B2B prospect list building is the work of turning an ideal customer profile into an accurate, usable set of accounts and people for a specific sales motion. A large spreadsheet is not necessarily a qualified prospect list. If the companies are outside your service market, the roles are wrong, the data sources are unclear, or the contacts must not be approached, having more rows only increases review work and risk.
For SaaS and ERP teams targeting the United States and Canada, a prospect list should be treated as a research product with evidence and quality gates, not as a collection of names. This guide covers company research, buying-committee coverage, contact verification, CRM deduplication, country- and channel-specific eligibility checks, and a repeatable sampling method before an SDR receives the list.
Quick answer: Define the target account and buyer role, research companies against the agreed criteria, record where each critical fact came from, check whether each person actually holds a relevant responsibility, remove duplicates and exclusions, validate contact details without assuming consent, then release only reviewed records with a named owner and next action.
Prospect list building is not the same as defining an ICP
An ideal customer profile (ICP) describes the types of businesses worth serving. A target account list identifies the actual organizations that appear to match those criteria. A prospect contact list identifies relevant people within those accounts, with verified role context and appropriate conditions for contacting them.
Those are three different deliverables:
| Layer | Core question | Example evidence |
|---|---|---|
| ICP | Which companies could benefit from our offering? | Industry, size range, geography, use case, exclusions |
| Account research | Which actual organizations appear to match? | Company website, public product details, credible market data |
| Contact research | Who has responsibility or influence for this problem? | Role, function, employer, buying-committee relevance and source |
| Outreach readiness | Is this record appropriate for this specific campaign and channel? | Ownership, data quality, preferences, restrictions and legal review |
A SaaS platform selling expense management might target growing multi-location companies with complex approval workflows. That doesn't mean every finance executive at every large company is a validated prospect. An ERP implementation provider might target manufacturers with a certain operational problem, then map finance, operations, IT and executive stakeholders separately.
If your target segments are not agreed yet, begin with our B2B SaaS ICP and target-account framework. The focus here is the next operational step: proving that individual records are accurate enough to use.
1. Convert the ICP into written research rules
Before buying a database or asking an analyst to build a list, give the research team an approved specification.
A practical research brief should state:
- Geography: eligible countries, states or provinces, territory assignments and any exclusions.
- Industry and model: specific business categories, not just a broad database taxonomy.
- Company characteristics: relevant operating footprint, employee or revenue ranges if reliable, and use cases.
- Buying problem: the business process the offer addresses.
- Relevant roles: decision-maker, technical evaluator, operational user, economic buyer and possible referrer.
- Hard exclusions: unsuitable verticals, unsupported regions, competitor conflicts, existing customers or active opportunities.
- Research evidence: acceptable sources, freshness rules, and how uncertainty is recorded.
- Handoff expectations: required fields, review percentage, responsible owner and approval criteria.
Don't confuse a convenient filter with business relevance. Employee count can help segment an account, but an inaccurate or out-of-date employee count should not overrule stronger evidence about the underlying workflow.
Our US and Canada outbound territory guide offers additional guidance for coordinating geographies, time zones and sales ownership.
2. Research accounts first, then people
Account-first research helps avoid finding hundreds of contacts at companies that your offer cannot support.
A practical account verification sequence
- Confirm that the organization is real and currently operating under the expected name.
- Verify the main domain and distinguish parent companies, subsidiaries and regional entities.
- Check the actual market served and geography relevant to the campaign.
- Look for evidence of the workflow or business need described in the ICP.
- Confirm whether the account is already a customer, partner, disqualified company or active opportunity.
- Record the most relevant source and the date reviewed.
- Assign approved, needs research, or excluded with a reason.
The best public sources vary by market. They may include an organization's official website, public product documentation, industry directories, credible filings or official regulatory records, and information provided directly by the business. A data vendor can help suggest candidates, but vendor enrichment should be checked rather than treated as an unquestionable source of truth.
