Draft a procurement policy for [COMPANY PROFILE] using the governing requirements and operating details below. [EXISTING POLICIES] [SPEND THRESHOLDS] [PROCUREMENT SCOPE] [VENDOR AND COMPLIANCE RULES]
Produce a 1,000-1,400 word policy in plain business language. Include: purpose and scope; definitions; roles and segregation of duties; the purchase-to-pay workflow; competition and quote requirements; approval thresholds; vendor onboarding and due diligence; conflicts of interest and gifts; contract review; purchase orders and invoice matching; emergency purchases; exceptions; record retention; and policy ownership and review cadence. Build a threshold table that shows the required requester, budget owner, procurement, finance, legal, and executive approvals at each spending level. Distinguish recurring commitments from one-time purchases, and total contract value from first-year spend. State when competitive bids may be waived, who may approve a waiver, and what documentation is required. Do not claim a legal, tax, sanctions, privacy, security, accessibility, or industry-specific requirement unless it appears in my inputs; mark those items “confirm with counsel or the responsible control owner.” Use “must” only for mandatory controls and “should” for guidance. Do not create an approval path that lets the same person request, approve, receive, and reconcile a purchase. Before answering, check the threshold table against the written workflow for contradictions. Then list assumptions, unresolved decisions, and controls that need finance, legal, security, or tax review. Ask up to 3 clarifying questions only if a required input is missing.
Fill in
| Placeholder | What to enter | Example |
|---|---|---|
| [COMPANY PROFILE] | Enter the company size, countries of operation, industry, purchasing volume, and relevant departments. | US and UK B2B software company with 180 employees, annual third-party spend of about $9 million, and centralized finance. |
| [EXISTING POLICIES] | Enter the finance, expense, security, legal, delegation, and records policies this policy must follow. | Expense policy requires receipts over $25; information security reviews SaaS vendors handling customer data; legal signs customer-data contracts; records policy keeps contracts for seven years. |
| [SPEND THRESHOLDS] | Enter proposed approval levels, currencies, and any contract-value calculation rules. | Under $2,500: budget owner. $2,500-$24,999: budget owner plus finance. $25,000-$99,999: add procurement. $100,000+: add CFO; $250,000+: CEO. Use total committed contract value. |
| [PROCUREMENT SCOPE] | Enter which purchases, entities, and payment methods are covered or excluded. | All third-party goods, services, software, contractors, renewals, and amendments; excludes employee expense reimbursements and payroll. |
| [VENDOR AND COMPLIANCE RULES] | Enter vendor diligence, security, privacy, insurance, tax, sanctions, and contract requirements already in force. | Collect W-9 or local equivalent, sanctions screening for new vendors, security review for customer data access, DPA for personal-data processing, and $1 million general liability insurance for onsite contractors. |
How to use
- Paste the prompt and include your current expense, delegation, security, and contract policies.
- Check every dollar threshold, approval role, exception owner, and record-retention period against current internal rules.
- Have finance, legal, security, and tax owners review only the sections that affect their controls.
- Follow up with: “Turn the approval threshold table into a one-page operating checklist for requesters.”
Variations
Startup policy
Use this when a small company needs lightweight controls without a procurement team.
Draft a 700-900 word procurement policy for [COMPANY SIZE AND INDUSTRY]. We have [APPROVAL ROLES] but no dedicated procurement team. Cover purchase requests, approvals, vendor setup, contracts, invoice matching, emergency spend, and conflicts of interest. Our thresholds are [THRESHOLDS], and our required reviews are [CONTROL REQUIREMENTS]. Create a simple approval matrix. Keep administrative burden proportional to spend, separate requester and approver duties, and identify any control requiring legal or finance confirmation. Do not invent regulatory obligations.
Supplier code
Use this when you need standards to send to prospective suppliers.
Create a supplier code of conduct for [COMPANY] that vendors must acknowledge before onboarding. Cover [PRIORITY TOPICS], reporting concerns through [REPORTING CHANNEL], audit or evidence rights limited to [AUDIT PARAMETERS], and consequences for material breach. Produce 600-800 words with clear mandatory requirements and no unsupported legal claims. Separate ethical expectations from contractual obligations. Before answering, flag provisions that need jurisdiction-specific legal review and any requirement we cannot reasonably verify.
Exception request
Use this when a buyer needs approval to bypass a normal procurement control.
Write a procurement exception request for [PURCHASE DESCRIPTION] costing [AMOUNT] from [VENDOR]. The policy rule to waive is [RULE], and the business reason is [JUSTIFICATION]. Include alternatives considered, risks, compensating controls, approval needed, expiration date, and records to retain. Keep it under 400 words and do not overstate urgency or savings. Flag any missing fact needed to decide whether the exception is justified.
Tips
- Base approval thresholds on total committed value, including renewals and implementation fees, so teams cannot split a commitment into smaller approvals.
- Keep the approval matrix aligned with system permissions; a policy that requires approvals your purchasing tool cannot capture will be bypassed.
- Treat security, privacy, tax, and legal review as triggered controls with stated criteria rather than sending every vendor through every review.
- Write emergency purchasing as a documented exception path, not a vague permission to act quickly.
FAQ
Can AI write a procurement policy ready to publish?
It can create a strong draft, but finance, legal, security, tax, and policy owners must validate controls and local requirements before adoption.
How many bids should a policy require?
Use requirements that scale with risk and spend, then define documented waiver reasons such as sole source, compatibility, or an urgent incident.
Should renewals follow the same policy as new vendors?
Yes, but renewals should also require review of price changes, scope changes, performance, data access, and total remaining commitment.