Audit supplier data

# Supplier records audit

## Purpose

Check that active suppliers' records are complete before a payment run: bank details, address, legal identifiers. Spot incomplete suppliers that have invoices to pay, and bank details changed recently.

This skill only reads. Completing a record needs the `update_supplier` tool ("Manage suppliers" permission, in Beta) or the Spendesk app.

## What the record holds — and what it does not

| Available | Field |
|-----------|-------|
| Bank details | `iban`, `bic`, `bankCountry` |
| Last bank change | `bankDetailsUpdatedAt`, `bankDetailsUpdatedBy` |
| Address | `address` (line, city, postal code, country) |
| Legal identifiers | `legalName`, `registrationNo`, `vatNo` |
| Supplier account | `accountPayable` (absent when there is no active account) |

⚠️ Two limits to state in the report:

- **An empty IBAN does not prove there are no bank details.** Account number, routing code and holder (non-IBAN accounts, in the UK or the US for instance) are never returned. Write "IBAN not set", not "payment impossible".
- **There is no email or contact** on the record: that point cannot be audited.

## Step 1 — List active suppliers

```json
{ "tool": "get_suppliers", "params": { "isArchived": "false", "pageSize": 100 } }
```

- The parameter is `isArchived`, a string (`"false"`), not `status`.
- Page with `page` while `hasNextPage` is `true`. If a page fails because the response is too large, lower `pageSize` and report the records not read rather than skipping them.

## Step 2 — Check completeness

For each supplier:

| Check | Verdict |
|-------|---------|
| `iban` and `bic` set | ✅ / "IBAN not set" |
| `address.country` and `address.city` set | ✅ / "Incomplete address" |
| `vatNo` or `registrationNo` set | ✅ / "Missing legal identifier" |
| `accountPayable` present | ✅ / "No supplier account" |
| `bankCountry` differs from `address.country` | "To verify" (not an anomaly in itself) |

## Step 3 — Cross-check with invoices to pay

For suppliers with no IBAN:

```json
{
  "tool": "get_payables",
  "params": { "filters": { "operator": "and", "subfilters": [
    { "field": "supplier", "operator": "=", "value": ["<supplierId>", "<supplierId>"] },
    { "field": "paymentStatus", "operator": "=", "value": ["toPay"] }
  ] } }
}
```

A supplier with no IBAN and `toPay` invoices comes **first**. Read what is left to pay in `outstandingAmount`, not in `amount`.

## Step 4 — Bank details changed recently

Read `bankDetailsUpdatedAt`: it is the date of the last change to the bank details, distinct from `updatedAt` (any change to the record). Flag changes from the last 7 days, with `bankDetailsUpdatedBy` resolved to a name: this is the payment-fraud check.

Also flag suppliers created less than 30 days ago (`createdAt`) that already have an invoice to pay.

## Report

```
Supplier audit — <today's date> (N active records read)

🔴 First: IBAN not set and invoices to pay — N suppliers, X EUR
🟡 Incomplete: address, legal identifier or supplier account missing — N
🟠 Bank details changed in the last 7 days — N (to confirm with the supplier)
🟢 New suppliers with an invoice to pay — N
```

## Limits to state

- Never change bank details without written confirmation from the supplier.
- Supplier data is cached for up to 24 hours: a record fixed a moment ago can still show as incomplete.

## Observed result (demo account, 5 October 2026)

On the first two active records read: neither had an IBAN, a BIC or an address; only one had a supplier account and a bank country. Neither carried a bank-change date.

## Example prompts
- "Which suppliers have incomplete data and invoices to pay?"
- "Full audit of my supplier master data"
- "Are there recently changed bank details that I should confirm?"