Account hierarchy matters
Consider a multinational company with a Canadian subsidiary and a U.S. headquarters. A lead-generation tool may assign contacts to the parent company while the buying decision for a local ERP rollout sits with regional operations. Without an account hierarchy rule, reps may contact the wrong office, double-count the account, or conflict with an existing sales owner.
Decide whether your system groups by ultimate parent, operating subsidiary, regional business unit or CRM account ID. Save both the raw organization name and the normalized match, and review ambiguous cases instead of automatically merging them.
3. Map the buying committee, not just the job titles
A contact can have a prestigious title and still be the wrong person for the problem.
For a B2B SaaS workflow, the relevant roles may include the team responsible for the process, an executive sponsor, a technical evaluator and procurement. In an ERP decision, finance, operations, IT and executive leadership may evaluate different risks.
| Buyer function | What the researcher should establish | What not to assume |
|---|---|---|
| Business or process owner | Owns or manages the workflow that needs improvement | Every director can authorize a purchase |
| Technical evaluator | Reviews integrations, architecture, security or implementation | IT always owns the business decision |
| Economic buyer | May approve spending or justify budget | A senior title alone proves budget |
| Influencer or end user | Can explain the operational impact or evaluation criteria | Every engaged user is a decision-maker |
| Procurement or legal | May review contracts and compliance | Procurement initiates the evaluation |
| Referral contact | Can direct the team to the correct stakeholder | A referral automatically creates a qualified opportunity |
Research job responsibilities, not just strings in a title field. “Head of Operations” can mean very different things in a small SaaS company and a large manufacturing group.
Our ERP buying-committee prospecting guide explains how to structure multi-stakeholder outreach without treating every contact as interchangeable.
4. Verify the contact without pretending to know more than the evidence
A contact record needs more than a name and an email-shaped string.
Check the person's current employer, current function, relevance to the approved buying process, and whether the source is recent and trustworthy. Record a verification date and distinguish:
- Verified: supported by an acceptable current source for the particular field.
- Plausible but unconfirmed: a reasonable hypothesis, not an outreach-ready fact.
- Outdated: evidence conflicts with a more recent record.
- Unknown: missing data that should not be invented.
- Excluded or suppressed: record must not be used for the proposed contact.
Verification can be field-specific. A company domain may be verified while the person's exact title remains unknown. Avoid one blanket “100% verified” badge for the entire record.
Email verification versus actual reachability
A syntactically valid business email does not guarantee that the mailbox exists, will accept commercial messages, belongs to the intended person, or is suitable to contact. Third-party deliverability checks can be probabilistic, and catch-all mail systems can make certainty impossible.
Use provider-approved, privacy-conscious methods and honest confidence labels. Do not probe or harvest systems in ways that violate terms, privacy or security expectations.
LinkedIn and automated scraping
LinkedIn can help a researcher understand professional roles, but its prohibited software guidance states that third-party bots, crawlers and extensions that scrape or automate activity are not permitted. A technically possible automation is not automatically an authorized research method.
Build the process around lawfully and contractually permitted sources and verified business context. Do not recommend unauthorized scraping or attempts to bypass access controls.
5. Document source quality and data provenance
The ability to explain where a fact came from is a major difference between a usable research asset and an opaque purchased list.
Record source provenance for the most important fields: company domain, segment fit, buyer role, contact channel and any event or prior relationship used to justify outreach.
A simple source-confidence policy might be:
| Source situation | Suggested handling |
|---|---|
| Current official company page supporting an account fact | Record URL/date and review applicability |
| Direct buyer statement made in an authorized conversation | Preserve wording, context, date and preferences |
| Credible licensed data provider | Record provider, permitted use, refresh date and known limitations |
| Third-party aggregator without original source | Treat as a research lead; seek corroboration |
| Old CRM note with no date | Mark as historical, not current |
| Inferred job role or guessed email format | Keep unverified and do not present as fact |
| Source with prohibited collection terms | Exclude the source from the workflow |
Make sure the team can distinguish research evidence from buyer confirmation. Public hiring news may suggest a company is expanding; it does not prove an approved procurement project exists.
