Procurement Policy: What It Covers, How to Write One, and What Auditors Look For

A procurement policy is the governance document that states who may commit organizational funds, up to what dollar value, through which competitive method, and with what record left behind.

Every other purchasing control depends on it. Without one, three departments buy the same category from three suppliers at three prices, and nobody can explain the difference to an auditor.

Most procurement policy guidance online comes from software vendors and stops at a component checklist. This guide covers the drafting decisions instead: setting threshold numbers, writing a sole source clause that holds up, and closing the gaps auditors find first.

Key Takeaways

 

• A procurement policy defines purchasing authority and rules. A procurement procedure explains the steps. Separate documents keep both usable.
• Approval thresholds form the operational core of the policy, and the numbers should come from your own spend data rather than a downloaded template.
• Exception clauses for sole source, emergency, and cooperative purchases decide whether staff follow the policy or route around it.
• Contract splitting prohibitions, segregation of duties, and conflict of interest disclosure are the clauses auditors test first.
• Canadian public sector organizations face trade agreement obligations that override internal thresholds.

What a Procurement Policy Is

 

A procurement policy is a formal rulebook governing how an organization acquires goods, services, and construction.

It assigns purchasing authority, sets the dollar levels that trigger competition, defines acceptable supplier selection criteria, and establishes the ethical standards binding anyone who touches a buying decision.

Three documents get confused with each other. Procurement strategy sets objectives, such as consolidating suppliers or reducing category spend. Procurement policy sets the binding rules.

Procurement procedure walks a requisitioner through the clicks and forms. The difference between a policy and a procedure matters here, because merging them produces a document too long for routine reference and too operational to survive a system change.

A complete purchasing framework spans four layers: policy, procedure, work instructions, and approval forms. Map them before drafting, the discipline behind any well-structured set of policies and procedures.

Why Organizations Write One

 

Uncontrolled purchasing creates four exposures. Off-contract buying erases negotiated pricing, since volume commitments mean nothing when staff order elsewhere.

Supplier selection without documented criteria opens the door to fraud and favouritism. Purchasing irregularities rank among the most common audit findings public agencies face. Budget owners also lose forecasting accuracy when commitments happen outside the requisition system.

One engagement made the cost visible. A regional organization asked The Write Direction to document its purchasing rules after a review found the same professional service bought by three departments at three price points, none competitive, none supported by a written justification.

The rules lived in people’s heads. Nothing on paper existed for a reviewer to test. [Author note: replace with approved anonymized client detail before publish.]

The SPEND Framework for a Complete Procurement Policy

 

A workable policy answers five questions. We use the SPEND framework to structure new documents and to audit drafts clients bring us.

Scope: What the Policy Governs

 

State which spend the policy covers and which it excludes. Common exclusions include payroll, rent, intercompany transfers, taxes, and utilities under a master agreement.

Name the people bound, and extend the policy past employees to contractors, volunteers, and board members who can initiate a purchase.

Organizations spending grant or public money need a funding-source overlay. Federal award conditions, provincial directives, and donor restrictions often impose stricter rules than internal policy, so state which prevails.

Powers: Delegated Authority and Thresholds

 

The threshold table carries the operational weight of the document.

A common structure escalates through four bands: direct purchase with a single quote at the lowest tier, three written quotes in the middle band, a formal request for quotation above that, and a full competitive solicitation at the top.

Set the numbers from your own transaction data. Pull twelve months of purchase history, plot the distribution, and place breakpoints where volume drops off. A threshold capturing 80 percent of transactions in the lowest tier creates no control. One that pushes office supplies into a three-quote process creates workarounds.

Delegate by role rather than by name, so the table survives staff turnover. Pair each threshold with the position authorized to approve it, and add a rule that nobody approves a purchase they requested.

Two clauses belong here that most templates omit:

Contract splitting. Prohibit dividing a requirement into smaller purchases to stay under an approval limit. The California State Auditor lists this prohibition as a standard policy area, and its absence shows up in audit findings. Canadian federal buyers face the same restriction under trade agreement rules, which forbid dividing a procurement to escape coverage.

