# Procurement Policy: [Organisation name]

> Organisation-wide policy for buying goods, services and works:
> who may commit spend, how much competition each purchase needs,
> when a single supplier may be used, how sustainability and ethics
> are built into sourcing, and how exceptions are recorded. The
> sustainability sections are structured in line with ISO 20400:2017
> *Sustainable procurement, Guidance* (cited by name and clause number
> only), and the ethics sections link to the anti-bribery controls of
> ISO 37001:2025. It is written for private organisations; public
> bodies follow their procurement law first (section 13). Replace every
> `[bracketed]` value and every row marked *Example*. This is a
> documentation format, not legal advice: check the current official
> text and a qualified professional.

<!--
Guidance: How to use this template
- Purpose: one short, enforceable rulebook for every person who buys
  on behalf of the organisation, so that spend is approved before it is
  committed, competition is proportionate to value and risk, and
  sustainability and ethics are considered at the point where they can
  still change the outcome.
- Scope boundary: this policy covers sourcing and supplier selection up
  to contract award. Payment controls (vendor master, three-way match,
  payment runs, expenses and cards) sit in the Procure-to-Pay and
  Expense Policy (`finance/procure-to-pay-and-expense-policy`).
- Fill the thresholds in section 5 and the approval matrix in section 6
  first, aligned with the Delegation of Authority Matrix
  (`finance/delegation-of-authority-matrix`). Then the single-source
  rules (section 8), because those are where most policy breaches hide.
- The worked example uses the fictional Corvanna Instruments Ltd, a
  laboratory instrument manufacturer with a UK head office, a
  Netherlands subsidiary and a US sales office (GBP, EUR, USD). Every
  figure is invented and marked *Example*; recompute your own.
- Related templates: Category Strategy (`procurement/category-strategy`),
  Purchase Requisition and PO (`procurement/purchase-requisition-po`),
  Supplier Onboarding and Due Diligence
  (`procurement/supplier-onboarding-due-diligence`), Contract Register
  (`procurement/contract-register`), Supplier Performance Review
  (`procurement/supplier-performance-review`), Supplier Code of Conduct
  (`procurement/supplier-code-of-conduct`), RFP (`business/rfp`), RFI
  (`business/rfi`), Vendor Evaluation Scorecard
  (`business/vendor-evaluation-scorecard`).
-->

## Document control

<!-- Guidance: The owner is normally the head of procurement. Record which legal entities and systems the policy binds, and who can grant exceptions. Pitfall: a policy with no named exception authority, so every exception becomes an informal favour. -->

| Field | Value |
|---|---|
| Document ID | [POL-PRC-NNN] *Example:* POL-PRC-001 |
| Version | [1.0] |
| Status | [Draft / In review / Approved] |
| Owner | [@head-of-procurement] |
| Approvers/reviewers | [@cfo], [@general-counsel], [@head-of-sustainability], [@internal-audit] |
| Entities in scope | [Legal entities] *Example:* Corvanna Instruments Ltd (UK), Corvanna Instruments B.V. (NL), Corvanna Instruments Inc. (US) |
| Systems | [Source-to-contract tool, ERP purchasing module, contract repository] |
| Exception authority | [Role] *Example:* CFO for value exceptions, head of procurement for process exceptions |
| Effective date | YYYY-MM-DD |
| Last updated | YYYY-MM-DD |
| Next review | YYYY-MM-DD (at least annually, or after a change in law or structure) |
| Classification | [Internal] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Policy owner | [@name] | [Prepared] | YYYY-MM-DD |
| General counsel | [@name] | [Reviewed] | YYYY-MM-DD |
| Head of sustainability | [@name] | [Reviewed] | YYYY-MM-DD |
| CFO | [@name] | [Approved] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change summary |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@name] | First draft |
| 1.0 | YYYY-MM-DD | [@name] | *Example:* Approved; thresholds aligned with DoA v3, sustainable procurement section added |

## Contents

1. Purpose and scope
2. Principles
3. Roles and responsibilities
4. Planning and the business need
5. Competition thresholds
6. Approval authority
7. Sourcing methods
8. Single-source and direct award
9. Evaluation and award
10. Contracts and purchase orders
11. Sustainable procurement
12. Ethics, conflicts and anti-bribery
13. Public sector and legal requirements
14. Supplier management after award
15. Exceptions, breaches and monitoring
16. Glossary and references

