Procurement Controls

The procurement process is responsible for spending more than half of most organisations’ total budget, and so it is appropriate that there are controls on the process. One of the most common controls found in procurement is the separation of roles within the procurement process, so that the same person cannot authorise, order, receive and approve an individual transaction. Written policy and procedures detail how the procurement process is to be managed, usually focusing particular attention on higher value acquisitions. Position descriptions define roles and responsibilities, and selection and training ensures that staff are competent in the duties of their post. Approvals ensure that managers maintain supervision of higher value acquisitions, and review processes ensure that compliance with the controls framework allows effective operation. See also Governance and Procurement.

In short

Procurement controls are the checks that make sure money is spent with the right supplier, on the right terms and with the right approval, and that the spending can be shown afterwards.

Common procurement controls

• Separation of duties. Different people raise, approve, receive and pay for a purchase.
• Delegations of authority. Each role has a spending limit, and higher values need more senior approval.
• Purchase order before invoice. Spend is committed on an approved order, not after the fact. Many organisations will not pay an invoice without one.
• Three-way match. An invoice is paid only when it agrees with the order and with what was received.
• Supplier master data. New suppliers and changes to bank details are checked and approved by someone outside purchasing.
• Market approach thresholds. The policy sets the value at which quotes or a tender are needed.
• Contract register. Every contract has an owner, a value and an end date, so spend outside contract shows up.
• Conflicts of interest and gifts. Staff declare interests and gifts, and evaluation panels sign probity declarations. See how to manage gifts from suppliers.

Preventive and detective controls

Preventive controls stop a problem before money leaves: approvals, separation of duties and purchase orders. Detective controls find it afterwards: exception reports, spend analysis and audits. A sound framework uses both, because preventive controls get bypassed when people are under time pressure.

Signs the controls are not working

• Invoices arrive without a purchase order, or orders are raised after the invoice.
• Orders are split to stay just under an approval limit.
• The same supplier appears more than once, or one supplier has several bank accounts.
• Large amounts are spent with suppliers that have no contract.
• One person can both create a supplier and approve its payments.

How to test your controls

1. Run a spend analysis to find exceptions: split orders, spend without a contract and duplicate suppliers.
2. Sample transactions above each approval limit and check the approval trail.
3. Review who can create suppliers, approve orders and release payments, and remove any overlap.
4. Report exceptions to management each quarter, and fix the process, not just the transaction.

Help with procurement controls

Comprara reviews procurement controls and compliance through its audit and governance service. Procurement Foundations training is available at the Academy of Procurement.