Approved supplier lists

Purpose and issuing authority

An approved supplier list (ASL), also called an approved vendor list in some systems, expresses which supply relationships an organization authorizes within a defined scope. It is a decision record of the approving organization, not a universal ranking of supplier quality. Oracle's Procurement 25C documentation describes authorization or restriction of suppliers, sites, manufacturers and distributors for specified items or categories. Oracle, Approved Supplier List

The buyer's authorization, a supplier's own capability claim and an independent certificate are different kinds of evidence. Approval by one buying organization does not establish approval by another. An approved source can still deliver a nonconforming lot; the list does not describe the inspection result for each shipment.

Original bounded scope-and-date example

Assume an invented purchaser requires all four conditions for one purchase: item P-100, supplier site West, Approved status, and an approval period including November 2, 2026. Only entry A meets all four conditions. Assume inclusive date endpoints and that the table contains all relevant entries.

Match the full relationship before counting eligible sources.

Even entry A supplies no price, capacity, lead time, current stock or lot-conformance result. If category-level approval also existed, its relationship to item-specific restrictions would depend on the purchaser's actual policy; the example supplies no precedence rule. A missing row also would not prove rejection unless the list's completeness and applicable scope were established.

Scope belongs to the relationship

Oracle allows an entry to link an item or category with either a supplier or a particular supplier site. The buying scope can be a procurement business unit or a ship-to organization within it. Its documentation also describes references to source agreements and dates for periodic qualification reviews. These are named product conventions, not mandatory field names for every ASL. Oracle 25C, entry scope and attributes

The table is explanatory synthesis. A list extract that omits these boundaries may not establish whether a particular proposed supply is authorized. A familiar supplier name alone leaves the relationship unresolved.

Qualification, certification and approval are distinct

The ISO/IAF Auditing Practices Group, External Providers, dated January 13, 2016, warns that reviewing an approved-provider list and its periodic review dates may be insufficient to establish effective supply-chain control. Its discussion includes ability to meet specifications, outsourced processes and the scope of a supplier's quality-system registration. It is guidance for auditing, not a normative requirement for a particular list format or universal review interval. ISO/IAF APG, External Providers

ISO's 2016 booklet ISO 9001: What does it mean in the supply chain? distinguishes a supplier's QMS conformity from product or service conformity. It describes supplier declarations, customer assessments and third-party certification as different bases for a QMS claim; a certificate describes its own scope. ISO develops standards but does not certify organizations. ISO, supply-chain booklet, pp. 3–9

Consequently, an ASL entry, a certificate, an audit result and a shipment acceptance answer different questions. A certificate alone does not state a purchaser's approval decision, agreed commercial terms or conformity of an individual part. These source explanations concern the ISO 9001:2015 context identified by the publications; they do not reproduce a later standard or determine sector-specific contractual requirements.

A list and its software enforcement can differ

Microsoft's Dynamics 365 Supply Chain Management procedure associates approved vendors with specific released products and expiration dates. It separately describes an Approved vendor check method controlling what happens when an unapproved vendor is used on a purchase-order line. The presence of a list therefore does not, by itself, describe the application's enforcement policy. Microsoft, Approve vendors for specific products

A separate Microsoft troubleshooting article describes authorization for a particular product and date, with effective and expiration dates delimiting the period. This is application behavior for the named system, not a rule that every organization uses the same date or status semantics. The article's option to disable a check is a software remedy, not evidence that supplier qualification has been granted. Microsoft, vendor authorization by product and date

Explanatory synthesis: an exported spreadsheet can communicate an approval state without enforcing purchasing restrictions. Conversely, a transaction warning or rejection identifies a configured control, not necessarily the underlying technical reason for a supplier's status. The business decision and its software implementation remain distinct.

Coverage and source versions

Reviewed 2026-11-02 PST. Oracle's cited documentation is the 25C release. Microsoft displays July 1, 2026 on its approval procedure and May 18, 2022 on its authorization troubleshooting page; these are page-update metadata, not a customer policy's effective dates. The APG paper explicitly dates itself January 13, 2016. ISO's booklet prints ©2016, ISBN 978-92-67-10654-0, and identifies its update for ISO 9001:2015. The table and example are original explanatory synthesis. No universal approval duration, supplier score threshold or regulated-industry release requirement is established here.

Related: Supplier documents and evidence.