Procurement Policy Template (ISO 20400 Sustainable Procurement)

Procurement Policy: [Organisation name]

Organisation-wide policy for buying goods, services and works: who may commit spend, how much competition each purchase needs, when a single supplier may be used, how sustainability and ethics are built into sourcing, and how exceptions are recorded. The sustainability sections are structured in line with ISO 20400:2017 Sustainable procurement, Guidance (cited by name and clause number only), and the ethics sections link to the anti-bribery controls of ISO 37001:2025. It is written for private organisations; public bodies follow their procurement law first (section 13). Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal advice: check the current official text and a qualified professional.

Document control

Approvals

Revision history

Contents

1. Purpose and scope
2. Principles
3. Roles and responsibilities
4. Planning and the business need
5. Competition thresholds
6. Approval authority
7. Sourcing methods
8. Single-source and direct award
9. Evaluation and award
10. Contracts and purchase orders
11. Sustainable procurement
12. Ethics, conflicts and anti-bribery
13. Public sector and legal requirements
14. Supplier management after award
15. Exceptions, breaches and monitoring
16. Glossary and references

1. Purpose and scope

This policy sets the rules for acquiring goods, services, software and works from external suppliers on behalf of [Organisation name]. It applies to every employee, contractor and agent who identifies a need, engages suppliers, negotiates, commits spend or signs a contract, in every entity listed in Document control.

The policy aims to achieve value for money over the whole life of a purchase, fair and transparent treatment of suppliers, compliance with law, and measurable progress on the organisation's sustainability commitments.

Purchases made on corporate cards remain subject to sections 5 and 12 of this policy; card administration is in the procure-to-pay policy.

2. Principles

3. Roles and responsibilities

4. Planning and the business need

Before engaging any supplier above [GBP 10,000] the requester and procurement confirm:

1. Need: the outcome required, quantity and timing, and whether the need can be met by an existing contract, internal capacity or a framework agreement already in place.
2. Budget: approved budget and cost centre, including running costs over the expected life.
3. Specification: written in terms of function and performance, naming a brand only with the words "or equivalent" and a reason.
4. Category strategy: the purchase follows the approved category strategy where one exists (procurement/category-strategy).
5. Risk and sustainability screen: the impact screen in section 11 and the supplier risk tier in procurement/supplier-onboarding-due-diligence.
6. Make or buy: for software and services, whether to build, buy or reuse (see architecture/build-vs-buy-analysis).

Large or complex projects record these in a procurement plan (project/procurement-plan).

5. Competition thresholds

The estimated contract value is the total payable over the whole term, including optional extensions, renewals and all lots bought for the same need, excluding VAT or sales tax. Splitting a requirement to avoid a threshold is a breach of this policy (section 15).

Values in other currencies are converted at the [monthly budget rate] on the date the requisition is raised.

Example: Corvanna needs a calibration service for three years with an optional fourth year, estimated at GBP 70,000 per year. The contract value is 4 x 70,000 = GBP 280,000, so the purchase falls in band D and needs a formal tender, even though each annual purchase order would be in band C.

6. Approval authority

Approval to commit spend follows the Delegation of Authority Matrix (finance/delegation-of-authority-matrix). The table below is a summary; where the two differ, the matrix prevails.

Nobody may approve a requisition, award or contract in which they have a declared conflict of interest, or approve their own spend.

7. Sourcing methods

Procurement chooses the method and records the reason in the sourcing record.

8. Single-source and direct award

A purchase above band A may be awarded without the competition in section 5 only on one of these grounds, recorded in a single-source justification and approved by the sourcing committee above [GBP 50,000] or by the head of procurement below it:

Single-source awards are reported quarterly to the CFO with value, ground and the plan to restore competition at the next renewal.

9. Evaluation and award

1. Criteria and weights are approved and issued with the invitation. Quality, total cost of ownership, risk and sustainability each appear, with pass or fail gates for mandatory requirements (licences, insurance, security, sanctions screening).
2. Each evaluator signs a conflict of interest declaration before seeing bids (see compliance/conflicts-of-interest-register).
3. Evaluators score independently, then meet to moderate. Procurement records the moderated scores and the reasons.
4. Clarifications are put in writing and shared with all bidders when they change the meaning of the requirement.
5. The award recommendation states the winning bid, the scores, the value and the approval needed under section 6. Use the Vendor Evaluation Scorecard (business/vendor-evaluation-scorecard) for the scoring sheet.
6. Unsuccessful bidders receive a short written debrief on request.

