# Procurement Compliance

> Validate procurement activities against regulatory requirements, internal policies, budget constraints, and audit standards with automated compliance checking and reporting

- Skill: `construct-ai-primary/procurement-compliance` (Agent Skill)
- Install (CLI): `npx skillmds@latest add construct-ai-primary/procurement-compliance`
- Raw SKILL.md: https://api.skillmd.com/api/skills/construct-ai-primary/procurement-compliance/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: Construct-AI-primary (https://skillmd.com/u/construct-ai-primary)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/construct-ai-primary/procurement-compliance

---


# Procurement Compliance

## Overview

Validate procurement activities against regulatory requirements, internal policies, budget constraints, and audit standards. Provides automated compliance checking at critical decision points (order submission, approval, payment), audit trail validation, and compliance reporting. Ensures all procurement activities meet governance requirements before execution.

**Announce at start:** "I'm using the procurement-compliance skill to validate procurement activities against policy, budget, and regulatory requirements."

## When to Use This Skill

**Trigger Conditions:**
- Validating procurement activities against compliance requirements
- Conducting procurement compliance audit or review
- Setting up compliance rules for a new project or contract
- Preparing for regulatory or internal audit
- Reviewing procurement processes for governance gaps

**Prerequisites:**
- Compliance rules defined for the procurement context (regulatory requirements, internal policies, budget constraints)
- Procurement data available for validation (orders, approvals, invoices, contracts)
- Audit requirements defined (retention periods, evidence requirements, reporting frequency)

## Step-by-Step Procedure

### Step 1: Compliance Framework Identification

Identify the compliance framework(s) applicable to the procurement context:

| Framework Type | Applies When | Key Requirements |
|----------------|--------------|-----------------|
| **Internal Policy** | All procurement activities | Authority limits, approval routing, documentation standards, audit trail |
| **Budget Compliance** | Orders against approved budget | Budget allocation, cost code validation, variance thresholds |
| **Regulatory Compliance** | Cross-border procurement, government contracts | Trade regulations, import/export rules, anti-corruption, tax compliance |
| **Contract Compliance** | Orders under specific contract | Contract terms, pricing, delivery requirements, quality standards |
| **Industry Standards** | Specialized procurement | Construction standards, safety requirements, environmental regulations |

### Step 2: Rule Set Activation

Activate compliance rules based on framework:

| Rule Category | Example Rules | Enforcement Level |
|---------------|--------------|-------------------|
| **Authority Limits** | Orders >$100k require director approval; orders >$1M require board approval | Hard block (cannot proceed without approval) |
| **Budget Compliance** | Order value must not exceed allocated budget (+/- tolerance); variance >10% requires formal review | Warning + escalation |
| **Documentation Requirements** | All orders must have requisition, quotation, and approval record; GRN required before payment | Hard block (missing documentation) |
| **Regulatory Requirements** | Import orders require customs clearance; hazardous materials require permits; anti-corruption declaration required | Hard block (missing compliance evidence) |
| **Timing Requirements** | Quotations must be within validity period; approvals must be before order issue; GRN within 3 days of delivery | Warning + escalation |
| **Audit Requirements** | All actions logged; records retained for 7 years; audit trail immutable | Post-action (validation only) |

### Step 3: Compliance Point Validation

Execute compliance validation at critical decision points:

**CP1: Order Submission (Before Order Issued to Supplier)**
- [ ] Budget allocation confirmed for cost code/WBS
- [ ] Supplier on approved vendor list (or pre-qualification completed)
- [ ] Quotation current and within validity period
- [ ] Order value within authority limit for approver
- [ ] Required approvals obtained per value threshold
- [ ] Technical specifications approved by discipline lead
- [ ] Incoterms specified correctly
- [ ] Insurance/bond requirements met (if applicable)

**CP2: Order Approval (Before Order Released)**
- [ ] Approval chain completed per routing configuration
- [ ] All approvers acted within authority limits
- [ ] No approver approved their own order
- [ ] HITL decision recorded where confidence was low
- [ ] Order value matches approved quotation

**CP3: Payment Processing (Before Invoice Paid)**
- [ ] 3-way match complete (PO + GRN/service entry + invoice matching)
- [ ] GRN verified quality meets specification
- [ ] Invoice amount matches PO line item price
- [ ] Tax calculation correct per jurisdiction
- [ ] Payment terms per contract honoured
- [ ] No duplicate invoice detected
- [ ] Anti-fraud checks passed

**CP4: Change Execution (Before Variation Implemented)**
- [ ] Variation order approved per authority matrix
- [ ] Budget impact assessed and approved
- [ ] Schedule impact assessed (if applicable)
- [ ] All affected parties notified
- [ ] Audit trail updated with change details

### Step 4: Audit Trail Validation

Validate audit trail completeness:

```json
{
  "audit_trail_check": {
    "entity_type": "purchase_order",
    "entity_id": "PO-2026-0089",
    "validation_at": "2026-03-31T14:00:00Z",
    "required_records_minimum": 5,
    "records_found": 5,
    "records": [
      {"action": "order_created", "timestamp": "2026-03-31T09:00:00Z", "actor": "procurement_officer_1", "data_changed": {...}},
      {"action": "submitted_for_approval", "timestamp": "2026-03-31T09:30:00Z", "actor": "procurement_officer_1"},
      {"action": "approved", "timestamp": "2026-03-31T10:00:00Z", "actor": "procurement_manager", "reason": "within_budget"},
      {"action": "sent_to_supplier", "timestamp": "2026-03-31T10:30:00Z", "actor": "procurement_officer_1"},
      {"action": "so_acknowledged", "timestamp": "2026-03-31T14:00:00Z", "actor": "supplier_steelworks", "data_changed": {...}}
    ],
    "completeness": "100%",
    "immutability_check": "passed",
    "retention_status": "active"
  }
}
```

