Excel Supplier Register: How to Build One That Survives an Audit

Contents

• Minimum columns for an audit-ready Excel supplier register
  • Twelve fields you must treat as mandatory
• How to classify and evaluate suppliers
  • Segregation of duties in the evaluation cycle
• Document expiries and alerts to configure
  • Status formula and a practical limitation to know
• Filters, data validation and basic controls
• When Excel stops being enough
• FAQ about an Excel supplier register
• Pre-audit checks: a six-question checklist

Minimum columns for an audit-ready Excel supplier register

Counting suppliers is easy. The weakness starts when a row lacks an internal owner, the date of last review or the evidence that supports a decision. A useful rule: a row is defensible when a person who didn’t create it can reconstruct the relationship, the decision and the evidence without asking the author.

Twelve fields you should not treat as optional

• Supplier ID: stable, unique code assigned once. It should not change when the legal name changes.
• Legal name and legal form: as per corporate records; use a canonical source for periodic checks.
• VAT/Tax ID(s): normalized (no spaces, consistent format) to prevent false duplicates.
• Procurement or project codes (when applicable): links to tenders, contracts or invoices so you can trace from supplier to the procurement event.
• Internal owner: the person accountable for the relationship, review and remediation.
• Service or category: short description of what is supplied and which process it supports.
• Data types accessed: whether the supplier handles personal data, sensitive data or operational data—link this to GDPR/privacy assessments.
• Contract and dates: contract number, start, renewal and end dates; flag tacit renewals.
• Criticality class: e.g., Critical, Relevant, Ordinary, To be qualified, plus documented rationale.
• Last evaluation outcome: date, evaluator and result; link to the supporting evidence.
• Linked evidence: reference to the document and its version (contract, questionnaire, certificate).
• Change history: date, author and reason for each change to status, owner or criticality.

Keep the Supplier ID stable across mergers, name changes or owner replacements; record attribute changes with date and reason in the change history. That stability allows you to connect older and newer evaluations to the same legal entity.

How to classify and evaluate suppliers

Classification determines how deeply you investigate and how often you reassess. If every supplier receives the same questionnaire, you will waste effort on low-risk providers and not focus enough on those that can interrupt critical services or access sensitive systems. Conversely, if criticality is assigned by gut feeling, the auditor cannot verify the criteria.

Use four observable factors: impact on continuity, access to personal or critical systems, replaceability within a short timeframe, and presence of subcontracting. Examples:

• A firm that has access to production systems or can stop a key process is at least Relevant—often Critical—regardless of spend.
• An office-supplies vendor that is easily replaced remains Ordinary even after years of business.

Suggested classes and minimum requirements (use these as operational proposals to embed in your policy):

• Critical: services that can interrupt essential processes or access sensitive systems or data. Review annually and upon contractual change. Evidence: contract with security clauses, completed security questionnaire, latest verification report.
• Relevant: supports important processes but without sensitive-data access. Review biannually or at contract renewal. Evidence: completed questionnaire and attestations.
• Ordinary: easily replaceable goods or services. Review at contract renewal. Evidence: basic supplier registration and contract reference.
• To be qualified: no evaluation yet. Evaluate before the supplier operates on critical processes; record qualification request date.

Separate scoring from the qualification decision. A score aggregates responses and evidence; the decision to approve, approve with conditions or suspend must be made by the owner and the approver.

Segregation of duties in the evaluation cycle

The internal owner proposes the class and outcome and collects evidence. A compliance owner or the responsible function approves. Verification of completeness and consistency must be performed by someone other than the person who compiled the questionnaire or collected attestations. Record name, role and date in the change history.

This separation matters for GDPR and governance frameworks (e.g., ISO, NIS2, DORA, anti-corruption regimes). The spreadsheet documents links to privacy assessments and sensitive processes but does not replace legal analysis, risk assessment or the judgement of oversight bodies.

Document expiries and alerts to configure

A date in a cell is not a control until it generates an alert, reaches a named responsible person and results in a traceable request to the supplier. For repeatable requests and reminders, pair the register with a simple schedule sheet that tracks document requested, received, verified and expired.

Common documents and suggested actions:

• Social security/insurance or labour compliance documents: standard validity e.g., 90–180 days; request renewal 30 days before expiry.
• Corporate registry extract: update at a defined cadence; verify changes against the register.
• Liability insurance: verify coverage and limits at renewal.
• Data processing agreement (Article 28 / equivalent): review 90 days before expiry or renewal.
• Security questionnaire: frequency depends on criticality; require refreshed questionnaires for Critical suppliers.
• Third‑party certifications: verify expiration and authenticity with the issuing body.

Tailor alert thresholds to the document complexity: give more lead time for items that need negotiation or external verification, and shorter windows for quick uploads. Every evidence request should link the control, the supplier, the owner and the expiry date—this is especially important for ICT suppliers in scope of DORA.

Status formula and the practical limitation to know

If expiry is in cell F2, a simple English formula for a status column is:

=IF(F2<TODAY(),"Expired",IF(F2-TODAY()<=30,"Expiring","Valid"))

Apply conditional formatting to make Expired/Expiring rows visible instantly.