Example: Corvanna's calibration tender weighted technical capability 40%, total cost over four years 30%, service levels 15% and sustainability 15%, with ISO/IEC 17025 accreditation as a pass or fail gate.

10. Contracts and purchase orders

• Band A and B purchases use a purchase order on the organisation's standard terms of purchase (procurement/purchase-requisition-po).
• Band C and D purchases, and any purchase involving personal data, system access or on-site work, use a written contract approved by legal. Use the master services agreement outline (legal-lite/master-services-agreement-outline), a data processing agreement (legal-lite/dpa) where personal data is processed, and a statement of work (business/statement-of-work).
• Supplier terms are accepted only after legal review against the contract review playbook (legal-ops/contract-review-playbook).
• Every contract above band A is entered in the contract register within [5] working days of signature, with its renewal and notice dates (procurement/contract-register).
• No goods may be ordered or work begun before the order or contract is approved and issued.

11. Sustainable procurement

ISO 20400:2017 is a guidance standard (not certifiable). Its public structure runs from fundamentals (clause 4), through integrating sustainability into procurement policy and strategy (clause 5) and organising the procurement function (clause 6), to integrating sustainability into each step of the procurement process (clause 7: planning, specification, supplier selection, contract management and review). This policy follows the same sequence in original wording.

Impact screen (answer yes or no, any "yes" means sustainability criteria are mandatory for the purchase):

All suppliers accept the Supplier Code of Conduct (procurement/supplier-code-of-conduct) before award above band A.

12. Ethics, conflicts and anti-bribery

• Everyone involved in a sourcing event declares any personal, financial or family interest in a bidder before the event starts, and again if circumstances change.
• During an open competition, buyers and evaluators accept no gifts or hospitality from bidders, of any value.
• Outside competitions, gifts and hospitality follow the limits and register of the anti-bribery programme (compliance/iso-37001-anti-bribery, aligned with ISO 37001:2025 clause 8.7 on gifts, hospitality and similar benefits).
• Due diligence on suppliers proportionate to bribery risk is carried out at onboarding (ISO 37001:2025 clause 8.2; procurement/supplier-onboarding-due-diligence), and suppliers in higher-risk tiers give anti-bribery commitments in the contract (clauses 8.5 and 8.6).
• No supplier is engaged if it, or its owners, appear on a sanctions list that applies to the organisation (compliance/sanctions-compliance-procedure).
• Concerns are raised through the speak-up channel (compliance/whistleblowing-policy); retaliation is prohibited.
• Employees follow the Code of Business Conduct (compliance/code-of-business-conduct).

Legal context (examples, check the current text): the UK Bribery Act 2010 section 7 offence of failure to prevent bribery, the UK Economic Crime and Corporate Transparency Act 2023 failure to prevent fraud offence (in force 2025-09-01), and the US Foreign Corrupt Practices Act.

13. Public sector and legal requirements

Private organisations are free to set their own rules, but some purchases are regulated:

Figures were checked on 2026-10-30 and are revised every two years; check the official source on the date your procurement starts.

14. Supplier management after award

• Each contract has a named contract owner in the contract register.
• Suppliers are segmented by spend and risk; tier 1 suppliers have a quarterly performance review, tier 2 half-yearly, tier 3 annually (procurement/supplier-performance-review).
• Supplier risk is re-assessed on renewal, on a change of control, and on any adverse event (sanctions designation, data breach, labour allegation, insolvency signal).
• Renewal decisions are taken before the notice deadline recorded in the contract register, with a fresh competition where section 5 so requires.

15. Exceptions, breaches and monitoring

Exceptions to this policy are requested in writing before commitment and approved by the exception authority named in Document control. Breaches found afterwards (no PO, split orders, missing competition, undeclared conflict) are reported to the head of procurement and the budget holder's line manager and may lead to disciplinary action.

Example: in the first half of 2026 Corvanna awarded GBP 6.2 million in bands B to D, of which GBP 5.7 million after competition (91.9%) and GBP 0.5 million single-source (8.1%).

16. Glossary and references

Standard and licence note

Structure aligned with ISO 20400:2017 Sustainable procurement, Guidance and ISO 37001:2025, cited by name, edition and clause number only; no text of either standard is reproduced. Official text: ISO and national standards bodies, purchase or licensed access via the links in section 16. UK, EU and US public procurement figures are taken from the official instruments named above and must be checked on the date of use. Corvanna Instruments and all figures are fictional. The text is original and is not legal advice. Template licence: MIT.