By Andrew Kornuta — 02 Mar 2026

Industrialist Paper No. 16

Verification as Industrial Plumbing

The series premise: rebuild American manufacturing coordination by turning soft failure modes into hard control points that both generalists and builders can execute.

Scenario: An RFQ lands in an inbox. The drawing PDF looks clean, the STEP matches, the tolerance block is sane. Then the estimator pauses, not because of the RFQ package, but because the buyer is unknown and as a result, the payment risk feels unpriced.

Claim (falsifiable): If supplier and buyer identity is captured as a verified, time stamped “identity packet” that is attached to every vendor master record and referenced by every RFQ and PO, then quote response rates to first time counterparties will rise and fraud driven vendor churn will fall, because “who are you” stops consuming the same cycle time as “can you make this part.” The term identity packet means a machine readable bundle of legal existence, location, sanctions screening, payment identity, and certification evidence, plus an audit trail that shows when each check last passed. The control point is the vendor master record, every RFQ and PO should link to the same packet.

Mechanism: move trust checks from phone calls into cached facts

In custom work, “trust” starts as an identity problem, not a machining problem. When identity is uncertain, buyers and suppliers use human conversation as a verification tool, because it is the fastest way to test for coherence across details: address, capability claims, payment expectations, and who will sign the PO. That phone call is doing real work, it is an ad hoc risk model built out of tone, responsiveness, and institutional memory, and it exists because the system does not provide durable signals. The artifact that reveals the failure is the RFQ email thread that becomes a second work package, full of “who are you” questions that should have been answered by a vendor master record.

Verification becomes “industrial plumbing” when it is boring, automatic, and hard to argue with. The inputs are registries and documents that already exist: legal business name, physical address validation, taxpayer identity, bank account ownership, sanctions list screening, and certification proofs. The output is not a badge, it is a set of fields that a buyer can rely on and a supplier can present without a sales pitch, tied to timestamps and evidence links. Government procurement does this at scale by pushing vendors through structured identity requirements, including physical address validation and identifiers, and by treating entity data as a prerequisite to transact. You can see the shape of that plumbing in SAM.gov’s entity checklist, which emphasizes validated physical address, taxpayer identification, and structured identifiers like CAGE or NCAGE.

Evidence level 1: what real procurement already asks for

If you want proof that verification is already standard, look at what large buyers demand before they will even pay an invoice. A supplier onboarding form from a major industrial buyer is blunt: provide required supplier setup information, keep the remit to name consistent, and ensure a W-9 or W-8 is on file or payment will be delayed. That is not “enterprise bureaucracy,” it is a payment safety rail that prevents vendor impersonation, misdirected funds, and endless AP disputes. This is why the vendor master record exists in ERP systems, it is a control surface for identity and payment, not just a contact list. When verification is missing, the PO becomes the first time anyone tries to reconcile “who you are” with “where we are sending money,” which is the worst possible time to discover a mismatch.

Sanctions screening is another example of boring, required plumbing that people still treat like an optional checkbox. OFAC maintains multiple sanctions lists and explicitly warns that programs can change frequently, which is why screening is not a one time event. The point is not to turn every job shop quote into a compliance ceremony, it is to make sure the vendor master record has an auditable “last screened” event that can be attached to an RFQ and later to a PO. In a weak identity environment, sanctions risk gets handled the same way payment risk gets handled, by relying on relationships and familiarity, which is not a reliable filter. The artifact here is a sanctions list search record tied to the legal business name and address, time stamped and stored alongside the supplier profile.

Evidence level 2: fraud and risk are not edge cases

Fraud is not a rare anomaly that only hits the careless. The ACFE’s 2024 Report to the Nations press release summarizes an estimate that organizations lose 5% of revenue to fraud each year, based on 1,921 investigated cases across 138 countries and territories. Procurement fraud and vendor impersonation are just one slice of that picture, but they matter because they poison the channel: one bad vendor event changes sourcing behavior for years. When buyers get burned, they overfit by narrowing sourcing to a small circle and demanding more manual gates, and when suppliers get burned by nonpayment or chargebacks, they stop quoting new logos. The artifact that shows up after the fact is a vendor change log in the ERP, full of rushed “deactivate vendor” actions with little structured evidence about what failed.

PwC’s 2024 Global Economic Crime Survey adds a second angle: procurement fraud is widely perceived as a serious concern, while many organizations still do not run mature third party risk programs or risk scoring. Their published key findings include that 55% report procurement fraud is a widespread concern in their country, and 42% either lack a third party risk management program or do not do any risk scoring within it. That gap is the space where “vibes” and informal relationship gates expand, because people will always invent a verification layer when formal signals are absent. The artifact that should exist, but often does not, is a third party risk record attached to the vendor master file with a clear risk score, evidence links, and renewal dates.