## 1. Purpose and scope

<!-- Guidance: State what the policy is for and list the spend that is in and out of scope. Questions: does it cover intercompany charges, grants, property leases, employment of contractors, marketing media buys? Pitfall: leaving large categories out of scope by silence, so they are bought without any rules. -->

This policy sets the rules for acquiring goods, services, software and
works from external suppliers on behalf of [Organisation name]. It
applies to every employee, contractor and agent who identifies a need,
engages suppliers, negotiates, commits spend or signs a contract, in
every entity listed in Document control.

The policy aims to achieve value for money over the whole life of a
purchase, fair and transparent treatment of suppliers, compliance with
law, and measurable progress on the organisation's sustainability
commitments.

| In scope | Out of scope (covered elsewhere) |
|---|---|
| Direct materials and components | Employment of staff (HR policies) |
| Indirect goods and services, including software and cloud | Intercompany charges (transfer pricing policy) |
| Professional services and contingent labour through agencies | Treasury instruments and bank products (treasury policy) |
| Capital equipment and works | Property acquisition and leases above [value] (real estate policy) |
| Marketing services and media | Donations and sponsorships (community investment policy) |

Purchases made on corporate cards remain subject to sections 5 and 12
of this policy; card administration is in the procure-to-pay policy.

## 2. Principles

<!-- Guidance: Keep principles few and testable; they are used to resolve cases the rules do not cover. Pitfall: a long list of virtues that no decision can be traced back to. -->

| ID | Principle | What it means in practice |
|---|---|---|
| PR-01 | Value over price | Award on total cost of ownership and quality, not unit price alone |
| PR-02 | Proportionate competition | The effort of competing grows with value and risk (section 5) |
| PR-03 | Fair treatment | All bidders receive the same information at the same time and are evaluated against published criteria |
| PR-04 | Separation of duties | The person who defines the need does not alone select the supplier, approve the spend and receive the goods |
| PR-05 | Sustainability by design | Environmental, social and ethical impacts are assessed at planning, not after award |
| PR-06 | Integrity | Conflicts of interest are declared, gifts and hospitality follow the anti-bribery rules |
| PR-07 | Records | Every sourcing decision leaves an auditable record that a third party could follow |

## 3. Roles and responsibilities

<!-- Guidance: Name roles, not people. Questions: who owns the budget, who runs the competition, who can sign? Pitfall: budget holders who negotiate and sign alone above the threshold where procurement must be involved. -->

| Role | Responsibilities |
|---|---|
| Budget holder | Confirms the business need and budget, raises the requisition, approves within delegated authority |
| Requester | Describes the requirement, takes part in evaluation, confirms receipt |
| Procurement (category manager or buyer) | Chooses the sourcing route, runs competitions above [GBP 10,000], negotiates, keeps the sourcing record |
| Legal | Approves non-standard contract terms and all contracts above [GBP 250,000] |
| Finance | Confirms budget, checks approval authority, owns payment controls |
| Information security and privacy | Assess suppliers that handle data or connect to systems |
| Sustainability lead | Sets sustainability criteria per category and reviews high-impact sourcing |
| Sourcing committee | Approves award recommendations above [GBP 250,000] and all single-source cases above [GBP 50,000] |
| Internal audit | Tests compliance with this policy on a risk basis |

## 4. Planning and the business need

<!-- Guidance: Most value is won or lost before suppliers are contacted. Require a short business need statement and a check of existing contracts. Pitfall: specifications written around one supplier's product, which turns a competition into a formality. -->

Before engaging any supplier above [GBP 10,000] the requester and
procurement confirm:

1. **Need:** the outcome required, quantity and timing, and whether the
   need can be met by an existing contract, internal capacity or a
   framework agreement already in place.
2. **Budget:** approved budget and cost centre, including running costs
   over the expected life.
3. **Specification:** written in terms of function and performance,
   naming a brand only with the words "or equivalent" and a reason.
4. **Category strategy:** the purchase follows the approved category
   strategy where one exists (`procurement/category-strategy`).
5. **Risk and sustainability screen:** the impact screen in section 11
   and the supplier risk tier in
   `procurement/supplier-onboarding-due-diligence`.
6. **Make or buy:** for software and services, whether to build, buy
   or reuse (see `architecture/build-vs-buy-analysis`).

