From 40 Minutes to 60 Seconds: The ROI of Automated Supplier Verification

The Manual Verification Time Budget

A properly conducted manual supplier verification — one that covers ABN status, ASIC company status, GST registration, web presence, domain WHOIS, email authentication records, and a basic reputation check — takes an experienced accounts professional approximately 35 to 45 minutes per supplier. This assumes familiarity with the relevant government websites, the ability to interpret DNS lookup results, and access to the necessary tools.

Most AP teams do not do all of this. They do the ABN lookup (two minutes), maybe a Google search (five minutes), and move on. The full 40-minute verification is aspirational — the actual time spent is closer to 7 to 10 minutes, and the checks performed are insufficient to detect most modern fraud patterns.

This creates a dilemma: the verification that actually works takes 40 minutes, and at volume, 40 minutes per supplier is not sustainable. So either the quality of verification suffers, or the volume of suppliers that can be properly verified is severely constrained. In practice, both happen simultaneously.

The Volume Calculation

Consider a business that onboards 20 new suppliers per year — a modest figure for any organisation with active procurement. At 40 minutes of proper manual verification per supplier:

• 800 minutes of verification time per year — about 13 hours
• At a fully-loaded cost of $80/hour for an experienced AP officer: $1,040 per year in labour cost for supplier verification alone
• This does not include time spent on banking detail changes, which should trigger re-verification: assume another 10 per year
• Total: 1,200 minutes — 20 hours — at $80/hour: $1,600 per year

For most businesses, $1,600 per year in verification labour is not the constraining factor. The constraining factor is that 20 hours of verification time is genuinely unavailable in an AP team that is also processing hundreds of invoices, managing payment runs, handling supplier queries, and managing month-end. Verification gets deprioritised, shortened, or skipped.

The Cost of a Single Fraud Event

A single successful supplier fraud event — payment redirected to a fraudulent account — costs, on average, $30,000 to $150,000 in direct losses for an Australian SME. The distribution is wide: small events can be $5,000 to $10,000 (a one-invoice redirect); major events can exceed $500,000 where the fraud ran undetected for multiple payment cycles.

Beyond direct loss:

• 40 to 80 hours of internal investigation time: $3,200 to $6,400
• External legal and forensic costs if recovery is pursued: $5,000 to $30,000
• Insurance premium increase at renewal: $2,000 to $8,000 per year ongoing
• Post-incident AP process audit: $10,000 to $40,000
• Total incident cost including indirect: $50,000 to $200,000+

Expected Value of Improved Verification

Expected value analysis provides a framework for quantifying the benefit of better verification. If a business processes 20 new supplier onboardings per year, and each presents a 1% probability of being a fraud attempt (a conservative estimate given ACCC data on the frequency of fraudulent supplier setups), then the expected number of fraud events is 0.2 per year — one event every five years.

At an average direct cost of $60,000, the expected annual cost of fraud is $12,000. A verification process that reduces the fraud success rate from 100% (no proper verification) to 5% (automated verification catches most attempts but occasional sophisticated attacks succeed) reduces the expected annual fraud cost to $600 — a saving of $11,400 per year.

Gumshoe's current pricing for unlimited verifications is a fraction of this expected saving. The ROI calculation is straightforward.

The Time Saving Is the Real Benefit

The expected value calculation, while accurate, understates the actual benefit of automated verification for most businesses. The primary benefit is not financial — it is the elimination of the time constraint that forces verification shortcuts in the first place.

At 60 seconds per verification instead of 40 minutes, the verification process becomes something that actually happens — every time, for every supplier — rather than something that is supposed to happen but is routinely compressed or skipped under workload pressure. A complete verification that takes 60 seconds and produces an audit-ready report is not competing with other AP tasks for time. It is a check that can be performed as part of the standard vendor creation workflow without slowing anything down.

This means the comparison is not really "40 minutes of manual verification vs 60 seconds of automated verification." It is "7 minutes of incomplete manual verification vs 60 seconds of comprehensive automated verification." Automated verification is faster and more thorough simultaneously.

"The comparison is not 40 minutes of manual verification versus 60 seconds of automated. It is 7 minutes of incomplete manual verification versus 60 seconds of comprehensive automated verification. Automated is faster and more thorough simultaneously."

The Audit Trail Value

A benefit that does not appear in any ROI calculation but that finance professionals consistently identify as significant: automated verification produces a documented, timestamped audit trail for every supplier check. Manual verification produces nothing — or at best a set of browser history records that nobody will be able to reconstruct six months later.

In the event of an audit, an insurance claim, a regulatory inquiry, or a dispute with a supplier, "we ran a Gumshoe verification on date X, the assurance score was Y, and here is the detailed report" is qualitatively different from "we checked the ABN, I think it was fine." The former demonstrates reasonable due diligence. The latter does not.

For CFOs and practice managers thinking about liability and governance, this audit trail dimension may ultimately be more valuable than the fraud prevention benefit — because it protects against liability even in scenarios where fraud succeeds despite best efforts.

Uncommon Insights

One of the lesser-known implications of the Australian Government's Anti-Money Laundering and Counter-Terrorism Financing Act 2006 is that it creates a secondary liability for businesses that fail to conduct adequate due diligence on their suppliers. This means that if a supplier is found to be involved in money laundering or terrorist financing activities, the business that failed to conduct proper verification can be held liable under section 16 of the Act. Automated supplier verification can help mitigate this risk by ensuring that all necessary checks are conducted consistently and thoroughly.

ASIC's Regulatory Guide 217 (RG 217) emphasizes the importance of verifying the identity of suppliers as part of a business's overall risk management framework. While RG 217 is primarily focused on the obligations of Australian financial services licensees, its guidance on verification and due diligence is relevant to all businesses that engage with suppliers. By automating supplier verification, businesses can ensure that they are meeting the expectations outlined in RG 217 and reducing their risk exposure.

The ATO's Taxation Ruling TR 2019/4 highlights the importance of verifying the ABN status of suppliers to ensure compliance with the GST Act 1999. However, a lesser-known aspect of this ruling is that it also emphasizes the need to verify the GST registration status of suppliers. Automated supplier verification can help businesses ensure that they are meeting these obligations and avoiding potential penalties under section 288-55 of the Taxation Administration Act 1953.

Enforcement patterns by ASIC and the ATO suggest that businesses that fail to conduct adequate supplier verification are at risk of being targeted for audit and potential penalties. For example, ASIC's 2020 enforcement report noted that inadequate due diligence on suppliers was a common theme among businesses that were subject to enforcement action. By automating supplier verification, businesses can demonstrate a proactive approach to risk management and reduce their risk of being targeted for audit or enforcement action.