Segregation of duties. Separate the functional roles so no individual controls a transaction end to end. Ontario’s Broader Public Sector Procurement Directive requires designated organizations to segregate at least three of five roles: requisition, budgeting, commitment, receipt, and payment. Organizations too small to separate them need compensating controls approved by an external auditor.

Exceptions: Sole Source, Emergency, and Cooperative Purchases

 

Exception clauses determine whether the policy survives contact with real work. Write them so the legitimate path stays faster than the workaround.

A sole source justification should name the requirement, explain why one supplier alone can meet it, document the price reasonableness analysis, and carry a signature above the requester’s level. Require the form before the purchase order issues. Retroactive justification signals a process that exists on paper alone.

Emergency purchases need a definition tied to operational or safety risk, not to poor planning. Set a documentation window, such as five business days, and name the executive who ratifies the purchase.

Cooperative purchasing lets you buy off a contract another entity competed. State which cooperative agreements you accept and what evidence of the original competitive process the file must hold.

Norms: Ethics, Conflict of Interest, and Supplier Conduct

 

Require written conflict of interest disclosure from anyone involved in supplier selection, evaluation, or approval, and define the recusal trigger. United States federal contracting rules address personal and organizational conflicts in FAR Part 3, which offers useful language for private sector drafters.

Set a gift and hospitality limit with a workable number. A zero-dollar rule reads well and collapses in practice, because it turns a coffee into a compliance event. A modest incidental threshold with mandatory disclosure above it holds up better.

Add supplier screening against debarment and exclusion lists, confidentiality obligations for evaluators, and any sustainability or supplier diversity commitments your organization has adopted.

Documentation: Records, Retention, and the Audit Trail

 

State what the file must contain at each tier: quotes received, evaluation notes, the justification for the selected supplier, the executed agreement, and the approval chain.

Set retention periods against the longest applicable statutory requirement. Ontario’s BPS Directive, for one, sets seven years for procurement documentation.

Above a defined value, require a cost or price analysis rather than a bare price comparison. Teams tracking requirement-by-requirement evidence across a large solicitation often manage it through a compliance matrix, a structure that transfers well to procurement files.

How Thresholds Connect to Solicitation Method

 

The policy sets the rule; the solicitation applies it. Map each threshold band to a method, and add complexity as a second trigger alongside value. A low-dollar purchase carrying unusual technical risk still warrants a formal process.

Keep evaluation weightings out of the policy. State that competitive solicitations must publish mandatory and rated criteria in advance and must not change them except by addendum.

The solicitation itself carries the weights, which lets procurement teams tune criteria per requirement without amending a board-approved document.

Requirements for Canadian Organizations

 

Canadian public and broader public sector buyers work under obligations sitting above internal thresholds.

The Canadian Free Trade Agreement sets covered procurement values that force open, published competition once a requirement crosses them, and the CFTA thresholds reset every two years. International agreements including CETA and the CPTPP apply their own higher values.

Ontario adds a further layer. Designated broader public sector organizations, including hospitals, school boards, universities, and colleges, follow the BPS Procurement Directive. The Buy Ontario Procurement Directive, in force since April 2026, consolidates domestic preference requirements across government and broader public sector entities.

A policy written for a Canadian organization needs a clause acknowledging that trade agreement obligations prevail over internal thresholds, plus a review trigger tied to threshold updates.

Requirements for Grant-Funded Organizations

 

Recipients of federal awards must maintain written procurement procedures as a condition of funding.

Requirements include full and open competition, written standards of conduct covering conflicts of interest, cost or price analysis above defined values, and verification that suppliers are neither suspended nor debarred. Legal Services Corporation publishes procurement policy drafting guidance that grantees across sectors find useful.

Keep funding-source rules in an appendix rather than the body, so the core policy stays readable and the appendix updates without a full rewrite. Broader compliance documentation practices apply to the supporting evidence set.

How to Write the Document

 

Start with an audit of current behaviour. Pull spend data, interview the departments that buy most, and find where purchases already bypass finance. Policy written against reality gets followed.

Bring finance, legal, operations, and the largest requisitioning departments into threshold setting. Approval limits imposed without their input generate exception requests within a month.