Large or complex projects record these in a procurement plan
(`project/procurement-plan`).

## 5. Competition thresholds

<!-- Guidance: Thresholds use total contract value over the full term including optional extensions, excluding VAT or sales tax. Questions: does the value include all lots bought together for the same need? Pitfall: splitting one need into several smaller orders to stay below a threshold. -->

The estimated contract value is the total payable over the whole
term, including optional extensions, renewals and all lots bought for
the same need, excluding VAT or sales tax. Splitting a requirement to
avoid a threshold is a breach of this policy (section 15).

| Band | Total contract value (excl. tax) | Minimum competition | Run by |
|---|---|---|---|
| A | Below [GBP 10,000] | One quote; catalogue or card permitted | Requester |
| B | [GBP 10,000 to 49,999] | Three written quotes | Requester with procurement check |
| C | [GBP 50,000 to 249,999] | Competitive request for quotation or proposal, at least three invited suppliers | Procurement |
| D | [GBP 250,000] and above | Formal tender (RFP) with published criteria and an evaluation panel | Procurement, sourcing committee approval |

Values in other currencies are converted at the [monthly budget rate]
on the date the requisition is raised.

*Example:* Corvanna needs a calibration service for three years with
an optional fourth year, estimated at GBP 70,000 per year. The contract
value is 4 x 70,000 = GBP 280,000, so the purchase falls in band D and
needs a formal tender, even though each annual purchase order would be
in band C.

## 6. Approval authority

<!-- Guidance: Copy the commitment limits from the delegation of authority matrix; never set different numbers here. Pitfall: approving the purchase order without approving the contract, or the reverse. -->

Approval to commit spend follows the Delegation of Authority Matrix
(`finance/delegation-of-authority-matrix`). The table below is a
summary; where the two differ, the matrix prevails.

| Total contract value (excl. tax) | Approves the requisition | Approves the award | Signs the contract |
|---|---|---|---|
| Below [GBP 10,000] | Budget holder | Budget holder | Budget holder (PO only) |
| [GBP 10,000 to 49,999] | Budget holder | Department head | Department head |
| [GBP 50,000 to 249,999] | Department head | Finance director | Finance director |
| [GBP 250,000 to 999,999] | Finance director | Sourcing committee | CFO |
| [GBP 1,000,000] and above | CFO | Sourcing committee and CEO | CEO, or the board where the matrix requires |

Nobody may approve a requisition, award or contract in which they have
a declared conflict of interest, or approve their own spend.

## 7. Sourcing methods

<!-- Guidance: List the methods your teams may use and when each fits. Questions: when is an RFI useful, when is an e-auction acceptable? Pitfall: running an e-auction on a strategic category, which damages a relationship you depend on. -->

| Method | Use when | Template |
|---|---|---|
| Catalogue or marketplace purchase | Band A, standard items | Not needed |
| Request for quotation (RFQ) | Specification is complete, price is the main differentiator | `procurement/purchase-requisition-po` for the order |
| Request for information (RFI) | Market or solution options are unclear | `business/rfi` |
| Request for proposal (RFP) | Bands C and D where quality, method or risk differ between suppliers | `business/rfp`, `business/rfp-compliance-matrix` |
| Mini-competition under a framework | An existing framework agreement covers the need | Framework terms |
| Electronic reverse auction | Leverage categories with several qualified suppliers and a complete specification | Procurement procedure [ID] |
| Negotiation with one supplier | Only under section 8 | Single-source justification |

Procurement chooses the method and records the reason in the sourcing
record.

