On this page
Key takeaways
- Procurement compliance means buying in line with internal policy, applicable law and the organization's ethical standards, and being able to show it.
- Compliance has three layers: internal rules, external law, and conduct standards. Controls should map to each.
- Evidence matters as much as behavior. If a control leaves no record, an auditor will treat it as not done.
- Public sector buyers face specific regimes. The UK Procurement Act 2023, in effect since 24 February 2025, adds a central debarment list and notices at each stage.
- Ethics is the part that policy cannot cover alone. Training and a safe way to speak up carry the weight.
Free PDF: Procurement compliance control checklist. Get it below
An internal auditor opens a sample of fifty purchase orders and asks one question of each: where is the evidence that three quotes were obtained, as the policy requires? In thirty-one cases the folder holds a single quote. The buyers all say they did get three. They are probably telling the truth. The auditor still records thirty-one exceptions, because the policy asked for evidence and none exists.
That is an invented sample, and it shows the central point of this guide. Compliance is behavior that can be proved. If you cannot prove it, you have not achieved it.
Procurement compliance is the practice of buying in line with internal policy, applicable laws and regulations, and ethical standards, supported by controls and records that show the rules were followed.
Which rules does procurement have to meet?
| Layer | What it covers | Examples |
|---|---|---|
| Internal rules | Policy, approval limits, competition thresholds, supplier onboarding | Three quotes above a set value, dual approval of new suppliers |
| External law | Statutes and regulations that govern buying | Anti-bribery law, sanctions, data protection, public procurement rules |
| Conduct standards | Ethics, gifts, conflicts of interest, speaking up | Code of conduct, gift register, conflict declaration |
Check which of these apply to you. A private manufacturer is mainly bound by the first and third, plus law such as anti-bribery rules. A public body is bound by procurement regulation that dictates how contracts are advertised, evaluated and awarded. General legal points here are for orientation only. Take advice from counsel for your jurisdiction.
What changed for public sector buyers?
The UK Procurement Act 2023 came into effect on 24 February 2025. It introduces a central debarment list for suppliers excluded for serious misconduct, requires notices at each stage of a covered procurement and implies payment on 30 day terms into contracts. For contracts over 5 million pounds, authorities must set three key performance indicators to monitor supplier performance. Private companies that tender for public work are affected too, because they need evidence of how their own supply chains meet the standards. If you sell to or buy for the UK public sector, the Act is the first thing to check.
How do you turn a policy into controls?
A control is a specific check that stops or catches a breach. Write each policy rule as a control with an owner, a frequency and a record. The control list in the download below follows this layout.
| Policy rule | Control | Owner | Evidence |
|---|---|---|---|
| Three quotes above the competition threshold | System blocks order without quotes attached, or buyer attaches evidence | Buyer, checked by procurement lead | Attached quotes in the purchase file |
| New suppliers vetted before first payment | Onboarding checklist completed before master data is created | Procurement operations | Signed checklist, dated |
| No one approves their own purchase | Approval workflow forbids same person requesting and approving | System administrator | Workflow configuration, quarterly test |
| Gifts above a set value declared | Gift register reviewed monthly | Compliance | Register entries and review sign-off |
| Conflicts of interest declared | Annual declaration and a check at every sourcing event | Category owner | Signed declarations |
Where a system can enforce a rule, let it. A rule that relies on memory fails more often than a rule built into the workflow. Our procurement policy guide covers how to write the rules in the first place, and this page covers how to prove they are followed.
Free PDF
Procurement compliance control checklist
A control list that turns policy rules into checks with owners and evidence, plus a quarterly sample test sheet and a conduct standards checklist.
- Rule to control to evidence table
- Quarterly sample test sheet
- Exception classification guide
- Conduct standards checklist
How do you test that controls work?
- Sample regularly. Pull a random set of purchases each quarter and check each control against the record.
- Count exceptions and classify them. Missing evidence, wrong approver and urgent purchase each have different fixes.
- Track the rate over time. A falling exception rate is the proof that matters to leadership.
- Report to someone who can act. Share results with finance and the head of procurement, with owners for each fix.
- Retest after a fix. A corrected control that is never tested again is a hope.
Where does ethics fit?
Rules cover the cases you can imagine. Ethics covers the rest. Procurement ethics means acting honestly, avoiding conflicts of interest, treating suppliers fairly and refusing improper gifts or favors. It rests on three practical things: a clear code of conduct, regular training with real examples, and a way to raise a concern without fear. The ACFE's 2024 study of 1,921 fraud cases in 138 countries found 43 percent were detected by a tip, the most common method. A visible, trusted reporting route does more than most controls. Our procurement fraud guide covers the schemes to watch.
What mistakes weaken compliance?
- Writing the policy and stopping. The rules exist and nobody checks them.
- Controls with no owner. If everyone owns it, nobody tests it.
- Treating urgent purchases as exceptions to be ignored. If a quarter of spend uses the urgent route, it is the normal route in disguise.
- Annual training only. A single video a year changes nothing. Use short cases at team meetings.
- Confusing supplier compliance with internal compliance. Checking a supplier's certificates, covered by vendor compliance management, does not show that your own buyers follow your rules.
For the audit that tests all of this, see the procurement audit guide. For the wider plan, read the procurement strategy pillar and the procurement risk management guide.
Sources
- Brabners, Procurement Act 2023 key reminders: commencement 24 February 2025, debarment list, notices, payment terms, KPIs for contracts over 5 million pounds.
- ACFE, Occupational Fraud 2024: A Report to the Nations: 1,921 cases, 138 countries, 43 percent detected by tip.
- The control list and testing steps are editorial summaries of common practice. Legal references are general and not legal advice.
Frequently asked questions
What is procurement compliance?
It is buying in line with internal policy, applicable law and ethical standards, supported by controls and records that show the rules were followed.
What are examples of procurement compliance controls?
Examples include a block on orders without attached quotes, vetting new suppliers before first payment, a rule that no one approves their own purchase, a gift register and annual conflict of interest declarations.
How do you measure procurement compliance?
Sample purchases each quarter, check each control against its record, count and classify exceptions and track the exception rate over time. A falling rate is the evidence leadership wants.
What is procurement ethics?
It is acting honestly in buying: avoiding conflicts of interest, treating suppliers fairly and refusing improper gifts. It relies on a clear code, regular training with real cases and a trusted way to raise concerns.
What is the UK Procurement Act 2023?
It is the UK law governing public procurement, in effect since 24 February 2025. It created a central debarment list, requires notices at each stage and implies 30 day payment terms into public contracts.