Approved Supplier List Risk: When Your ASL Is a Spreadsheet

Somewhere on a shared drive there is a file called something like ASL_FINAL_v7_updated.xlsx. It holds your approved supplier list: the one document that is supposed to say who you are allowed to buy from and why. For many manufacturers, that spreadsheet is the entire supplier management system.

It works until the day it is tested. Here is what that spreadsheet hides, and why the risk grows the longer it stays in place.

Signs Your ASL Has Become a Liability

• Several versions of the list exist, and people disagree about which is current.
• Buyers can place orders with suppliers who are not on the list.
• Approval scope, such as which parts and processes a supplier is approved for, isn't captured.
• Certificates and approvals expire without anyone noticing.
• Suppliers removed for cause quietly reappear.
• Only one person really understands the file.

The Hidden Audit and Business Risk

Auditors test the ASL by following a purchase order backward: was this supplier approved, for this scope, at the time of purchase, and on what basis? A spreadsheet rarely answers that cleanly, which is why ASL gaps sit behind so many supplier control findings.

The business risk is larger. When the list is not connected to purchasing, performance and certifications, it cannot stop a buyer from using an unqualified source under schedule pressure. In defense and aerospace, that can mean nonconforming or even counterfeit material entering the product. And when the one person who maintains the file leaves, the knowledge leaves with them.

Why a Better Spreadsheet Isn't the Answer

The first response to an ASL problem is usually a cleaner spreadsheet: more columns, better formatting, a locked version. That treats the symptom. The real issue is that the list is disconnected from the decisions it is supposed to govern.

The opposite reaction, buying a large software platform, can fail just as badly if the underlying rules for approval, scope, monitoring and removal have never been defined. Software automates whatever process you give it, including a broken one.

What a Trustworthy Supplier List Looks Like

A trustworthy approved supplier list is a living part of how the business buys. It shows who is approved, for what, on what basis and until when. It is connected to purchasing so unqualified sources get caught before the order, and connected to performance so poor suppliers are reviewed rather than forgotten. It survives staff turnover and satisfies any auditor on any sample.

What the Turnaround Typically Looks Like

A typical case: a growing manufacturer whose ASL spreadsheet worked at 40 suppliers but is failing at 300, with an audit finding to prove it. Once the rules behind the list are defined and the list is tied to purchasing and performance, audit sampling stops turning up surprises, buyers stop using unapproved sources, and the list becomes a tool people trust instead of a file they fear.

Frequently Asked Questions

Is it acceptable to keep an approved supplier list in a spreadsheet?

Standards do not prohibit it, but spreadsheets make it hard to control versions, scope, expirations and the link to purchasing, which is where most audit and business risk comes from.

What do auditors look for in an approved supplier list?

Evidence that each supplier was approved against defined criteria, for a specific scope, before being used, and that approval is maintained based on performance.

Should we buy supplier management software?

Only after the rules for approval, scope, monitoring and removal are clear. Otherwise the software just automates the existing gaps.

If This Is Your Situation

"We got an audit finding on our supplier controls." If that sentence sounds like your week, you don't need another article. You need someone who has fixed it before to look at your specific situation. See how we approach this situation, or request a Situation Review. Tell us what's going on in a few sentences and we'll come back with how we'd tackle it. It's a conversation, not a sales pitch.

Related reading: Why Auditors Keep Writing Up Supplier Controls · Supply Chain Traceability for Defense Contractors · Supplier Quality Management