Original Issuance Date: December 4, 2019
Last Revision Date: November 11, 2022
1. Purpose of Procedure
This procedure outlines the processes through which changes to suppliers in the UW System’s shared financial systems are to be verified in compliance with UW System Administrative Policy 363, Change Requests of Bank and Contact Information.
2. Responsible UW System Officer
Senior Associate Vice President for Finance
Contact Information: Mailing/postal address, phone numbers, and e-mail addresses for UW System students, employees and suppliers.
Out-of-Band Verification: A process where validation of changes requires a secondary verification method through a separate, independent communication channel or network.
Past Invoice: An invoice received and successfully processed for payment prior to the current change request.
Supplier: An individual or company from whom the UW System purchases goods or services.
Any request to change the contact information or the name, tax identification number, and/or banking information for a UW System students, employees and suppliers must be verified using out-of-band verification procedures. The key factor is that the verification steps must be independent of the change request received and the steps taken/people talked to must be documented and attached to the UW System’s shared financial system as proof of completion.
If an e-mail is received requesting contact information or name, tax identification number, and/or banking information changes, an electronic copy must be saved at the institutional level to preserve the meta-data in the event that the email is later deemed to be a fraudulent request. In addition, a .pdf copy of the email must be part of the support attached within the UW System’s shared financial systems.
Examples of valid out-of-band verification:
- Use the supplier contact information on record in the UW System’s shared financial system to call or e-mail to confirm the change.
- Use an invoice successfully paid prior to the change request to get a phone number or e-mail to confirm the change.
- Internet search (using a search engine such as Google) of company name to get a phone number and call to confirm the change.
- Internet search (using a search engine such as Google) of company name to verify address matches.
Examples of actions which do not qualify as out-of-band verification:
- Calling the number of the invoice received with new remit address.
- Calling the number on or replying back to the e-mail received to request an address/bank change.
- Calling or e-mailing the supplier based on information provided in a letter requesting address/banking change.
Once the out-of-band verification is completed, it must be documented and attached to the supplier record change request. This can be via use of supplier forms, listed below, notes written on the invoice/e-mail/letter received, or a separate attachment of notes. The verification documentation must indicate:
- what actions were performed;
- who performed the verification, date of verification;
- who was contacted; and
- an indication of positive verification.
If the verification is negative, this documentation along with copies of all forms and correspondence should be provided to the campus police. A copy of the information should be sent to the UW System Administration Vice President for Finance and Administration.
Out-of-band verification is not required when a UW Institution initiates the action, such as an ACH payment fails and the company is contacted for new information or the Authorization for Direct Deposit form is included in the envelope with the check payment (this should be marked in the bottom section prior to mailing).
Out-of-band verification is not required when a new supplier is established. In addition, PO addresses are difficult to verify for two reasons: the supplier is frequently an individual without contact information on file and the UW System’s contracted consumer reporting agency, which verifies and authenticates banking and address information, often does not include PO addresses. As a result, out-of-band verification of supplier address changes to PO addresses can be waived when total annual invoices for the current year and prior two years are less than $7,500 and normal verification procedures are unavailable.
5. Related Documents
Revision 2: November 11, 2022
Revision 1: November 1, 2022
First approved: December 4, 2019