Procurement Policy: What to Put in It So People Actually Follow It

A procurement policy is the set of rules that decides who can buy what, up to what amount, with which approvals, and through which payment method. A good one makes the compliant way to buy the fastest way, so people use it instead of working around it.

Most finance teams already have some version of this document. The trouble shows up in AP, where invoices still arrive without purchase orders, from suppliers nobody approved, for amounts nobody signed off on. That gap usually comes from rules that don't match how the company actually buys, more than from rules that are missing.

Key Takeaways

• A procurement policy covers company-wide purchasing. The corporate card policy and the travel and expense policy sit beneath it.

• The core sections cover who can buy, how much each approver can sign for, and which payment method fits each purchase, plus supplier onboarding and documentation.

• Approval limits set below the typical purchase size create more off-policy spend, not less.

• Cards suit low-value, frequent buys from known suppliers. Purchase orders suit contracted, high-value, receipt-matched purchases.

• A policy only becomes a control when the purchasing system enforces it at the moment someone tries to buy.

What is a procurement policy?

A procurement policy, also called a purchasing policy, is the written standard for how an organization buys goods and services. It sets who may commit company money, what approvals each purchase needs, how suppliers get chosen and onboarded, and which payment method fits each kind of purchase.

It sits above the narrower policies most companies already have. Your corporate card spend policy governs who gets a card, which merchant categories are blocked, and what the limits are. A travel and expense policy covers employee travel and reimbursement. The procurement policy decides when a card is the right tool in the first place, and when a purchase needs a requisition and a PO instead.

How is a procurement policy different from a purchasing procedure?

A policy states the rules and a procedure describes the steps. The policy says a purchase over a set amount needs two approvals and three quotes. The procedure says how to raise the purchase requisition, where to attach the quotes, and who gets notified.

Keep them in separate documents. Policies change rarely and need executive sign-off. Procedures change whenever your systems do, and the people who run them should be able to update them without a board meeting.

Who should own the policy when there is no procurement team?

In a company without a chief procurement officer, the controller or VP of Finance usually owns the policy. Finance already owns the budget, the approval matrix, and the AP process, so it's the natural home.

Owning the policy means maintaining the document, setting the thresholds, approving exceptions, and reporting on compliance. Department heads still make most purchasing decisions within the limits finance sets. If you're still defining the procurement function itself, settle that first, because the policy has to name roles that actually exist.

What should a procurement policy include?

A procurement policy should include enough sections to answer any purchasing question without a phone call to finance. For most mid-size companies, that means nine:

1. Scope, covering which entities, departments, and spend types the policy applies to, and what it excludes, such as payroll or taxes

2. Roles and responsibilities, naming who requests, who approves, who buys, and who pays

3. Approval thresholds, with the amount bands and the approver for each

4. Competitive quotes, saying when a purchase needs two or three bids and when a sole-source justification is enough

5. Approved payment methods, defining when to use a purchase order, a card, or an existing contract

6. Supplier onboarding, including vendor due diligence, tax forms, and bank-detail verification before the first payment

7. Contracts, covering who may sign, what terms need legal review, and when to add price-adjustment language

8. Conflicts of interest, requiring disclosure of any personal or financial tie to a supplier

9. Documentation, retention, and exceptions, stating what records each purchase needs, how long to keep them, and who can approve a departure from the policy

The contracts section deserves more attention than it used to get. According to KPMG, citing a July 2025 HFS Research and KPMG report, 52% of procurement teams are adding economic trigger clauses to contracts, and 41% are breaking large deals into smaller, more flexible components. If your policy says nothing about price-adjustment terms, buyers will either skip them or invent their own.

Which sections can a mid-size company skip at first?

A mid-size company can start without detailed sections on sustainability, supplier diversity, or category strategy. Those matter, but they don't stop bad purchases. A sustainable procurement policy is worth adding once the basics hold, not before.

Don't skip thresholds, payment methods, supplier onboarding, or documentation. Those four decide whether AP can pay an invoice without chasing anyone, and whether an auditor can follow the trail afterward.

