Safety Norms: Supply Chain, Procurement and Sales Operations

1Purpose, Scope and Safety Principles

These norms apply to everyone who plans, sources, buys, receives, pays for, sells, ships or records goods and services for the organization, including employees, temporary staff, contractors and agents acting on its behalf. They cover the full chain from demand planning and supplier selection through purchase orders, goods receipt, invoice matching, payment, customer order handling, dispatch and returns.

Four principles guide every decision. No single person should control a transaction from start to finish. Every commitment of money, stock or company information must be authorized and recorded. Doubt is escalated rather than resolved privately. Speed never overrides verification. Where this document says must, the rule is mandatory under company policy. Where it says should, it is recommended good practice that managers may adapt, with reasons documented.

2Roles, Competence and Accountability

The head of procurement or supply chain owns the purchasing policy and approves delegated spending limits. Finance owns payment controls, bank detail changes and reconciliations. Sales operations owns order acceptance, pricing governance and customer master data. Compliance owns restricted party screening, anti-bribery checks and sanctions alerts. Internal audit provides independent assurance. Each process has a named process owner who maintains a current responsibility matrix.

Competence must be confirmed before authority is granted. Staff must complete role-based training on the policy, approval limits and systems before they create supplier records, approve purchases, release payments or change prices. Access is removed promptly when roles change or people leave. No one may approve their own transactions or those of a close family member, and conflicts of interest must be declared in writing.

• Approval authority must be written down with monetary and category limits, and reviewed on a periodic basis by finance.
• Staff who receive a request outside their authority must refuse it and refer it to the approver in writing.
• Anyone may place a hold on a payment or shipment they believe is fraudulent, pending review by the process owner.

3Realistic Activities, Hazards and Risk Assessment

Typical activities include supplier onboarding, tendering, contract negotiation, purchase requisitions, warehouse receiving, freight booking, customs documentation, invoice processing, customer quotations, order entry, credit checks and returns processing. The people involved range from buyers and planners to warehouse staff, accounts payable clerks, sales representatives and external carriers. Tools include enterprise resource planning systems, procurement portals, shared spreadsheets, email, electronic signature platforms and bank portals.

Each risk should be scored using a simple likelihood and impact matrix, recorded in a risk register owned by the process owner, and reviewed whenever a process, system or supplier base changes. High-scoring risks require documented preventive controls and detection measures. The main risks are listed below.

• Payment diversion: fraudulent change of supplier bank details, usually requested by email. Likelihood high, impact high.
• Supplier fraud: shell suppliers, duplicate invoices and inflated quantities. Likelihood medium, impact high.
• Pricing and discount errors: unauthorized concessions that erode margin. Likelihood medium, impact medium.
• Sanctions, export and anti-bribery breaches: dealing with restricted parties or offering improper inducements. Likelihood low to medium, impact severe.
• Data exposure: sharing pricing, bid or customer personal data with unauthorized parties. Likelihood medium, impact high.
• Warehouse and transport safety: manual handling, forklift movement and dock hazards during goods receipt. Likelihood medium, impact medium, managed under site health and safety procedures.

4Financial Control and Segregation of Duties

Segregation of duties means that the person who requests, approves, records, pays and reconciles a transaction should not be the same person. Where staffing is small, compensating controls such as independent review of system logs, dual approval above set thresholds, or finance-owned reconciliations must be documented and approved by the finance lead. Compensating controls are exceptions, not substitutes for basic separation.

Recommended analytics include flagging split purchases just below approval thresholds, duplicate invoice numbers and unusual round-sum payments, with findings reviewed by finance on a periodic basis.

• The requester must not approve the same purchase or price change.
• Supplier creation and maintenance must be separated from invoice approval and payment release.
• Bank detail changes require callback verification to a number already held on file, never a number supplied in the change request.
• Purchase orders must be raised before commitment, except for documented emergency purchases approved in writing and reconciled within the period set by finance.
• Three-way matching of purchase order, goods receipt and invoice is mandatory, and exceptions must be investigated before payment.
• System administrators must not hold business approval rights for transactions they are able to configure.
• Payment runs and bank release require dual authorization, with the second approver independent of the first.

5Fraud Prevention and Suspicious Activity

Fraud in procurement and sales is usually social engineering rather than technical attack. Common indicators include urgent payment requests, pressure to bypass the process, requests to change remittance details, invoices from unfamiliar suppliers, discounts approved outside normal channels, inconsistent delivery addresses, and staff who avoid leave or insist on handling a specific account alone.

