Small Business Procurement Policy: Sections and Sample Rules

Cover these parts in this order:

• Purpose and scope: what counts as a purchase, and who is covered.
• Roles: who requests, who approves, who orders and who pays.
• Approval limits: the spend level at which each role can approve.
• Quotes and vendor selection: when you compare suppliers.
• Vendor onboarding: what a new vendor must provide before first payment.
• Purchase orders and invoices: when to issue a PO, and how invoices are matched.
• Conflicts of interest and gifts: a short rule on personal relationships with vendors.
• Exceptions and emergencies: how to buy urgently and record it afterward.

Keep the definitions of who counts as an approver short and role-based, such as department head and finance lead, so the policy survives job changes.

Approval limits should match your risk, not a template. Start from the amounts that would hurt you if spent wrongly, then set tiers. For example, a small company might let any employee spend up to a low amount on approved categories with a company card, require a manager's approval above that, and require finance or the owner above a higher limit. Use figures that fit your size, since a limit that's too low creates constant requests and one that's too high defeats the purpose.

Two rules matter more than the numbers:

1. Nobody approves their own purchase or one for their own direct benefit.
2. Splitting a purchase into smaller pieces to get under a limit is a violation.

Write the thresholds as a table in the policy: category or amount, who approves, and whether a PO is needed. The purchase order approval workflow shows how to run this in practice.

Require quotes only where they pay off. For example, you might ask for three quotes above a certain spend or for any new recurring contract, and allow a single-source purchase with a written reason when there's only one suitable supplier or when a vendor has an existing relationship. The written reason is the control: it forces the buyer to say why.

Compare more than price. Score the options on total cost over the contract term, quality, references, security and data handling where relevant, support, and how easy it is to leave. Recurring software contracts deserve extra care, because auto-renewals lock you in. Record the renewal date and notice period in a contract tracker, and review it before each renewal window. For tools that enforce these controls, see this spend management tool comparison.

Vendor payment fraud often starts with a changed bank account or a fake invoice. Build these controls into the policy:

• New vendors provide tax forms and payment details through a standard process, before the first payment.
• Changes to vendor bank details are verified by calling a known number, never by replying to the email that requested the change.
• Invoices are matched to a PO or an approved request before payment.
• The person who approves a payment isn't the person who sets up the vendor.
• Payments above a stated amount need a second approver.

These separations of duty matter more as you grow, but even a five-person company can do the callback and the matching. Add a periodic review, such as quarterly, of new vendors and payments above the limit.

Introduce the policy in a short meeting with examples: "You need a laptop stand; that's under the limit, so buy it. You want a new project tool for the team; that needs a quote and manager approval." Put it where people find it, and link it from the expense process. Add a row to your employee handbook that points to it, and align equipment rules with the remote equipment policy.

Review it once a year and after any incident or growth jump. Look at purchases that bypassed the process: are they rule-breaking or does the rule not fit? Adjust the rule if the workarounds are reasonable. If you plan to add a dedicated buyer, the hiring process template can help you structure the search.