Supplier Verification in Australia: What a Clean Result Actually Tells You

A clean supplier verification report looks underwhelming. A column of green ticks, a handful of PASS labels, and a risk score in the low range. Nothing flagged. Nothing to action. It is tempting to scan it quickly, file it, and move on.

The thing worth understanding is what it took to get there. A clean result is not the default state — it is the output of checks against more than a dozen government databases, three real-time DNS and email lookups, and cross-referencing the entity against adverse records that take human analysts hours to compile manually. When everything comes back green, that is a meaningful finding, not a formality.

What "PASS" Means on Each Check

Each tile in a Gumshoe report represents a separate inquiry. A PASS result is not "we did not find anything" — it is "we checked, and the result is affirmatively good." The distinction matters when you are constructing an audit trail or defending a payment decision.

ABN status: PASS means the ABN is active, the GST registration matches what the supplier told you, and the entity type matches the invoice source. Not just "an ABN exists."

ASIC company status: PASS means the company is registered, not under external administration, not deregistered, and the ACN matches the ABR entry. ASIC and the ABR are separate systems that can diverge — and the discrepancy is a red flag that neither system will surface on its own.

Insolvency gazette: PASS means we checked the ASIC external administration register for entries matching this entity's ABN and company name, and found none. At the moment of the check, this supplier is not in voluntary administration, receivership, or liquidation.

Banned persons: PASS means the entity's directors — resolved via ACN from the ASIC register — do not appear on the banned and disqualified persons list. A director can be banned without the company itself being in administration; this check catches that separately.

Email security: PASS means the supplier's domain has SPF and DMARC records configured, making their email harder to spoof in a business email compromise attack targeting your accounts payable team.

What NA (Not Applicable) Means

Some tiles will return NA rather than PASS. This is not a failure — it means the check is not relevant to this entity type, or the data required to run it does not exist for this supplier.

An ABN registered to a sole trader will return NA on the ASIC company status check — sole traders are not registered with ASIC as companies. An entity with no resolvable website will return NA on the WHOIS and email security checks. A business with no QBCC or Fair Trading licence on record returns NA on the trade licence check — because most businesses do not require one.

NA is informational: it tells you the check ran, the entity was assessed, and the check does not apply. It is different from a check that could not complete due to a data error.

The Three Checks That Are Never Trivial

Some PASS results carry more weight than others, depending on what the supplier does and what the payment size is. Three checks are worth reviewing even on a clean report:

Insolvency gazette. This is the last check most accounts payable teams think to run, and the one with the most immediate payment consequence. If your supplier is in administration, payments to them become a creditor claim, not a service payment. A PASS here is actively good news, not a formality.

ASIC Banned Persons. A director who has been banned is legally prohibited from managing a company. If they remain involved, any contracts with that company may be voidable. A PASS on this check means the entity's control structure is not disqualified — something no manual ABN lookup tells you.

Domain registration age. A supplier with a domain registered less than six months ago, combined with an entity created in the same period, is statistically overrepresented in payment fraud cases. Not determinative — startups are legitimate — but worth noting when the invoice value is significant.

Keeping the Record

A clean Gumshoe report serves two functions: a risk decision at the time of onboarding, and a record of due diligence that can be produced in the event of a dispute, audit, or fraud investigation. The timestamp, the ABN, the check results, and the risk score are all in the report.

The most useful thing you can do with a clean report is store it. File it against the supplier record in your accounts payable system. When the same supplier comes up in an audit twelve months later, you have a record of the check, what it found, and when it was run — rather than a note that says "verified, all good."

Run the check. File the result. A boring report, properly dated and stored, is a better audit defence than a complicated one that raised flags and got resolved informally.

Uncommon Insights

A clean supplier verification report is often seen as a formality, but it's essential to understand that it's a meaningful finding that can be used as an audit record. In fact, under section 286 of the Corporations Act 2001, a company must keep records that explain its transactions and financial position, and a supplier verification report can be a valuable addition to these records. By keeping a record of the verification, companies can demonstrate their due diligence and compliance with regulatory requirements.

While a PASS result on an ASIC company status check may seem straightforward, it's essential to understand that ASIC and the Australian Business Register (ABR) are separate systems that can diverge. Under section 601AD of the Corporations Act 2001, ASIC is required to maintain a register of companies, but discrepancies can occur between ASIC and the ABR. A supplier verification report that checks both systems can help identify these discrepancies, which can be a red flag for potential risks.

The Australian Taxation Office (ATO) requires companies to verify the identity of their suppliers to prevent identity theft and other fraudulent activities. A clean supplier verification report can provide assurance that the supplier's identity has been verified, but it's essential to understand that this verification is only accurate at the moment it runs. Under the ATO's guidelines for identity verification, companies must ensure that their verification processes are ongoing and that they regularly review and update their supplier information to prevent identity theft.

A supplier verification report that includes a risk verification matrix can provide valuable insights into the supplier's financial stability and regulatory compliance. Under the ASIC Regulatory Guide 166 (RG 166), companies are required to have adequate risk management systems in place, including systems for identifying and managing risks associated with their suppliers. A risk verification matrix can help companies identify potential risks and take steps to mitigate them, demonstrating their compliance with ASIC's regulatory requirements.