6. Deduplicate accounts and contacts before releasing the list
Duplicates create wasted effort and real relationship risk. Two SDRs can contact the same person with different messages; an active customer can be treated as a new prospect; and suppression status can disappear when an address is re-imported under a slightly different name.
Use a hierarchy of matching rules:
- Exact CRM IDs, when the systems share them.
- Normalized company domains and approved account parent relationships.
- Known verified email identities and account associations.
- Name-plus-company review for ambiguous contacts—never merge two people just because names match.
- Explicit exclusion and suppression statuses that override campaign imports.
- A documented manual review path for likely duplicates.
Be cautious with company domains that represent shared service providers, subsidiaries or franchises. Don't auto-merge two companies simply because a vendor assigns them to the same parent group.
A small example
Suppose an import contains 120 rows. Ten are confirmed duplicate copies of existing contacts, five are active customers already owned by another team, and eight fail hard ICP checks. If the categories are non-overlapping, 97 rows remain for further research, not necessarily for outreach.
That arithmetic is a fictional illustration, not a benchmark or a recommendation to contact those 97 people. Every remaining row still needs role, source, preference and channel-eligibility checks.
7. Verify outreach eligibility separately from data accuracy
This is the most important distinction for a U.S.–Canada campaign:
Knowing that a business address exists does not itself establish permission to send commercial messages. Contact availability, sender rules, applicable law, and the person's preferences are separate questions.
United States: B2B email remains subject to CAN-SPAM
The Federal Trade Commission's CAN-SPAM business guide explains that commercial B2B email is not categorically exempt. It requires truthful identity and subject information, appropriate identification, a valid postal address, a clear opt-out process, and honoring opt-outs. Hiring a sales agency does not eliminate the promoting company's responsibilities.
Research teams should retain suppression data and avoid feeding commercial sequences with contacts who have already opted out. The outbound operator must apply the appropriate message-level requirements, not assume the list vendor handled them.
Canada: public contact details do not automatically mean consent
The CRTC's CASL guidance on conspicuous publication explains the conditions for relying on implied consent where someone publishes an electronic address. Among the requirements are the absence of a statement rejecting unsolicited commercial electronic messages and relevance to the recipient's business, role, functions or duties. The sender carries the burden of proving the basis.
The CRTC's CASL FAQ also covers consent, identification, unsubscribe and cross-border messages. A database vendor labeling a Canadian contact “public” or “business email” is not enough to prove those conditions.
Keep an evidence record of the source, circumstances, date and review. Some exceptions may apply to particular business relationships or messages, but they are fact-dependent. Legal review is appropriate for the actual geography and campaign. This article is general operational guidance, not legal advice.
A contact-eligibility gate
Before a record enters a campaign, confirm:
- The actual message and channel are allowed under your reviewed policy.
- The relevant country and recipient context are known.
- Existing opt-outs, do-not-contact and suppression requests are applied.
- The source and legal basis or applicable exception are documented where needed.
- The owner and vendor agree how future opt-outs are shared and enforced.
- Uncertainty sends the record to review rather than auto-approval.
For sender identity and bounce handling after eligibility checks, our cold email deliverability checklist covers SPF, DKIM, DMARC, sender reputation and suppression.