Managers should rotate duties where practical and require mandatory leave for staff with sensitive financial access. These are recommended controls. The specific obligations for reporting fraud depend on jurisdiction and contract, so verify them with legal counsel.

• Verify any change to supplier banking, contact or address details through a known independent channel before processing.
• Do not act on payment or stock release instructions received only by email, text message or messaging application.
• Record gifts, hospitality and offers from suppliers or customers in the company register, and refuse anything that could influence a decision.
• Report suspected fraud to the designated fraud or compliance contact the same working day. Do not confront the suspected individual or run your own investigation.
• Preserve evidence such as emails, invoices and system logs. Do not delete or alter them.

6Data Confidentiality, Information Security and Records

Procurement and sales handle commercially sensitive information, including bid prices, margins, contract terms, supplier cost structures, customer lists and forecasts. They also handle personal data such as contact details, delivery addresses and payment information for individuals. Access follows the principle of least privilege, and data is used only for the purpose for which it was collected.

Records must be complete, accurate and timely. Approvals are attached to the transaction, backdating is prohibited, and corrections are made through documented adjustments rather than overwriting. Retention periods vary by jurisdiction and contract, so confirm them with the records manager and privacy officer.

• Share tender and pricing documents only through approved, access-controlled repositories, never personal email or consumer file-sharing tools.
• Apply the classification label required by company policy to every commercial document, and check recipients before sending.
• Do not place customer personal data or bank details in shared spreadsheets or unapproved applications.
• Use multi-factor authentication where the system supports it, and never share login credentials.
• Lock screens when away from the desk and collect printed sensitive documents promptly from shared printers.

7Regulatory Compliance and Supplier Conduct

Procurement and sales activity is subject to many laws, including anti-bribery, sanctions and export control, customs, competition, consumer protection, tax, and modern slavery or forced labor reporting in some jurisdictions. The specific requirements, thresholds and screening obligations differ by country and sector and must be confirmed with qualified legal and compliance advisers. This section states general norms only. It is educational guidance, not legal advice.

Manufacturer instructions, product standards and contract specifications must be followed for handling and storage of goods. Where they conflict with internal procedures, the stricter requirement applies and the conflict is escalated to the process owner.

• Screen new suppliers, customers and intermediaries against applicable restricted party lists before commitments are made, and rescreen on a periodic basis.
• Do not discuss prices, bids or market allocation with competitors. Refer any such contact to legal immediately.
• Obtain written approval before engaging agents or intermediaries who interact with public officials on the company's behalf.
• Confirm export classification and licence requirements before shipping controlled goods, and do not ship where a required licence is unconfirmed.
• Include a supplier code of conduct and audit rights in contracts, and act on credible reports of unsafe labor conditions.

8Incident Escalation, Response and Review

An incident includes suspected fraud, a paid invoice that cannot be matched, a data disclosure, a sanctions alert, a supplier safety incident during receiving, a lost shipment, or a near miss where a control almost failed. Staff must report the matter to their line manager and the designated process owner or compliance contact within the time set by policy. Where money, data or a person may be at risk, reporting must happen the same working day.

Investigations should be conducted by people independent of the transaction. Findings lead to corrective actions that are tracked to closure, and lessons learned feed back into training, system controls and the risk register. Confirm notification requirements for each jurisdiction with legal counsel.

• Stop or hold the transaction where a control has been bypassed or fraud is suspected.
• Physical injury or immediate danger: call local emergency services first, then notify the site safety lead.
• Data disclosure: notify the privacy officer immediately so that any legal notification obligations can be assessed within the timeframes that apply.
• Do not delete messages or alter records. Preserve everything relevant.
• Record each incident in the incident register with facts, actions taken and a named owner.

Implementation checklist

• Confirm every purchase, price change and payment has a documented approval within your authority.
• Verify any supplier bank detail change through a known independent contact before processing.
• Check that the person who creates, approves and pays a transaction is not the same person.
• Screen new suppliers and customers against applicable restricted party lists before committing.
• Share commercial and personal data only through approved, access-controlled systems.
• Record gifts and hospitality offers in the company register and refuse any that could influence decisions.
• Report suspected fraud, data disclosure or control bypass to the designated contact the same working day.
• Preserve emails, invoices and system logs, and do not alter or delete them.
• Complete required training and confirm your system access matches your current role.
• Raise any unclear legal or compliance question with qualified advisers before acting.