What does a usable procurement policy template look like?

A usable template is short enough to read in 10 minutes. It has a one-page summary up front with the threshold table and the payment-method rules, followed by the full sections in the order listed above.

Put the threshold table on the first page. It's the part people look up most often, and burying it on page seven is how you end up with requesters guessing.

How do you set purchasing approval limits people will follow?

Set purchasing approval limits around the size of purchases your company actually makes, so routine buys need one quick approval and scrutiny goes to the purchases that carry real risk. The goal is fewer approvals on small, frequent buys and more on large, rare ones.

Public programs offer a useful reference point, even though a private company sets its own lines. The Federal Acquisition Regulation, in FAR 2.101, defines the micro-purchase threshold as $15,000, with listed exceptions, and sets the simplified acquisition threshold at $350,000. Those numbers are tuned for public money and a very large organization, so treat them as calibration rather than a template.

Here's an illustrative structure a mid-size company might start from:

Adjust the bands to your own purchase data. Pull last year's invoices and card transactions, sort them by amount, and see where most transactions fall. That distribution should drive the first band, not a round number someone picked years ago.

Why do thresholds set too low create more off-policy spend?

A threshold set below the typical purchase size turns almost every buy into an approval request. Approvers start rubber-stamping, requesters start splitting purchases or paying personally and expensing it, and suppliers start invoicing without a PO because waiting costs them more than the risk.

In my experience, the limit nobody follows is almost always the one set below the median purchase. If a team buys a lot of $800 items and the no-approval line is $500, you've designed a policy that's broken by default. Raising the line to match real purchases, and putting those buys on a card with controls, usually cuts maverick spend more than any reminder email.

How many approval tiers does a mid-size company need?

Most mid-size companies need three or four approval tiers. Fewer than three puts too much weight on one approver. More than four slows routine purchases and adds approvers who don't add judgment.

Each tier should add someone with a different view of the purchase, such as budget, technical fit, or legal exposure. If two tiers would ask the same question, merge them.

When should a purchase go on a card instead of a purchase order?

A purchase should go on a card when it's low in value, frequent, and from a known supplier, and on a purchase order when it's high in value, under contract, or needs a goods receipt before payment. Cards keep small purchases fast and controlled. POs give large purchases a document trail and a three-way match.

The payment data supports that split. Average B2B credit card payments were $275 and debit card payments $119, compared with $8,084 for ACH and $5,577 for checks, according to a Federal Reserve Bank of Cleveland payments research brief. The federal government shows the same pattern. The average GSA SmartPay transaction in fiscal year 2025 was $480, according to GSA's program statistics. Cards already carry the small, frequent purchases, so the policy should say so instead of forcing them through POs.

A third option sits between the two. Once a purchase has been approved and invoiced, AP can pay the supplier by virtual card instead of ACH or check, so the card's controls and data apply to supplier payments too. Corpay supports that split, paying approved suppliers by virtual card, ACH, or check.

Corporate cards or virtual cards for procurement?

Corporate cards and purchasing cards suit employee-initiated buys, such as supplies, software subscriptions, and small services, where the cardholder is the requester. Virtual cards suit supplier payments, where AP issues a card number for a specific approved invoice.

Single-use virtual cards add a control that plastic can't. Each number is created for one payment and one amount, so it can't be reused if it's exposed. Many companies use both, with purchasing cards for front-line buying and virtual cards for AP payments to card-accepting suppliers.

How do card controls carry the policy to the point of sale?

Card controls carry the policy to the point of sale by enforcing its rules before a transaction is approved. Per-transaction and monthly limits mirror the threshold table, while merchant category blocks keep cards away from spend the policy routes to a PO or contract instead. Department-level card limits tie each cardholder's limits to their budget.

That's the difference between a policy and a control. A rule in a PDF depends on someone remembering it. A card limit stops the purchase whether anyone remembers or not.

How do you enforce a procurement policy without slowing the business down?

