# Approved supplier lists

Authorization of supply sources by item, category, site and time: list scope, qualification evidence, system enforcement and limits of approval.

Reviewed: 2026-11-02

Tags: sourcing, supplier-approval, procurement, documents

## Purpose and issuing authority

An approved supplier list (ASL), also called an approved vendor list in some systems, expresses which supply relationships an organization authorizes within a defined scope. It is a decision record of the approving organization, not a universal ranking of supplier quality. Oracle's **Procurement 25C** documentation describes authorization or restriction of suppliers, sites, manufacturers and distributors for specified items or categories. [Oracle, Approved Supplier List](https://docs.oracle.com/en/cloud/saas/procurement/25c/oaprc/approved-supplier-list.html)

The buyer's authorization, a supplier's own capability claim and an independent certificate are different kinds of evidence. Approval by one buying organization does not establish approval by another. An approved source can still deliver a nonconforming lot; the list does not describe the inspection result for each shipment.

## Original bounded scope-and-date example

Assume an invented purchaser requires all four conditions for one purchase: **item P-100**, **supplier site West**, **Approved status**, and an approval period including **November 2, 2026**. Only entry A meets all four conditions. Assume inclusive date endpoints and that the table contains all relevant entries.

| Entry | Item | Site | Status | Valid dates | Matches all assumptions? |
| --- | --- | --- | --- | --- | --- |
| A | P-100 | West | Approved | Oct 1–Nov 30, 2026 | Yes |
| B | P-200 | West | Approved | Oct 1–Nov 30, 2026 | No: different item |
| C | P-100 | West | Approved | Oct 1–Oct 31, 2026 | No: expired before the example date |
| D | P-100 | East | Approved | Oct 1–Nov 30, 2026 | No: different site |

Match the full relationship before counting eligible sources.

Even entry A supplies no price, capacity, lead time, current stock or lot-conformance result. If category-level approval also existed, its relationship to item-specific restrictions would depend on the purchaser's actual policy; the example supplies no precedence rule. A missing row also would not prove rejection unless the list's completeness and applicable scope were established.

## Scope belongs to the relationship

Oracle allows an entry to link an item or category with either a supplier or a particular supplier site. The buying scope can be a procurement business unit or a ship-to organization within it. Its documentation also describes references to source agreements and dates for periodic qualification reviews. These are named product conventions, not mandatory field names for every ASL. [Oracle 25C, entry scope and attributes](https://docs.oracle.com/en/cloud/saas/procurement/25c/oaprc/approved-supplier-list.html)

| Dimension | Why it changes the meaning |
| --- | --- |
| Issuing organization | Authority may cover one purchaser or organizational unit. |
| Supplier identity and site | A corporate group name does not identify every factory or supplying location. |
| Item, category or process | Approval for one supply scope does not inherently cover another. |
| Status and conditions | Authorized, restricted and suspended relationships need not permit the same transactions. |
| Effective period | A dated authorization can apply at one time and fail to apply later. |

The table is explanatory synthesis. A list extract that omits these boundaries may not establish whether a particular proposed supply is authorized. A familiar supplier name alone leaves the relationship unresolved.

## Qualification, certification and approval are distinct

The **ISO/IAF Auditing Practices Group, External Providers**, dated **January 13, 2016**, warns that reviewing an approved-provider list and its periodic review dates may be insufficient to establish effective supply-chain control. Its discussion includes ability to meet specifications, outsourced processes and the scope of a supplier's quality-system registration. It is guidance for auditing, not a normative requirement for a particular list format or universal review interval. [ISO/IAF APG, External Providers](https://committee.iso.org/files/live/sites/tc176sc2/files/documents/ISO%209001%20Auditing%20Practices%20Group%20docs/Auditing%20to%20ISO%209001%202015/APG-ExternalProviders2015.pdf)

ISO's **2016** booklet *ISO 9001: What does it mean in the supply chain?* distinguishes a supplier's QMS conformity from product or service conformity. It describes supplier declarations, customer assessments and third-party certification as different bases for a QMS claim; a certificate describes its own scope. ISO develops standards but does not certify organizations. [ISO, supply-chain booklet, pp. 3–9](https://www.iso.org/files/live/sites/isoorg/files/store/en/PUB100304.pdf)

Consequently, an ASL entry, a certificate, an audit result and a shipment acceptance answer different questions. A certificate alone does not state a purchaser's approval decision, agreed commercial terms or conformity of an individual part. These source explanations concern the ISO 9001:2015 context identified by the publications; they do not reproduce a later standard or determine sector-specific contractual requirements.

## A list and its software enforcement can differ

Microsoft's Dynamics 365 Supply Chain Management procedure associates approved vendors with specific released products and expiration dates. It separately describes an **Approved vendor check method** controlling what happens when an unapproved vendor is used on a purchase-order line. The presence of a list therefore does not, by itself, describe the application's enforcement policy. [Microsoft, Approve vendors for specific products](https://learn.microsoft.com/en-us/dynamics365/supply-chain/procurement/tasks/approve-vendors-specific-products)

A separate Microsoft troubleshooting article describes authorization for a particular product and date, with effective and expiration dates delimiting the period. This is application behavior for the named system, not a rule that every organization uses the same date or status semantics. The article's option to disable a check is a software remedy, not evidence that supplier qualification has been granted. [Microsoft, vendor authorization by product and date](https://learn.microsoft.com/en-us/troubleshoot/dynamics-365/supply-chain/planning/vendor-code-not-authorized)

Explanatory synthesis: an exported spreadsheet can communicate an approval state without enforcing purchasing restrictions. Conversely, a transaction warning or rejection identifies a configured control, not necessarily the underlying technical reason for a supplier's status. The business decision and its software implementation remain distinct.

## Coverage and source versions

Reviewed **2026-11-02 PST**. Oracle's cited documentation is the **25C** release. Microsoft displays **July 1, 2026** on its approval procedure and **May 18, 2022** on its authorization troubleshooting page; these are page-update metadata, not a customer policy's effective dates. The APG paper explicitly dates itself **January 13, 2016**. ISO's booklet prints **©2016**, ISBN **978-92-67-10654-0**, and identifies its update for ISO 9001:2015. The table and example are original explanatory synthesis. No universal approval duration, supplier score threshold or regulated-industry release requirement is established here.

Related: [Supplier documents and evidence](index.md).