How to Set Up a Purchasing Process and Manage Suppliers Well

What is a purchasing process, and why does a small company need one?

A purchasing process is the agreed way your company decides what to buy, from whom, at what price, with whose approval, and how it checks that it got what it paid for. In a company of 30 or 300 people it is often nobody's formal job. The engineer buys spares from the firm he trusts, the owner negotiates the big contracts in his head, and finance pays whatever invoice arrives with a familiar name on it.

That works until it does not. A production line stops because the only supplier of a printed component is late. An invoice is paid twice. A price rise slips through because nobody can find the agreed rate. An email asking you to pay a new bank account turns out to be from a criminal. Each of these is a process failure, and each has a simple control that prevents most of it.

The good news is that the methods are mature and not complicated. Spend analysis, an approval matrix, purchase orders, a three-way match, supplier scorecards and a risk register are standard in large companies, and they work perfectly well with a spreadsheet and a few templates. What small companies usually lack is not knowledge but a designed process and the files to run it.

What are the steps from requisition to payment?

Most purchasing teams call this requisition to pay, or procure to pay. The names differ; the steps do not. The table sets out seven steps, what happens at each, the control it provides, and who usually owns it in a small company.

Two of the seven carry most of the weight. The purchase order is the record of what you agreed before the supplier did any work, so it should exist before the commitment, not after the invoice. The three-way match compares the PO, the goods received record and the invoice before anyone pays. Agree a small tolerance, often a percentage of PO value agreed with finance, so rounding differences pass and real errors become a query to the supplier.

How do you work out what you are buying?

Start with data, not negotiation. Ask finance for every supplier payment in the last twelve months as a spreadsheet: date, supplier, description, amount and PO number where there was one. Give each line a category if your accounts system does not. An AI assistant can propose categories for a long export, but check every line it is unsure about yourself.

Then sort by category and by supplier. The Pareto principle, applied to management by Joseph Juran as the vital few and the trivial many, almost always holds: a small number of categories and suppliers carry most of the money. ABC analysis turns that into classes. Manage the A categories closely and make the C categories cheap to buy.

Spend alone does not tell you how to buy, so add a second question. In a 1983 Harvard Business Review article, Peter Kraljic proposed sorting purchases by profit impact and supply risk. That gives four boxes, each bought differently.

• High impact, low risk (competitive items): compete. Run an RFQ each cycle, bundle volume and keep contracts short.
• High impact, high risk (strategic items): partner. Share forecasts, use index-linked price clauses and qualify a second source where you can.
• Low impact, high risk (bottleneck items): secure supply first. Hold safety stock, give long notice and test an alternative.
• Low impact, low risk (routine items): simplify. Use a catalogue, a card or a monthly order, and skip quotes below a sensible limit.

Who should approve what?

A purchasing policy answers one question above all: who may commit the company to what. It fits on two pages. The heart of it is an approval matrix: value bands down the side, categories or types of spend across the top, and the approver and the number of quotes required in each cell. A department head can approve a routine order on Tuesday morning without asking anyone; a large multi-year contract is seen by the managing director and the finance head before it is signed.

Three rules make the matrix work. First, the PO comes before the commitment, with a short emergency route for genuine 2 a.m. breakdowns that are logged and regularised the next day. Second, approval covers the whole commitment, so splitting an order to stay under a limit is a breach, not a clever workaround. Third, anyone with a personal interest in a supplier declares it and steps out of the decision, and gifts above a modest value are declined or recorded.

Set the limits so that the matrix is workable. If every small order needs the owner's signature, people will find ways round it, and the share of spend without a PO will rise. Track that share every month, by department, and make it visible. Visibility usually fixes more than discipline does.

How do you choose a supplier fairly?

Use a request for quotation (RFQ) for things you can specify exactly, such as a carton, a grade of oil or a freight lane. Use a request for proposal (RFP) for services where you want bidders to say how they would meet a need, such as maintenance or outsourced logistics. Either way, send the same document to every bidder at the same time, share every clarification with all of them in writing, and never tell one bidder another's price.

