Original Issuance Date: December 4, 2019
Last Revision Date: December 4, 2019
1. Purpose of Procedure
This procedure outlines the processes through which changes to suppliers in the UW System’s shared financial systems are to be verified in compliance with UW System Administrative Policy 363, Change Requests of Bank and Contact Information.
2. Responsible UW System Officer
Vice President for Finance
Contact Information: Mailing/postal address, phone numbers, and e-mail addresses for UW System students, employees and suppliers.
Out-of-Band Verification: A process where validation of changes requires a secondary verification method through a separate, independent communication channel or network.
Past Invoice: An invoice received and successfully processed for payment prior to the current change request.
Supplier: An individual or company from whom the UW System purchases goods or services.
Any request to change the contact information or the name, tax identification number, and/or banking information for a UW System students, employees and suppliers must be verified using out-of-band verification procedures. The key factor is that the verification steps must be independent of the change request received and the steps taken/people talked to must be documented and attached to the UW System’s shared financial system as proof of completion.
If an e-mail is received requesting contact information or name, tax identification number, and/or banking information changes, an electronic copy must be saved at the institutional level to preserve the meta-data in the event that the email is later deemed to be a fraudulent request. In addition, a .pdf copy of the email must be part of the support attached within the UW System’s shared financial systems.
Examples of valid out-of-band verification:
- Use the supplier contact information on record in the UW System’s shared financial system to call or e-mail to confirm the change.
- Use an invoice successfully paid prior to the change request to get a phone number or e-mail to confirm the change.
- Internet search (using a search engine such as Google) of company name to get a phone number and call to confirm the change.
- Internet search (using a search engine such as Google) of company name to verify address matches.
Examples of actions which do not qualify as out-of-band verification:
- Calling the number of the invoice received with new remit address.
- Calling the number on or replying back to the e-mail received to request an address/bank change.
- Calling or e-mailing the supplier based on information provided in a letter requesting address/banking change.
Once the out-of-band verification is completed, it must be documented and attached to the supplier record change request. This can be via use of supplier forms, listed below, notes written on the invoice/e-mail/letter received, or a separate attachment of notes. The verification documentation must indicate:
- what actions were performed;
- who performed the verification, date of verification;
- who was contacted; and
- an indication of positive verification.
If the verification is negative, this documentation along with copies of all forms and correspondence should be provided to the campus police. A copy of the information should be sent to the UW System Administration Vice President for Finance.
Out-of-band verification is not required when a UW Institution initiates the action, such as an ACH payment fails and the company is contacted for new information or the Authorization for Direct Deposit form is included in the envelope with the check payment (this should be marked in the bottom section prior to mailing).
Out-of-band verification is not required when a new supplier is established.
5. Related Documents
Optional forms are available for use:
- Supplier Name or Address Change: This form can be completed by the supplier to indicate a name or address change/addition. Sections 1-8 are completed by the supplier and the bottom section is completed by Institution staff to note the out-of-band verification steps taken.
- Authorization for Direct Deposit: This form can be completed by the supplier to indicate a change in banking information or the addition of ACH banking information. Sections 1-8 are completed by the supplier and the bottom section is completed by Institution staff to note the out-of-band verification steps taken.
- New Supplier Form: This form can be completed by the supplier during the initial setup of the new supplier.
First approved: December 4, 2019