## 8. Single-source and direct award

<!-- Guidance: Define the narrow grounds for skipping competition and require a written justification approved one level above normal. Pitfall: "urgency" caused by late planning accepted as a ground. -->

A purchase above band A may be awarded without the competition in
section 5 only on one of these grounds, recorded in a single-source
justification and approved by the sourcing committee above [GBP 50,000]
or by the head of procurement below it:

| Ground | Evidence required |
|---|---|
| SS-01 Only one capable supplier (technical exclusivity, intellectual property) | Market check or RFI showing no alternative |
| SS-02 Compatibility with installed equipment or software where a change would cause disproportionate cost | Cost of change estimate |
| SS-03 Genuine emergency (safety, legal compliance, unforeseeable event), not caused by late planning | Description of the event; follow-up competition planned |
| SS-04 Extension of an existing contract within its terms | Contract clause reference |
| SS-05 Regulated or monopoly supplier (utilities, regulators) | Not needed |

Single-source awards are reported quarterly to the CFO with value,
ground and the plan to restore competition at the next renewal.

## 9. Evaluation and award

<!-- Guidance: Publish criteria and weights before bids are opened and never change them afterwards. Questions: are sustainability and security criteria weighted, or only pass or fail? Pitfall: a "price" weight that is applied to day rates when the real cost driver is the number of days. -->

1. Criteria and weights are approved and issued with the invitation.
   Quality, total cost of ownership, risk and sustainability each
   appear, with pass or fail gates for mandatory requirements
   (licences, insurance, security, sanctions screening).
2. Each evaluator signs a conflict of interest declaration before
   seeing bids (see `compliance/conflicts-of-interest-register`).
3. Evaluators score independently, then meet to moderate. Procurement
   records the moderated scores and the reasons.
4. Clarifications are put in writing and shared with all bidders when
   they change the meaning of the requirement.
5. The award recommendation states the winning bid, the scores, the
   value and the approval needed under section 6. Use the Vendor
   Evaluation Scorecard (`business/vendor-evaluation-scorecard`) for
   the scoring sheet.
6. Unsuccessful bidders receive a short written debrief on request.

*Example:* Corvanna's calibration tender weighted technical capability
40%, total cost over four years 30%, service levels 15% and
sustainability 15%, with ISO/IEC 17025 accreditation as a pass or fail
gate.

## 10. Contracts and purchase orders

<!-- Guidance: Say which contract form applies at each band and that no work starts before the order or contract is in place. Pitfall: suppliers starting work on an email and the PO raised after the invoice arrives. -->

- Band A and B purchases use a purchase order on the organisation's
  standard terms of purchase (`procurement/purchase-requisition-po`).
- Band C and D purchases, and any purchase involving personal data,
  system access or on-site work, use a written contract approved by
  legal. Use the master services agreement outline
  (`legal-lite/master-services-agreement-outline`), a data processing
  agreement (`legal-lite/dpa`) where personal data is processed, and a
  statement of work (`business/statement-of-work`).
- Supplier terms are accepted only after legal review against the
  contract review playbook (`legal-ops/contract-review-playbook`).
- Every contract above band A is entered in the contract register
  within [5] working days of signature, with its renewal and notice
  dates (`procurement/contract-register`).
- No goods may be ordered or work begun before the order or contract
  is approved and issued.

## 11. Sustainable procurement

<!-- Guidance: Follow the ISO 20400 logic: commit at policy level, organise for it, and build it into each step of the procurement process. Questions: which categories carry the largest environmental and social impacts, and which criteria apply to each? Pitfall: a sustainability questionnaire sent to every supplier and never used in an award decision. -->

ISO 20400:2017 is a guidance standard (not certifiable). Its public
structure runs from fundamentals (clause 4), through integrating
sustainability into procurement policy and strategy (clause 5) and
organising the procurement function (clause 6), to integrating
sustainability into each step of the procurement process (clause 7:
planning, specification, supplier selection, contract management and
review). This policy follows the same sequence in original wording.

| Step | Rule in this policy | Responsible |
|---|---|---|
| Policy and strategy | Sustainability commitments are set for each high-impact category in its category strategy | Sustainability lead, category manager |
| Organising | Buyers complete [sustainable procurement training] within [6] months of joining | Head of procurement |
| Planning | Every band C and D purchase completes the impact screen below | Procurement |
| Specification | Use functional specifications that allow lower-impact solutions (reuse, refurbishment, service models) | Requester, procurement |
| Supplier selection | Sustainability criteria carry at least [10%] of the weighting for categories rated high impact | Procurement |
| Contract management | Sustainability commitments become contract obligations with KPIs reviewed in supplier performance reviews | Contract owner |
| Review | Lessons learned at contract end feed the next category strategy | Category manager |