8. Build a CRM-ready research record
A spreadsheet with 25 columns is not automatically better than one with 10. Capture the minimum reliable data needed to understand fit, ownership and the next action, while preserving richer evidence separately when appropriate.
| Field | Purpose | Recommended state |
|---|---|---|
| Account ID / parent account | Ownership and deduplication | Verified or flagged ambiguous |
| Company name and domain | Entity identity | Verified |
| Geography and sales territory | Routing | Verified/approved |
| ICP segment and exclusion reason | Fit judgment | Documented |
| Contact name and current role | Buyer context | Source-reviewed |
| Stakeholder function | Why the role matters | Supported by research |
| Source URL/provider and reviewed date | Provenance | Required for material claims |
| Contact method and verification state | Operational reachability | Not confused with permission |
| Eligibility and suppression state | Compliance gate | Required before activation |
| Account/SDR owner | Prevents duplicate outreach | Assigned |
| Research status and reviewer | Auditability | Approved / review / excluded |
| Next action and due date | Handoff | Assigned where relevant |
Keep personal data to what is needed and allowed; access should be role-appropriate. A research spreadsheet should not become an unrestricted archive of private details.
Release statuses that the SDR understands
Use simple and consistent states:
- Research: record is incomplete, unverified or awaiting review.
- Approved for outreach: data, fit, ownership and required contact safeguards passed for the specified campaign/channel.
- Account owned elsewhere: route to the existing owner, not a fresh sequence.
- Excluded: wrong fit, duplicate, suppressed or otherwise ineligible.
An SDR should not be expected to infer from missing columns whether a record is safe to use.
9. Run a sample-based QA process before full handoff
A meaningful quality audit needs more than counting filled cells. Define a small, representative review sample that covers different countries, industries, list sources, role types and record ages. Include high-risk exceptions deliberately instead of relying only on a simple random sample.
A reviewer's checklist for each sampled record:
- Can we confirm the organization and the right legal/operating entity?
- Does the company satisfy the agreed ICP and territory rule?
- Is the person's role relevant to the proposed use case?
- Are the key sources and verification dates present?
- Does the account have a conflicting owner or active opportunity?
- Have duplicates and suppressions been checked?
- Is the proposed channel eligible under the reviewed rules?
- Can an SDR explain the business relevance without unsupported claims?
Two kinds of quality scores
Completeness measures whether fields are populated. Accuracy measures whether populated fields are supported and current. A list can achieve high completeness while having poor accuracy.
For internal reporting, define separate indicators such as:
| Metric | Example definition |
|---|---|
| Account fit pass rate | Sampled accounts passing verified ICP rules ÷ sampled accounts reviewed |
| Contact role accuracy | Sampled contacts with supported relevant roles ÷ sampled contacts reviewed |
| Source traceability | Reviewed records with acceptable source/date ÷ reviewed records |
| Duplicate incidence | Confirmed duplicate rows ÷ imported rows in the defined cohort |
| Outreach eligibility pass | Reviewed records with complete, appropriate contact controls ÷ reviewed records |
| Unresolved research share | Records needing clarification ÷ reviewed records |
| Post-launch correction rate | Activated records requiring a substantive factual correction ÷ activated records |
Use consistent denominators and report the cohort definition. Do not quietly exclude failed records from accuracy calculations.
A fictional QA example
Imagine a team samples 40 records from a newly compiled list. 34 pass company-fit review, 31 have a sufficiently verified role, 29 have traceable sources, and 27 pass the full outreach-readiness review. Those are different gates:
- Company-fit pass rate: 34/40 = 85%.
- Contact-role pass rate: 31/40 = 77.5%.
- Full readiness pass rate: 27/40 = 67.5%.
These are made-up teaching figures, not industry averages, LeadUp performance or forecasted outcomes. A full readiness pass rate below your agreed standard should trigger remediation and another sample review before activation; the threshold must be defined with the client, not invented by the vendor.
10. Handoff a research list as a governed sales asset
Before giving the list to SDRs, agree on the final handoff packet. It should contain more than a CSV:
- The documented ICP and scope used for selection.
- Included and excluded segments.
- Source and verification methodology, including limitations.
- Record counts by approved/research/excluded status.
- Data freshness and sample QA outcomes.
- Ownership and suppression treatment.
- CRM import/deduplication rules.
- Review date, reviewer, and escalation contact.
