What a dormant-vendor review can and cannot establish

Freeze the vendor master as of a stated date. Before querying it, define the entities, covered systems, eligible vendor types, qualifying transaction classes, and inactivity interval. One unique vendor ID in that snapshot is the observation unit. Duplicates, one-time vendors, intercompany records, blocked records, and never-used records need written treatment rather than after-the-fact removal.

The output is a population that met the declared rule. It does not establish fraud, duplication, invalid identity, or lack of future business need. GAO's fraud-risk framework makes data analytics part of a wider risk-management process; this protocol adopts the bounded idea of using a query to select records for follow-up, not the conclusion that inactivity is suspicious.

For every eligible ID, retain active status, last qualifying transaction date, open payables or credits, recent master-data changes, recurring or seasonal indicator, responsible owner, and final disposition. Preserve the master snapshot, transaction-extract parameters, extraction time, row counts, and reconciliation of vendor IDs between the two sources.

Only fields needed for identification and review should enter the working file. Bank details, tax identifiers, addresses, and contacts should be masked or omitted unless the approved follow-up requires them. The IRS recordkeeping guidance supports retaining evidence for purchases and expenses, but it does not define this extract or how long a vendor record must remain active.

Set a cutoff date by subtracting the approved inactivity interval from the snapshot date. Count eligible vendors whose latest qualifying activity is before that cutoff, then divide by all eligible vendor IDs. Report never-used records separately because they have no last-activity date. Disclose records for which history is missing or the identifier cannot be matched.

Segment, without silently redefining the denominator, dormant records that have open balances, pending payments, recent bank-detail changes, contracts, or recurring status. Those flags help prioritize review. They do not prove the record should be disabled, and they should not change the inactivity result unless the approved inclusion rule says so.

A bookkeeper can assemble authorized extracts, apply the frozen rule, and route flagged records. The vendor-master owner should approve eligibility, qualifying activity, and any status change. A reviewer should retest samples from dormant, active, never-used, and excluded groups and reconcile unmatched IDs.

GAO's internal-control principles support documented responsibility and review, but they do not require this exact workflow. Callback procedures, payment controls, privacy restrictions, tax treatment, and record retention remain separate decisions for their authorized owners. The dormant label alone should trigger none of them automatically.

Seasonal suppliers, long-term contracts, acquisitions, duplicate cleanup, entity restructuring, and system migrations can alter the dormant share. Missing legacy transactions can make records appear older, while a consolidated vendor ID can conceal recent activity. These conditions are competing interpretations, not demonstrated causes.

Systems also differ in archival rules, identifier reuse, and transaction coverage. Any reported result should disclose the snapshot date, threshold, qualifying activities, eligible population, covered systems, unmatched IDs, exclusions, missing-history constraints, and review dispositions. No external benchmark follows from this protocol.