, references, financial standing — and each of them establishes something narrow, verifiable and temporary. What fails is not the check. It is the assumption that clearing a check at approval clears the supplier thereafter.
Two mistakes follow from that assumption and both are common. The first is treating a check as a verdict: the supplier is registered, therefore the supplier is sound; insurance was produced, therefore the risk is covered. A registration extract establishes that a company exists on a register on a date. It establishes nothing about whether the company trades, whether it can do the work, or whether the person writing to you has any authority to bind it. The second mistake is treating the approval as permanent: a supplier file assembled in February and consulted in December is a file about February.
This piece sets out the five checks as evidence to collect, what each can and cannot establish, the fields that make a supplier file usable a year after it was built, a worked example of an approval that was correct on the day it was taken and wrong sixty-nine days later, the limits no check programme can cross, and the decision that turns the file from paperwork into a control.
What an approval is
An approval to trade with a supplier is a delegation and a date. Somebody with the authority to commit the organisation’s money decides that this entity may be bought from, in this scope, on these conditions, until a stated date or until stated evidence expires. The record of that decision is the supplier file, and its value is entirely in what it lets a stranger check afterwards: who decided, on what evidence, on what date, and what would have to change for the decision to be revisited.
There are three readers for that file, and they want different things from it. The buyer wants to know what the supplier can do and on what terms. The approver wants to know whether the evidence is sufficient to support the commitment being proposed. The auditor, or the person investigating a loss two years later, wants to know what was true on the date of the order rather than on the date of the enquiry. A file that serves only the first two readers is a working document. The third reader is the one that decides whether it was a control.
The evidence itself comes from outside the organisation, which is both the point and the weakness. Registration extracts, certificates, screening results, referee statements and filed accounts are all produced by somebody other than the buyer, and none of them is produced for the buyer’s purpose. A certificate of insurance exists to record a contract between the supplier and an insurer. It becomes evidence in a supplier file by accident, and it is read by people who did not write it and cannot verify it directly.
The five checks, and what each establishes
Table 1 sets out the five checks with the evidence each produces and, in the two right-hand columns, the boundary that matters: what the evidence establishes and what it does not. The right-hand column is deliberately narrow. Every phrase in it could be prefixed with “only”.
Table 1. The five supplier checks, the evidence each produces, what it establishes, and what it cannot. Source: the purchase manager’s supplier file as specified by the role, read against the documents each check actually produces.
| Check | The evidence | What it establishes | What it cannot establish |
|---|---|---|---|
| Registration | An extract from the companies register: legal name, number, status, registered address, incorporation date, officers | That the entity exists on that register, on the date read, and who its officers are | That it trades; that it can perform the work; that the person corresponding with you holds any authority to bind it |
| Insurance | A certificate or schedule: insurer, policy number, cover, limits, period of cover | That an insurer issued a policy on those terms to that legal entity | That the premium was paid; that cover continues beyond the period shown; that the limits match your exposure; that the exclusion that matters to you is absent |
| Sanctions screening | A result from a named list or lists, screened against named parties, on a stated date | That the screened names were not on the lists searched, on the day searched | That the entity is not on a list not searched; that an officer or an owner not screened is not listed; that ownership has not changed since |
| References | Two named customers, the dates and what was bought, read back with specific questions | That somebody is willing to speak for the supplier, and what they say to a particular question | That the referee is independent, representative, or still a customer; that what they say is true |
| Financial standing | Filed accounts, a credit report, a bank reference, each with its date | That the entity reported those figures at that date, as filed | Solvency today; that the accounts were audited; that the figures describe the part of the business that would serve you |
Read the fourth column as a list of the things an approval is often assumed to have established. The most expensive of them is the insurance line, because it has two independent failure points: the policy may lapse before the buyer’s re-check date, and the cover may not reach the exposure the buyer has created. A certificate with a $2,000,000 limit is evidence of a $2,000,000 limit, not of $2,000,000 of protection. What it covers, what it excludes, whether the premium is paid and whether the insurer will pay a particular claim are four separate questions, and the certificate answers one of them.