Enforce a procurement policy by building it into the tools people already use to buy, so compliance happens by default and exceptions stand out. Requisitions that route automatically by amount and department, cards with limits that match the policy, and an invoice approval workflow that rejects non-PO invoices above a threshold all do this.

Documentation is where enforcement breaks down most often. In a 2017 report, GAO found that 22% of government-wide purchase card micropurchase transactions lacked complete documentation supporting the approval process. That's a well-funded public program with written rules and regular audits. For a private company, the lesson is that a documentation requirement no system enforces will be skipped a meaningful share of the time.

The upside of getting it right is measurable. The Hackett Group's Digital World Class procurement teams lose 60% less savings to maverick buying and contract noncompliance, according to a July 2025 Hackett release. Guided buying and catalogs, which steer requesters to approved suppliers and prices, are a large part of how those teams get there.

One loose end no system fixes. A policy that leadership exempts itself from won't hold for anyone else. If executives buy outside the rules, the rules become optional, and AP will see it in the invoices within a quarter.

What documentation does an audit expect for each purchase?

An audit usually expects to trace each purchase from request to payment. For a typical PO purchase, that means:

• The approved requisition, showing who asked, who approved, and when

• Quotes or a sole-source justification, where the policy requires them

• The purchase order or contract

• A receipt or acceptance record confirming the goods or services arrived

• The supplier invoice, matched to the PO and receipt

• The payment record, with method, date, and reference

For card purchases, the receipt, the business purpose, and the cardholder's manager approval usually stand in for the requisition and PO.

How do you measure compliance after launch?

Measure compliance with a few numbers you can pull monthly:

• Share of invoices that arrive with a valid PO

• Share of spend with approved suppliers

• Count of purchases that look split to stay under a threshold

• Number of exceptions approved, and by whom

Review the trend, not just the level. A rising share of non-PO invoices usually means a threshold or a process is wrong, not that people stopped caring. Fix the rule, and the number tends to follow. Watching tail spend closely helps too, because that's where off-policy suppliers tend to hide.

Put the policy into the purchasing system with Corpay

A procurement policy works best when the system enforces it at the moment of purchase. Corpay PO automation routes requisitions through automatic approval workflows with budget and policy checks, so requests follow your threshold table without anyone looking it up.

Corpay purchasing cards carry the policy to the point of sale with controls set by your rules, and single-use virtual cards extend those controls to supplier payments. Fully managed AP pays suppliers by virtual card, ACH, or check and syncs back to your ERP through 100+ ERP integrations, including NetSuite, Sage Intacct, Business Central, and Acumatica. Most programs are live in weeks, and they fit into the procure-to-pay process you already run.

Frequently Asked Questions

What are the 7 principles of procurement?

There's no single official list of seven. Most versions start with transparency and fairness, then add value for money, competition, and accountability in some form. A policy turns those principles into specific rules, such as quote requirements and conflict-of-interest disclosures.

Can you provide an example of a procurement policy?

A simple example sets three or four approval bands by dollar amount, requires quotes above a set level, sends small purchases to purchasing cards, and requires a PO for anything under contract. The threshold table above is a starting structure you can adapt.

What are the 5 pillars of procurement?

Like the seven principles, the five pillars vary by source. Common versions cover people, process, technology, suppliers, and data. For a policy, the practical takeaway is that rules alone aren't enough without the systems and supplier relationships to support them.

What should a procurement policy include for a mid-size company?

A mid-size company's policy should cover the nine sections listed above, from scope and roles through documentation and exceptions. Start with thresholds and payment methods, because those decide most daily purchasing questions.

How often should a procurement policy be reviewed?

Review a procurement policy at least once a year, and whenever the company changes its ERP, adds an entity, or sees non-PO invoices rising. Recheck the thresholds against the past year's purchase data each time.

David Luther

Product Marketing Program Manager

David Luther, MBA is a product marketing program manager with years of experience in commercial banking, finance, and technology sectors, with research and writing appearing in financial publications.

Procure-to-Pay

Commercial Cards