Governance and risk for procurement
Governance and risk controls for procurement can prevent unnecessary costs by ensuring that enterprise AI solutions are used consistently with organisational policies, as seen when a category manager checks spend reports and a shift supervisor accesses maintenance schedules, with permissions enforced at retrieval.
A category manager checking the latest spend reports on a Monday morning is likely to be the first to notice when something has gone awry with the procurement process, but by then it may be too late to prevent unnecessary costs or risks. This is why governance and risk controls are crucial when implementing enterprise AI solutions for procurement, to ensure that the system is used in a way that is consistent with the organisation's policies and procedures.
Enforcing permission at retrieval
One common mistake is to try to control access to the system by instructing the model to only return certain types of information to certain users. However, this approach is flawed because it relies on the model being able to understand the nuances of the organisation's permission structure, which can be complex and difficult to codify. A better approach is to enforce permission at the point of retrieval, so that the system checks the user's permissions before returning any information. This way, the organisation can be sure that sensitive information is only being shared with those who are authorised to see it.
The shift supervisor, for example, may need to access information about maintenance schedules and inventory levels in order to plan the day's work, but they should not be able to see sensitive information about supplier contracts or employee salaries. By enforcing permission at retrieval, the organisation can ensure that the shift supervisor only sees the information they need to do their job, and that sensitive information is protected.
Auditability
Auditability is another key aspect of governance and risk controls for procurement. This refers to the ability to track and record all interactions with the system, including what was asked, what was returned, and on what data. This information can be used to identify potential issues or risks, and to ensure that the system is being used in a way that is consistent with the organisation's policies and procedures. The ability to audit the system is particularly important in procurement, where small mistakes can have significant financial consequences.
For instance, if a procurement officer is using the system to compare prices from different suppliers, the organisation should be able to track what information was requested, what information was returned, and what decision was made based on that information. This allows the organisation to ensure that the procurement officer is making informed decisions, and that the system is being used in a way that is transparent and accountable.
Procurement data
The effectiveness of governance and risk controls for procurement depends on the quality and accuracy of the underlying data. This includes purchase orders, supplier contracts and terms, invoice history, and category structure. If this data is incomplete, inaccurate, or outdated, the system will not be able to provide reliable information, and the organisation will not be able to make informed decisions. The category manager, for example, needs to be able to access accurate information about supplier contracts and terms in order to negotiate the best possible deals.
The procurement data should be regularly reviewed and updated to ensure that it remains accurate and relevant. This can be a time-consuming process, but it is essential for ensuring that the system is providing reliable information. The organisation should also have processes in place for handling discrepancies or errors in the data, such as discrepancies between the contract terms and the invoice history.
Impact on spend and contracts
The implementation of governance and risk controls for procurement can have a significant impact on spend and contracts. By providing greater visibility and control over the procurement process, the organisation can reduce the risk of overspending or entering into unfavourable contracts. The system can also help to identify areas where spend is fragmented across multiple suppliers, and where contract terms are diverging from what is actually being paid.
For example, the organisation may discover that it is paying different prices for the same item from different suppliers, or that it is being charged for services that are not actually being used. By identifying these issues, the organisation can take steps to consolidate its spend and negotiate better contracts, which can lead to significant cost savings. The operations team can work with the procurement team to implement changes to the procurement process and ensure that the organisation is getting the best possible value from its suppliers.
Measurement and evaluation
The effectiveness of governance and risk controls for procurement should be measured and evaluated on a regular basis. This can be done using metrics such as spend under management, price variance to contract, and supplier concentration. These metrics can provide insights into the organisation's procurement practices and help to identify areas for improvement. The organisation should also have processes in place for regularly reviewing and updating its governance and risk controls, to ensure that they remain effective and relevant.
The organisation may also want to consider tracking other metrics, such as the number of procurement requests that are approved or rejected, or the average time it takes to process a procurement request. By tracking these metrics, the organisation can get a better understanding of its procurement practices and identify areas where it can improve. For more information on how to implement governance and risk controls for procurement, please contact us.
Limitations and exceptions
While governance and risk controls for procurement can be highly effective in reducing risk and improving compliance, they are not a silver bullet. There may be situations where the controls are not sufficient, or where they need to be adapted to meet specific business needs. For example, in situations where the organisation is dealing with a new or untested supplier, it may be necessary to relax some of the controls in order to facilitate the procurement process.
In these situations, the organisation should have processes in place for evaluating and mitigating the risks, and for ensuring that the controls are adapted in a way that is consistent with the organisation's overall risk management strategy. The organisation should also be aware of the potential limitations and exceptions to the controls, and should have plans in place for addressing these issues as they arise.
Frequently asked questions
How can governance and risk controls prevent unnecessary costs in procurement?
By ensuring that enterprise AI solutions are used consistently with organisational policies and procedures.
What is the importance of enforcing permission at retrieval in procurement?
Enforcing permission at retrieval ensures that sensitive information is only shared with authorised users, protecting the organisation from potential risks.
Why is auditability crucial in governance and risk controls for procurement?
Auditability allows the organisation to track and record all interactions with the system, identifying potential issues and ensuring transparency and accountability.
How can accurate procurement data impact the effectiveness of governance and risk controls?
Accurate procurement data ensures that the system provides reliable information, enabling informed decisions and reducing the risk of errors or discrepancies.