The sanctions check has the same shape and a sharper edge. Screening is a search of named parties against named lists on a named date. It is a snapshot with a timestamp, and its value decays: lists are amended, ownership changes, and a result produced in February is a statement about February. The check also has a scope problem that no amount of care at the screening step fixes — a supplier whose owners have not been identified cannot be screened by ownership, so the file should record which parties were screened and which were not, rather than a single word indicating that screening happened.
References are the check most often read as a verdict and least able to support one. A referee chosen by the supplier is not a sample; it is a nomination. What a reference can establish is narrow and useful: that a named person at a named organisation will say a specific thing about a specific engagement. Read that way — with questions about quantities, dates and what went wrong — a reference is a genuine test. Read as “two happy customers”, it is a courtesy the supplier performs.
The fields that make a file usable a year later
The difference between a supplier file and a folder of certificates is six fields. Table 2 is the checklist. Each row names a field, what goes in it, the date it must carry, and who owns it. A file missing the third column is the one that produces the worked example in the next section.
Table 2. The supplier file checklist: the fields that make an approval testable a year after it was taken, with the date each must carry and its owner.
| Field | What it holds | The date it must carry | Owner |
|---|---|---|---|
| Entity | Legal name, registration number, registered address | The date the register was read | Buyer |
| Each check | The evidence document, referenced by name and date | The date the evidence was read | Buyer |
| Validity | When the evidence itself stops being true: policy period, accounts date, next list update | The expiry printed on the document, not the reading date | Buyer |
| Re-check | The next date this check must be repeated | Derived from the validity date, not from the approval date | Buyer |
| Approval | Approved, approved with conditions, or declined, with the reason in a sentence | The date of the decision | Named approver |
| Scope | What may be bought, up to what value, on what terms | The period of the approval | Named approver |
The row that does the work is the fourth. A re-check date derived from the approval date is a schedule; a re-check date derived from the expiry printed on the document is a control. The two differ by exactly the age of the evidence at the moment it was read, and that gap is where a supplier on an approved list can sit for months on a certificate that no longer exists.
The fifth and sixth fields are what make the file a decision rather than a collection. “Approved” without a scope is an unbounded permission, and an approval without a named person is not an approval — it is a state the file reached. The conditions matter as much as the decision: a supplier approved on condition that annual accounts are filed within ninety days of the year end has a date attached to their continued approval, which is the difference between a condition and a note.
Worked example: sixty-nine days on an expired certificate
The example is constructed for this piece. A fabrication supplier, Harlow Fabrication Ltd, is approved on 12 February 2026 on all five checks. The file is complete: registration read that day, insurance certificate on file, sanctions screening run, two references taken and recorded, accounts for the year to 31 March 2025 read.
The insurance certificate shows a policy period of 1 October 2025 to 30 September 2026, with public liability cover of $2,000,000. The buyer records the check as read on 12 February 2026 and sets the re-check date twelve months later, on 12 February 2027, because the field asked when the check was done and the buyer answered from the approval date rather than from the certificate. The certificate’s own expiry — 30 September 2026 — is on the document and appears nowhere in the file.
From 1 October 2026 the supplier is trading without the insurance the approval was taken on. Four orders are placed in the window, all raised by people who had no reason to look: 14 October, $18,400; 3 November, $22,850; 27 November, $31,700; 8 December, $11,650. The gap is closed on 8 December, sixty-nine days after the certificate expired, when a new certificate is requested for an unrelated reason and the date is noticed.
Table 3 sets out what the window contained, and what each figure measures.