### Step 5: Compliance Report Generation

Generate compliance report covering:

| Report Section | Content |
|----------------|---------|
| **Executive Summary** | Overall compliance status, critical findings, recommendations |
| **Scope** | What was reviewed, time period, data sources |
| **Framework Applied** | Which compliance rules were validated |
| **Compliance Checks Performed** | Each check with pass/fail result |
| **Findings** | Non-compliance identified with severity rating |
| **Recommendations** | Corrective actions for each finding |
| **Evidence** | Supporting documentation for each finding |

**Finding Classification:**
| Severity | Definition | Required Action |
|----------|------------|-----------------|
| **Critical** | Legal or regulatory violation, material financial misstatement | Immediate escalation, formal investigation |
| **High** | Material policy violation, missing required approval | Immediate corrective action, senior management notification |
| **Medium** | Minor policy deviation, documentation gap | Corrective action within defined timeframe |
| **Low** | Best practice recommendation, process improvement | Process improvement in next cycle |
| **Informational** | Observation with no compliance impact | Documentation for future reference |

### Step 6: Remediation Tracking

Track identified non-compliance through remediation:

| Remediation Element | Description |
|--------------------|-------------|
| **Finding ID** | Unique reference for tracking |
| **Severity** | Critical/High/Medium/Low/Informational |
| **Description** | Specific non-compliance identified |
| **Root Cause** | Why it happened (system, process, human error) |
| **Corrective Action** | What was done to fix it |
| **Responsible Party** | Who is accountable for remediation |
| **Due Date** | When remediation must be completed |
| **Status** | Open/In progress/Closed/Verified closed |

### Step 7: Compliance Certification

Generate compliance certification when all checks pass:

```
COMPLIANCE CERTIFICATE
Project/Contract: _____________________
Procurement Scope: ____________________
Period Covered: _______________________

I certify that I have reviewed the procurement activities within the scope above and found them to be in compliance with:
☐ Internal procurement policy
☐ Budget allocations and authority limits
☐ Regulatory requirements
□ Contract terms and conditions
☐ Audit trail requirements

Outstanding Findings: [None / List finding IDs]

Certified By: ________________________
Role: _______________________________
Date: _______________________________
```

## Success Criteria

- [ ] Compliance framework correctly identified for procurement context
- [ ] All compliance checks executed with pass/fail result documented
- [ ] Audit trail validation complete (all actions logged with actor, timestamp, data changed)
- [ ] Findings classified with correct severity rating
- [ ] Remediation plan created for all non-compliance findings
- [ ] Compliance report generated covering all required sections
- [ ] Certification signed by authorized reviewer (if applicable)

## Common Pitfalls

1. **Assuming Retroactive Approval** — Approval must be obtained before action, not after. A post-hoc approval is not a valid compliance record.
2. **Ignoring Soft Limits** — Not all limits are hard stops. Budget tolerance, quotation validity, and timing requirements are often soft limits that require escalation rather than blocking action.
3. **Incomplete Audit Chain** — Every action must be logged with actor, timestamp, and data changed. Missing links in the audit chain prevent forensic analysis and may invalidate the entire record.
4. **One-Time Compliance** — Compliance is not a single event. It must be maintained throughout the procurement lifecycle. A compliant order becomes non-compliant if the supplier invoice differs from PO terms.
5. **No Remediation Tracking** — Finding non-compliance without tracking remediation means the gap persists. Always track findings through to verified closure.

## Cross-References

### Related Skills
- `procurement-order-management` — Compliance checks at order submission and approval
- `contract-intelligence` — Contract term compliance validation
- `procurement-analytics` — Compliance reporting, audit trail analysis
- `supplier-evaluation` — Supplier compliance with contract terms

### Related Agents
- `Financial Compliance Specialist` (DomainForge) — Budget compliance, financial audit
- `Contract Administration Specialist` (DomainForge) — Contract term compliance
- `Procurement Strategy Specialist` (DomainForge) — Regulatory compliance, risk assessment

## Example Usage

**Scenario:** Validate Q1 2026 procurement activities for audit compliance

1. **Framework:** Internal policy + budget compliance + audit requirements
2. **Scope:** All orders issued Q1 2026 (147 POs, R15.2M total value)
3. **Compliance Checks:** 500 checks performed across 4 compliance points
4. **Results:** 495 passed (99%), 4 medium findings (documentation gaps), 1 high finding (missing approval on R890k order)
5. **Remediation:** High finding escalated to procurement manager, medium findings corrected within 30 days
6. **Report:** PDF compliance report for management, JSON data for audit system
7. **Certification:** Compliance certificate signed by procurement director

## Performance Metrics

**Target Performance:**
- Compliance check coverage: 100% of required checks executed
- Critical finding detection rate: 100% (no critical findings missed)
- False positive rate: <5% of reported findings
- Report generation time: <10 minutes for full audit scope
- Audit trail completeness: 100% of procurement actions logged with actor, timestamp, data changed