- A procedure for corrections and opting out.
- Next research or refresh date, based on the campaign's needs.
A buyer should be able to ask, “Why did this account make the list?” and get a useful answer. The provider should not need to reverse-engineer its own database.
How often should a list be refreshed?
There is no universally correct number of days. Highly dynamic startup segments may need more frequent role checks than stable industrial accounts, but even apparently stable records can become outdated. Choose refresh triggers based on role changes, failed contact attempts, account ownership changes, commercial relevance, and the period the list will be used.
Treat a verified record as verified as of a date, not permanently correct.
For the broader handoff between external research or SDR partners and the sales team, our outsourced SDR onboarding checklist outlines responsibilities and approval gates.
Copyable B2B prospect list building checklist
Research brief and accounts
- ICP, territories, use cases and hard exclusions approved.
- Company domains and entity hierarchies researched, not guessed.
- Account ownership and active customers/opportunities reconciled.
- Source and review date recorded for important account facts.
Contacts and permissions
- Relevant buying functions identified, not just generic senior titles.
- Employer and role verified or clearly marked uncertain.
- Email/contact records labeled by verification state.
- Source use complies with relevant platform and provider terms.
- Country, channel, consent or applicable legal basis assessed separately from accuracy.
- Opt-outs and suppression lists applied before activation.
Quality assurance and CRM
- Duplicate accounts and contacts reviewed with documented rules.
- Representative and risk-based QA samples completed.
- Completeness and accuracy measured separately.
- Research, approved, owned-elsewhere and excluded statuses consistent.
- Named owner and next action provided for approved records.
- Corrections, refreshes and data retention handled under a defined policy.
Frequently asked questions
Is buying a B2B email list enough to begin outreach?
No. A purchased list may supply possible business contacts, but company fit, current role, provenance, legal eligibility, suppression, and sender requirements need separate review. The provider's “verified” badge is not a universal guarantee or permission grant.
How many contacts should an SDR have per account?
There is no universal quota. For some offers a single verified operational owner may be appropriate; a complex ERP evaluation may involve several functions. Use the agreed buying process and relevant roles instead of padding the list to meet a contact count.
Is an email address published on a website safe to use for cold email in Canada?
Not automatically. CASL's conspicuous-publication conditions are specific: the published address must not be accompanied by a no-unsolicited-messages statement, the message must be relevant to the person's role, and the sender must be able to substantiate the legal basis. Check official CRTC guidance for the actual facts.
Does email verification guarantee deliverability?
No. It may reduce some invalid-address risk, but deliverability also depends on sender authentication, receiving systems, reputation, recipients' preferences and message suitability. A verified mailbox does not authorize contact.
Should every prospect list record have a phone number?
Not unless that is relevant, lawfully obtained and necessary for the approved channel. Missing data should not be invented, and outreach should not be expanded across channels to bypass a refusal.
What is the difference between ICP fit and prospect list quality?
ICP fit asks whether the company belongs in the intended market. Prospect list quality adds the accuracy of company and individual facts, buyer-role relevance, source traceability, duplicate prevention, contact eligibility, and CRM handoff readiness.
A better list creates better conversations—not just more activities
Reliable prospect research gives a sales representative a clear reason to contact an appropriate person and gives the buyer a more relevant experience. It also protects the company from wasted work, conflicting ownership and avoidable data-quality errors.
LeadUp Solutions offers Prospect Research & List Building for B2B programs, including company research, relevant decision-maker and influencer identification, contact verification, and delivery of researched target lists. The service is meant to support an agreed ICP and qualification process, not to promise that any database guarantees meetings.
If your SaaS or ERP company is entering a U.S. or Canadian segment, or your current SDR lists generate too many wrong-role contacts and duplicate records, contact LeadUp Solutions to discuss a research and list-quality brief. We can start with the accounts you want to reach, your definition of relevant roles, and the evidence your team needs before outreach begins.