Practical limitation: the TODAY() function updates only when the workbook is opened. If nobody opens the register, no alerts fire. Assign a weekly reviewer who records outcomes. Also separate date of receipt from date of expiry: the first shows when the document arrived, the second shows how long it remains valid. Mixing them undermines proof of timely requests and continuity of coverage.

Filters, data validation and basic controls

These steps reduce common errors without turning Excel into a full database:

1. Structured table: convert the list to a table so formulas and filters extend to new rows. Avoid merged cells and duplicate headers.
2. Data validation: use dropdown lists for class, status, owner and service type to prevent variations like "Critical" vs "critical." Maintain the source list centrally.
3. Sheet protection: lock formula and history columns; leave input columns editable and keep the password with the register owner. Remember this is not a substitute for proper access control on shared drives.
4. Filter on expired criticals: before each review, extract Critical suppliers whose evidence is expired. Watch for blank dates—filters may exclude them, but missing dates are a red flag.
5. Version history and change log: rely on OneDrive/SharePoint versioning and add a dedicated Change Log sheet with date, author, field and reason. The technical history often lacks the context an auditor wants.
6. Duplicate detection: highlight duplicate VAT/Tax IDs and Supplier IDs after normalizing formats.

Run a simple acceptance test: filter by Critical and check every row has an owner, a last evaluation date and linked evidence. One incomplete row is enough for an auditor to say the register is not ready.

When Excel stops being enough

Excel can handle initial inventories. It breaks down when it must govern relationships, responsibilities and evidence over time. Regulators and auditors often measure the register against the requirements in DORA (for ICT third‑party risk in financial services), and expect records to show contractual relationships, subcontracting chains, data localization, and start/renewal/termination dates. Even outside financial services, these are useful benchmarks.

Consider moving to a dedicated tool when you observe:

• Divergent versions: multiple people edit copies and no one knows which is authoritative.
• Hidden subcontracting: the supply chain has layers that the sheet only shows as the prime contractor.
• Unlinked services: ICT services are not mapped to critical functions or supported systems.
• Scattered evidence: contracts, approvals and verification reports are in email threads or chats.
• Slow extractions: audits require subsets, exceptions and summaries that take too long to prepare.
• Integrity requests: auditors ask for time‑stamped histories and independent verification of key decisions.

A supplier management tool centralizes requests, document versions and evidence while keeping an audit trail. AuditReady can help operationalize evidence collection and reminders but does not provide legal advice or replace decision‑making by owners.

If an auditor’s question takes more than five minutes of manual reconstruction, your spreadsheet has outlived its purpose.

Frequently asked questions

Can I keep ordinary and critical suppliers on the same sheet?

Yes—if criticality is a mandatory dropdown field. For Critical suppliers add fields for contract clauses, security questionnaire, last verification report, subcontractors and remediation plans. Use filters to separate review workflows.

Can a supplier that hasn’t been qualified operate?

Not on critical processes. Mark them as To Be Qualified and record the date you sent the qualification request, expected documents and the internal owner so waiting does not imply implicit approval.

How do I handle subcontracting discovered after contract signature?

Update the service row with date and reason in the change history, request the subcontractor list from the primary supplier, attach the request as an action with owner and deadline, and reassess criticality and data/system access before confirming qualification.

Is a yearly renewed waiver an exception or a non‑conformity?

An exception is authorized, documented and time‑bound. If a waiver is routinely renewed without fresh assessment, compensating controls or a credible expiry, auditors will treat it as a finding. Repetition converts a managed exception into uncontrolled practice.

Who signs off supplier evaluations?

The owner proposes, the responsible approver signs off, and an independent verifier confirms completeness. Record names and dates, not only the outcome.

Verify the register before an audit

Most audit weak points are not about spreadsheet aesthetics but the chain of evidence. Retroactive approvals, files named register_final_v3, evidence kept only in emails, and corrective actions closed without independent verification are frequent causes of findings. Screenshots without date, author or version rarely hold up.

Concrete remedies: maintain a single authoritative file, separate receipt date from expiry date, link every piece of evidence to a version, and record author and rationale for each change.

Pre‑audit checklist: six questions

1. Completeness of criticals: does every Critical supplier have an owner and a date of last evaluation?
2. Existence of evidence: does each linked document exist in the stated version and is it accessible to those who must present it?
3. Handling expired items: for each Expired item, is there a traceable renewal request with recipient and date?
4. Recent history: do changes in the last 12 months show author, reason and approval?
5. Linked requests: are supplier requests tied to a control, recipient, status and due date?
6. Independent readability: can an unfamiliar person answer an auditor’s question in five minutes using the register and linked evidence?

Have someone who does not operate the register run the checklist. For questions 2 and 6, pick three suppliers at random, follow the evidence links and time how long it takes to produce the requested document. If the path runs through email, chat or a single person’s memory, it’s insufficient.

Treat negative outcomes as non‑conformities: assign an owner, corrective actions and deadlines, then obtain signed closure evidence. A credible register shows problems found, decisions taken and verified closures.

If your register still requires manual searches across drives and inboxes, consider AuditReady to centralize evidence, request documents from suppliers via secure expiring links, and track owners, expiries and remediation. AuditReady organizes materials into a structured evidence package while leaving the qualification and approval decisions to your people.