Impact screen (answer yes or no, any "yes" means sustainability
criteria are mandatory for the purchase):

| Question | Yes or no |
|---|---|
| Does the category carry a high carbon footprint (materials, freight, energy, travel)? | [ ] |
| Are there known labour or human rights risks in the supply chain (for example raw materials, low-wage assembly, cleaning, security, logistics)? | [ ] |
| Does the purchase generate hazardous waste or packaging at end of life? | [ ] |
| Is the supplier a small business, social enterprise or diverse supplier that the organisation has committed to support? | [ ] |
| Does the purchase affect the organisation's reported greenhouse gas inventory (`finance/ghg-emissions-inventory`)? | [ ] |

All suppliers accept the Supplier Code of Conduct
(`procurement/supplier-code-of-conduct`) before award above band A.

## 12. Ethics, conflicts and anti-bribery

<!-- Guidance: Link to the anti-bribery management system rather than restating it. Procurement is one of the highest bribery-risk functions. Pitfall: allowing buyers to accept supplier hospitality during an open tender. -->

- Everyone involved in a sourcing event declares any personal,
  financial or family interest in a bidder before the event starts,
  and again if circumstances change.
- During an open competition, buyers and evaluators accept no gifts or
  hospitality from bidders, of any value.
- Outside competitions, gifts and hospitality follow the limits and
  register of the anti-bribery programme (`compliance/iso-37001-anti-bribery`,
  aligned with ISO 37001:2025 clause 8.7 on gifts, hospitality and
  similar benefits).
- Due diligence on suppliers proportionate to bribery risk is carried
  out at onboarding (ISO 37001:2025 clause 8.2;
  `procurement/supplier-onboarding-due-diligence`), and suppliers in
  higher-risk tiers give anti-bribery commitments in the contract
  (clauses 8.5 and 8.6).
- No supplier is engaged if it, or its owners, appear on a sanctions
  list that applies to the organisation
  (`compliance/sanctions-compliance-procedure`).
- Concerns are raised through the speak-up channel
  (`compliance/whistleblowing-policy`); retaliation is prohibited.
- Employees follow the Code of Business Conduct
  (`compliance/code-of-business-conduct`).

Legal context (examples, check the current text): the UK Bribery Act
2010 section 7 offence of failure to prevent bribery, the UK Economic
Crime and Corporate Transparency Act 2023 failure to prevent fraud
offence (in force 2025-09-01), and the US Foreign Corrupt Practices
Act.

## 13. Public sector and legal requirements

<!-- Guidance: If any entity is a public body, or receives public funds with procurement conditions, its procurement law overrides the bands in section 5. Record the regime and current thresholds. Pitfall: copying threshold figures without the date they apply from. -->

Private organisations are free to set their own rules, but some
purchases are regulated:

| Situation | Requirement | Where to check |
|---|---|---|
| UK contracting authority | Procurement Act 2023 regime. From 2026-01-01, threshold amounts (including VAT) for supplies and services are GBP 135,018 for central government and GBP 207,720 for sub-central authorities, and GBP 5,193,000 for works (SI 2025/1200) | legislation.gov.uk; gov.uk Procurement Act guidance |
| EU contracting authority | Directive 2014/24/EU as transposed nationally. For 2026 and 2027 the thresholds (excluding VAT) are EUR 140,000 (central government supplies and services), EUR 216,000 (sub-central) and EUR 5,404,000 (works), set by Delegated Regulation (EU) 2025/2152 | EUR-Lex; national procurement authority |
| US federal contracts | Federal Acquisition Regulation, under revision through the Revolutionary FAR Overhaul; check the current FAR part and agency deviations | acquisition.gov |
| Grant-funded purchases | Funder conditions (for example US 2 CFR 200 procurement standards) | Grant agreement |
| Supply chain transparency | UK Modern Slavery Act 2015 section 54 statements, EU forced labour product ban (Regulation (EU) 2024/3015, applies from 2027-12-14), US Uyghur Forced Labor Prevention Act import presumption | `procurement/supplier-code-of-conduct` |

Figures were checked on 2026-10-30 and are revised every two years;
check the official source on the date your procurement starts.