The most common sourcing mistake is to read the bids first and build the reasons afterwards. Prevent it by writing the criteria, their weights and short descriptions of what a score of 1, 3 and 5 looks like before any bid is opened. Typical criteria are price, quality, delivery and lead time, service and flexibility, and risk and compliance. Calculate the price score rather than judging it: for example, the lowest quote divided by each quote, times five.

Between close bids, total cost of ownership decides. Unit price is what the quote says. Total cost of ownership adds freight and duties, defects and the cost of handling them, payment terms, the stock you must hold because of lead time and minimum orders, one-off set-up costs such as tooling, and your own people's time. A quote that is cheaper per unit can easily cost more per year once defects and stock are counted.

How do you onboard suppliers and stop invoice fraud?

Onboarding is where most supplier fraud is either stopped or let in. The common pattern is an email, apparently from a real supplier, asking you to pay a new bank account. The invoice looks right and the PO matches, so the money goes. Nacha, reporting the FBI Internet Crime Complaint Center's 2024 figures, noted 21,442 business email compromise complaints with losses of roughly 2.8 billion dollars that year.

The control that defeats most of these takes two minutes: call the supplier on a number you already hold, never one taken from the email or invoice, and confirm the account with their finance contact. Then have a second person approve the change in your system. Apply the same check to every new supplier before the first payment.

A complete onboarding file also covers registration and tax status (a valid tax registration is usually what lets you recover VAT, GST or sales tax), insurance and quality certificates where relevant, and a signed supplier code of conduct covering ethics, anti-bribery, labour and basic environmental expectations. On bribery, the UK Ministry of Justice guidance under the Bribery Act 2010 sets out six principles for adequate procedures: proportionate procedures, top-level commitment, risk assessment, due diligence, communication and training, and monitoring and review. They are a useful frame wherever you operate. For sustainability, ISO 20400 offers guidance on sustainable procurement. Rules differ by country, so check your finance team, auditor and local law.

How do you manage supplier performance and risk?

Score your important suppliers every quarter on a few measures you can take from data you already hold: quality (rejects and complaints), delivery (on time and in full), price (against the agreement and the market) and service (response and problem solving). Weight them, convert each to a 1 to 5 score using cut-offs agreed in advance, and put the weighted total into a band with a consequence. A preferred supplier gets more volume and first call on new work; a supplier in a watch or corrective action band gets a written plan with dates, and in the worst case a second source is qualified.

Send the scorecard to the supplier a few days before the review meeting so there are no surprises. Spend a little time on the numbers and most of the meeting on what both sides will change next quarter, including what you do that makes their job harder, such as late forecasts or slow approvals.

Supplier risk comes in recognisable shapes: a single source with no tested alternative, a supplier quietly running short of cash, one port or region, and a supplier whose compromised email becomes your invoice fraud. ISO 31000 describes a simple cycle for any risk: identify, analyse, evaluate, treat, then monitor and review. In practice, list each risk, score likelihood and impact, write a mitigation with an owner and a date, and look at the register again every quarter.

How do you measure savings honestly, and where does AI fit?

Purchasing loses credibility fastest by reporting savings that finance cannot find. Agree the baseline before the work starts, whether that is the last price paid, the last contract price or an index-adjusted old price, and write down its source. A saving is then the baseline minus the new price, times real volume, validated against invoices. A price rise you avoided is cost avoidance: worth reporting, but on its own line and never added to the savings figure.

AI is now part of everyday purchasing work. It is useful for classifying spend exports, drafting RFQ specifications and score anchors, summarising contracts in plain language, preparing for a price-increase conversation and proposing invoice matches. Treat every output as a draft. A person checks the numbers and clauses against the source, approves every exception, and makes every award, suspension, termination, payment outside the matched process and bank-detail change. Write that rule into your policy so it does not depend on memory.

If you want the whole system ready to use, the Purchasing and Vendor Management System from Bodhih Training includes a workbook for spend, Kraljic, POs, scorecards, risk and savings, a TCO calculator, the forms and templates described here, and dated country notes. To check your own judgement before you start, the AssessAll Procurement and Vendor Management Judgment assessment gives you a baseline, and a Jobulary development plan can turn the gaps into a few months of focused practice for you or your buyers.