Use binding language. “Must” creates an obligation, “should” creates a recommendation, and “may” grants discretion. Pick each word on purpose, and avoid mixing them inside a single requirement. The same company policy writing process applies to structure, numbering, and version control.

Keep the policy short. Anything that changes when you switch accounting systems belongs in the procedure.

Anything requiring board approval to change belongs in the policy. At The Write Direction, we hold most client procurement policies under fifteen pages and push operational detail into a companion procedure manual.

Close with approval, publication, and acknowledgment. Name the document owner, record the approval date, and require staff holding purchasing authority to confirm they have read it.

Keeping the Policy Enforceable

 

Schedule an annual review, and list the events forcing an off-cycle update: threshold changes under trade agreements, a new funding source, a restructuring, or an audit finding.

Train requisitioners and approvers on the parts that apply to them. Approvers need the threshold table and the conflict of interest rules. Requisitioners need the quote requirements and the exception process.

Write a consequences clause with substance. Vague statements about disciplinary action deter nobody. Where legal counsel supports it, state that purchases made outside the policy may go unpaid or become the personal responsibility of whoever committed them.

Measure compliance with a few figures: off-contract spend as a share of total, sole source rate by department, and the count of retroactive approvals. Rising retroactive approvals signal a process people find too slow.

Common Mistakes

 

Thresholds copied from a template rather than derived from spend data top the list. Behind that sit exception processes so slow that staff route around them, policies with no named owner, and one merged document trying to serve as policy, procedure, and training manual at once.

The costliest omission is silence on contract splitting. A policy with a clean threshold table and no splitting prohibition gives the appearance of control while leaving the obvious workaround open.

Frequently Asked Questions

 

What is a procurement policy?

 

A procurement policy is a formal governance document defining how an organization purchases goods, services, and construction.

It sets purchasing authority by role, establishes dollar thresholds that trigger competitive bidding, defines supplier selection criteria, and states ethical requirements covering conflicts of interest, gifts, and supplier conduct.

The policy binds everyone who can commit organizational funds, including contractors and board members where the organization chooses to extend it.

What is the difference between a procurement policy and a procurement procedure?

 

The policy states the rules and the authority behind them. The procedure explains the steps someone follows to comply.

A policy might require three written quotes above $25,000; the procedure explains which system captures the quotes, which form records the comparison, and who receives it. Keeping them in separate documents lets operational detail change without reopening a board-approved policy, which is why most organizations maintain both.

What should be included in a procurement policy?

 

A complete procurement policy covers scope and exclusions, delegated approval authority with dollar thresholds, competitive bidding requirements by tier, sole source and emergency exception rules, conflict of interest and gift standards, supplier screening obligations, contract signing authority, documentation requirements, and record retention periods.

Public and grant-funded organizations add applicable trade agreement and funding-source obligations, along with a contract splitting prohibition and segregation of duties clause.

What dollar threshold requires competitive bidding?

 

Private organizations set their own thresholds from spend data, with three written quotes above a mid-range value and formal solicitation above a higher one as a common pattern.

Canadian public entities have less discretion, since Canadian Free Trade Agreement covered procurement values force open competition once a requirement crosses them. Those values reset every two years, so verify the current figures before drafting or revising your table.

How often should a procurement policy be reviewed?

 

Review annually at minimum.

Update sooner when trade agreement thresholds change, when your organization takes on a funding source carrying its own procurement conditions, after a restructuring that changes approval roles, or following any audit finding related to purchasing.

Assign a named owner responsible for triggering these reviews rather than leaving the schedule to chance, and record the review date on the document itself.

Build a Procurement Policy Your Team Will Follow

 

At The Write Direction, we write procurement policies, procedure manuals, and the supporting forms that make them usable.

We work with private companies, public agencies, and grant-funded organizations across Canada and the United States, and we start every engagement by looking at how purchasing already happens rather than by opening a template.

If your purchasing rules live in people’s heads, or if an auditor has flagged gaps you need to close, we can help. Explore our business consulting services or email us at [email protected] to talk through your requirements.