The uncomfortable truth about relationship-driven commerce

Our experience has shown that shops want to call and “get to know you.” It is not a cultural quirk, it is a rational response to asymmetric risk. A supplier can burn days quoting from a perfect RFQ package and still lose money if the buyer is slow pay, disputes quality opportunistically, or lacks authority to issue the PO. A buyer can place a PO with a supplier whose website looks legitimate and still get a no show, a bait and switch, or a capability mismatch that only becomes visible after the first article inspection and the CMM report. In that environment, the phone call is a cheap probe for hidden variables, and relationships become a substitute for a missing identity packet. The artifact that proves the point is the quiet “no quote” status in the RFQ system, even when the drawing package is complete, because the missing input is counterparty confidence, not geometry.

At the same time, the data does not support the idea that B2B buyers universally want to live on the phone. Gartner reported in 2025 that 61% of B2B buyers prefer a representative-free buying experience, and that most prefer to carry out independent research through digital channels. McKinsey’s survey work also points to strong willingness for remote and self-serve purchasing, including large order values, while still acknowledging that buyers lean toward in person interaction when a purchase is high effort or when working with new suppliers. The synthesis matters: relationships remain important at the moment of risk, but buyers also want systems that let them progress without friction until a human adds real value. The artifact to design around is the RFQ intake and supplier selection flow, it should support both a verified self-serve path and an explicit “human handshake” path for high risk work, without requiring a phone call just to answer identity questions.

Industrial supply pricing opacity is part of the same story. When prices are negotiated, availability is volatile, and credit matters, vendors protect themselves by keeping pricing behind a relationship, because the relationship also carries payment terms, returns behavior, and how disputes get resolved. McKinsey’s work on industrial distribution describes how digital entrants increase pricing transparency and therefore negotiating power, while also noting that dedicated sales forces still play important roles for many customers. In other words, “call for price” often means “we are still doing verification and risk pricing in conversation,” not “we hate the internet.” The artifact that closes the loop is a quote history ledger tied to a verified buyer identity, so that pricing and terms can be contextual without being opaque.

Implications

When verification is cheap and portable, markets widen without becoming reckless. More buyers will test new suppliers because the first gate is factual, not social, and more suppliers will quote first time buyers because payment identity and dispute history become legible at the RFQ stage. That dynamic aligns with what part buyer surveys report about trying new vendors and caring about certifications and response speed, because experimentation requires confidence and fast feedback loops. When identity is weak, the opposite happens: buyers hoard work inside a small network, suppliers reserve attention for known accounts, and the public market becomes a thin layer of marketing websites with little transactional truth. The artifact that predicts which way a network is going is the share of RFQs awarded to first time suppliers, tied to verified identity fields and quote response timestamps.

Verification also protects legitimate small shops, but only if it stays proportional. A system that demands the same paperwork burden as a defense prime vendor onboarding process will exclude the long tail, and exclusion will look like “risk reduction” while actually reducing capacity and competition. The right shape is a ladder where baseline identity, address validation, and sanctions screening are automatic, and deeper artifacts like ISO certs, special process approvals, and on site audits are pulled only when the RFQ requires them. The control point is a verification policy table that maps RFQ attributes to required evidence, and logs every decision as an audit trail event referenced by the RFQ record.

What a coordination layer looks like in practice: it maintains a vendor master record that stores the identity packet, runs periodic re checks (address, sanctions, certificate expiration), and attaches a compact evidence summary to every RFQ and PO so humans spend their calls on exceptions, not on basic legitimacy.

Outro

Industrial sovereignty depends on throughput, and throughput depends on trust that moves at machine speed. When identity stays ambiguous, the practical failure mode is distrust, and distrust turns into misallocation: fewer quotes, fewer new suppliers, and more work trapped in legacy relationships that no longer earn the premium. Verification is not glamorous, but it is the pipe that keeps the marketplace from filling with noise and fraud while keeping honest capacity visible. The next paper will push beyond “are you real” into “do you perform,” where reputation, dispute closure codes, and inspection artifacts become the second layer of the same plumbing.

Questions to Ask

Where, exactly, does identity live today, in the vendor master record, the RFQ system, email threads, or the memories of two people on the phone, and which artifact is treated as the source of truth?
For every RFQ package, what identity fields are required before it is routed, and what percent of “no quote” outcomes are actually caused by missing counterparty confidence rather than missing technical data?
Which checks are one time (legal existence) versus recurring (sanctions screening, address validity, certificate expiration), and where are the timestamps stored so an auditor can reconstruct the decision path from RFQ to PO?
What is your minimum acceptable “identity packet” for a first transaction, and how many minutes of human time does it currently take to assemble it from W-9, COI, registry lookups, and email follow ups?
When a vendor event goes wrong, what fields in the vendor master record change, what closure codes get written (fraud, nonpayment, misrepresentation), and how does that evidence propagate to future routing decisions?