## 14. Supplier management after award

<!-- Guidance: Say who owns each contract and how often performance is reviewed. Pitfall: procurement walks away after signature and nobody tracks the commitments that won the tender. -->

- Each contract has a named contract owner in the contract register.
- Suppliers are segmented by spend and risk; tier 1 suppliers have a
  quarterly performance review, tier 2 half-yearly, tier 3 annually
  (`procurement/supplier-performance-review`).
- Supplier risk is re-assessed on renewal, on a change of control,
  and on any adverse event (sanctions designation, data breach, labour
  allegation, insolvency signal).
- Renewal decisions are taken before the notice deadline recorded in
  the contract register, with a fresh competition where section 5 so
  requires.

## 15. Exceptions, breaches and monitoring

<!-- Guidance: Distinguish an approved exception (recorded before the purchase) from a breach (found afterwards). Report both. Pitfall: retrospective "exceptions" approved after the invoice arrives, which are breaches by another name. -->

Exceptions to this policy are requested in writing before commitment
and approved by the exception authority named in Document control.
Breaches found afterwards (no PO, split orders, missing competition,
undeclared conflict) are reported to the head of procurement and the
budget holder's line manager and may lead to disciplinary action.

| Metric | Definition | Target |
|---|---|---|
| Spend under management | Spend sourced by or with procurement / total addressable spend | [above 80%] |
| Competitive award rate | Value awarded after competition / value awarded in bands B to D | [above 90%] |
| Single-source share | Value of single-source awards / total awarded | [below 10%] |
| Retrospective orders | POs dated after invoice, count and value | [below 2% of POs] |
| Contracts in register | Active contracts above band A recorded with notice dates | [100%] |
| Sustainability criteria use | Band C and D awards in high-impact categories with weighted sustainability criteria | [100%] |

*Example:* in the first half of 2026 Corvanna awarded GBP 6.2 million
in bands B to D, of which GBP 5.7 million after competition (91.9%) and
GBP 0.5 million single-source (8.1%).

## 16. Glossary and references

<!-- Guidance: Define terms in your own words, and list references with versions and the date you checked them. -->

| Term | Meaning in this policy |
|---|---|
| Total contract value | All amounts payable over the full term, including extensions and options, excluding VAT or sales tax |
| Category | A group of goods or services with a common supply market |
| Single-source | Award to one supplier without the competition in section 5 although others exist |
| Sole source | Only one supplier can meet the need |
| Framework agreement | An agreement setting terms for future orders from one or more suppliers |
| Total cost of ownership | Acquisition, operation, maintenance and disposal costs over the life of the purchase |

| Reference | Version or date | Official source |
|---|---|---|
| ISO 20400, *Sustainable procurement, Guidance* | 2017 (current, as listed by BSI as BS ISO 20400:2017, checked 2026-10-30) | Official text: ISO and national standards bodies, purchase or licensed access: https://www.iso.org/standard/63026.html |
| ISO 37001, *Anti-bribery management systems, Requirements with guidance for use* | 2025 | Official text: ISO, purchase or licensed access: https://www.iso.org/standard/85816.html |
| UK Procurement Act 2023 and Threshold Amounts (Amendment) Regulations 2025 (SI 2025/1200) | Thresholds from 2026-01-01 | https://www.legislation.gov.uk/ukpga/2023/54 |
| Commission Delegated Regulation (EU) 2025/2152 amending Directive 2014/24/EU thresholds | 2026 and 2027 | https://eur-lex.europa.eu/eli/reg_del/2025/2152/oj/eng |
| Federal Acquisition Regulation | Current | https://www.acquisition.gov/far |
| UK Bribery Act 2010 | Current | https://www.legislation.gov.uk/ukpga/2010/23 |

## Standard and licence note

Structure aligned with ISO 20400:2017 *Sustainable procurement,
Guidance* and ISO 37001:2025, cited by name, edition and clause
number only; no text of either standard is reproduced. Official text:
ISO and national standards bodies, purchase or licensed access via the
links in section 16. UK, EU and US public procurement figures are taken
from the official instruments named above and must be checked on the
date of use. Corvanna Instruments and all figures are fictional. The
text is original and is not legal advice. Template licence: MIT.