Table 3. The exposure carried by a re-check date set from the approval instead of from the certificate. Constructed for this piece; four orders, placed inside a sixty-nine-day window.
| Line | Amount | What it measures |
|---|---|---|
| Orders raised after cover expired | $84,600.00 | Commitments made on an approval whose evidence had lapsed |
| Delivered and invoiced by 8 December | $61,250.00 | Exposure that is now a fact rather than a possibility |
| Still on order at 8 December | $23,350.00 | Exposure that could still be cancelled |
| Days between expiry and discovery | 69 | The length of the failure, in calendar days |
| Average commitment per day in the window | $1,226.09 | What the unchecked list was being used for |
The arithmetic is plain. $18,400.00 + $22,850.00 + $31,700.00 + $11,650.00 = $84,600.00. Of that, $61,250.00 had been delivered and invoiced before anybody looked, leaving $23,350.00 on order — and $84,600.00 divided by 69 days is $1,226.09 a day. None of these figures describes a loss. They describe a period during which the organisation’s own approval said the supplier was insured and the insurer’s document said otherwise, and every order in that period was placed on the strength of the approval.
Two things are worth separating in the example, because they carry different remedies. The first failure is the field: a re-check date built from the wrong date. That is fixed by asking for the expiry on the document. The second is the reading: the certificate was on file, complete, dated, and nobody had extracted the one line that mattered. That is fixed by the file requiring the value, not the document — the policy period written into a field of its own, in the same call that reads the certificate, so that the next person to look sees 30 September 2026 rather than a PDF they have to open.
The example also shows why the checks cannot be run as a batch at approval and then left. Three of the five have validity dates that arrive independently of the approval: a policy period, an accounts date, a list revision. An approval is a decision with a horizon, and the horizon is the earliest of those three dates — unless the file records them, in which case it is a known horizon, and the supplier is reviewed rather than discovered.
What no check programme establishes
Five limits are worth stating plainly, because each one is a question a buyer will ask of a supplier file and each has the same answer: the file cannot tell you that.
The first is performance. None of the five checks tests whether the supplier can do the work at the volume, quality and date required. Registration says the company exists; insurance says a policy was issued; references say somebody will speak; accounts say what was filed. Capability is established by a trial order, a site visit, a specification read by somebody technical, or the first delivery — and every one of those is a document the buyer has to create rather than collect.
The second is conduct. A clean screen is a statement about lists, not about behaviour; a clean reference is a statement about one engagement, chosen by the supplier. Where the organisation’s exposure is to how a supplier behaves under pressure — a late delivery, a defect, a dispute — no pre-qualification document in this set speaks to it.
The third is the reading. Every check in Table 1 is a document read by somebody, and the file records that it was read rather than what it said. The distinction between “insurance verified” and “policy 1 October 2025 to 30 September 2026, $2,000,000 public liability” is the whole difference between a tick and an evidence trail, and it costs one extra field.
The fourth is the boundary of the entity. Checks are run against a legal entity, and trade happens between entities. Where a supplier trades through a group, a parent guarantee, a trading name or a newly incorporated subsidiary, the entity that was checked may not be the entity that invoices, and the entity that invoices may hold none of the assets the check was meant to reach.
The fifth is time. Everything in Table 1 is true of a date. A supplier file that does not carry those dates forward into a review schedule is a file that becomes false quietly — not on the day it was made, but on the first day one of its documents expired, which nobody marked.
What it costs to run
The checks are document work, and document work is where a measured per-call price is available rather than an estimate. Reading one piece of evidence into the supplier file is one call: a registration extract, a certificate, a screening result and a set of accounts are four. A reference read back and recorded is one more, and assembling the file with its re-check register is one. That is six calls for a complete approval — $0.04200 at the measured Base rate of $0.00700, read from the live 402 challenge today.
Re-checking is cheaper than approving because the file already exists. Five checks re-read once a year is five calls; a sanctions screen run quarterly is four reads a year; so nine calls a year per supplier, $0.06300. Forty approved suppliers carry 360 calls, $2.52000. Eight new suppliers a year at six calls each adds 48 calls, $0.33600. A monthly call that lists the evidence expiring in the next thirty days across the whole list is twelve calls, $0.08400. The programme is 420 calls and $2.94000 a year: $0.24500 a month for forty suppliers.
Set that against the example. The four orders placed in the sixty-nine-day window are $84,600.00, which is 28,776 times the annual cost of running the checks on forty suppliers, and the year’s programme is a fraction of one order: $2.94000 is 0.0035 per cent of $84,600.00, which is to say less than four thousandths of one per cent of the commitments made while the certificate was void.
A second reader is worth pricing at the one step where a miss is expensive. The four quarterly sanctions screens run on DeepSeek at $0.00700 are $0.02800; the same four run again on Qwen flash at its measured Base rate of $0.00875 are $0.03500, so a double screen costs $0.06300 a supplier a year — $0.00700, or 25 per cent, more than screening once, for a second independent read on the check whose result nobody can verify by opening a document. The figure is small enough that the question is not cost but whether the second result is ever read.
The 0.50 USDC opening balance on the workspace is 71 calls at this rate: eleven complete supplier approvals and part of a twelfth, against a role page that assumes sixty purchase cycles a month at 300 calls. Onboarding a supplier is a burst of work rather than a monthly one, and it is the burst that the balance runs out on first.
The decision
Put the expiry date in the file, not the reading date, and derive the re-check from it. This is the single field that turns an approval into a control, it costs nothing to add, and every other improvement in this piece depends on it: without a validity date there is nothing to review, and a review with nothing to review is a meeting.
Then name the approver and the scope on the file, because an approval with neither is a state rather than a decision: approved by whom, for what, up to what value, until when. A supplier file that cannot answer those four questions cannot support an order, and the order will be placed anyway, on the strength of a relationship and a memory.
And decide, once, what each check is for. Registration and financial standing answer “is this a real, solvent counterparty”. Insurance and sanctions answer “what happens if it goes wrong and who else is involved”. References answer “has anybody bought this before and what did they say”. Where the file keeps those three questions separate, an approver can see which one is unanswered; where it collapses them into a single verified column, the approver sees a tick and nothing else.
The agent’s part in this is narrow and it is the part that gets skipped when the work is busy: read the document, extract the values and the dates, place them in the fields, set the re-check from the expiry, and put the file in front of a person. It prepares the case. It cannot approve the supplier, cannot vary the scope, and cannot decide that a lapsed certificate is acceptable — and a supplier approval taken by anything other than a named person is a decision the organisation cannot defend when the question is asked.
Where this goes
- The pillar: x402.review/2026/10/31/commercial-operations/ — one record, two readers, and the approvals between them
- The role that keeps the file: studio.x402.press/roles/purchase_manager — the supplier file, the approval record and the order it cannot issue without one
- Who may approve, and within what: approval limits and segregation of duties — the bands, the record, and the signature that has to come after its evidence
- Where the approved list is spent: the three-quote comparison template — the comparison that decides which approved supplier is bought from
- The service it buys: x402.press/services/deepseek/ — the canonical price, seven chains
- The review: x402.review/2026/10/31/deepseek-review/ — the measured handshake and what it does not promise
Method note
The price was read from the live 402 challenge on Base on 31 October 2026, a Saturday and therefore outside DeepSeek’s weekday peak windows: 7000 atomic units under exact, which is $0.00700, and 9550 under upto at the max_tokens tested. Qwen flash’s $0.00875 was read from its own challenge in the same way. Call counts are planning assumptions, stated where they are used: six calls for a complete approval, nine a year for a re-check, twelve for the monthly expiry list.
Harlow Fabrication, the four orders, the dates and the figures in Table 3 are constructed for this piece; they describe no real supplier and no real loss. The checks, their limits and the field set are the discipline as the role specifies it, not the results of an audit of a live supplier file. No accuracy rate for document extraction, no time-to-complete and no variance rate is quoted anywhere here, because none has been measured.
x402.review is written and edited by N.P. Vincent. The publication is connected to x402.press, which sells the services reviewed here; that interest is disclosed on every piece that touches a service, and it is stated here rather than left to inference.
Filed under Jobs · Tags: suppliers, due-diligence, compliance, checks
