How to Set Up a Simple Purchasing Process for a Small Business

In a young business, purchasing is simple: the founder buys what is needed with a company card. As the team grows, that simplicity turns into a problem. Several people buy software and services, nobody knows the full list of commitments, renewals arrive unannounced and the same tool is paid for twice. A purchasing process fixes this. It does not need to be bureaucratic. A few clear rules, applied consistently, give you control without slowing anyone down.

Purchasing and procurement: the difference

• Purchasing is the transaction: requesting, ordering, receiving and paying.
• Procurement is the wider discipline: understanding needs, selecting suppliers, negotiating terms, managing contracts and reviewing supplier performance.

A small business does not need a procurement department, but it does need the procurement mindset: buy deliberately, record commitments and review them.

Why it matters, especially for software

Software has become one of the fastest growing and least controlled categories of spend:

Subscriptions are easy to start, renew automatically and are often bought by individuals on cards. Without a process, nobody sees the total until it is a problem.

The four building blocks

1. Spending thresholds and approvals

Thresholds keep small purchases fast and give large ones a second look. Set them for your business size and cash flow. An example policy for a business of 20 to 50 people:

Measure software by the annual commitment, not the monthly price, because a modest monthly fee becomes a significant annual contract.

2. An approved supplier list

Keep a short list of suppliers you have checked and agreed terms with, for common categories such as software, IT equipment, contractors, marketing services and office supplies. Buying from the list should be the easy path. Adding a new supplier should require a few basic checks: legal entity, payment details verified, terms agreed and, for critical suppliers, a security and risk review.

3. A single register of commitments

Every recurring commitment goes in one register, which can be a spreadsheet at first. For each entry, record:

• Supplier and product.
• Business owner (a named person, not a team).
• Cost, billing frequency and payment method.
• Start date, renewal date and notice period.
• Number of seats or units, and who uses them.
• Where the contract is stored.
• Whether it handles personal or confidential data.

The register is the foundation for everything else: budgeting, renewal reviews and security.

4. A regular spend review

Once a quarter, finance and budget owners review the register and the accounting data together:

1. Are there purchases or subscriptions missing from the register?
2. Which renewals fall in the next 90 days, and what is the decision for each?
3. Are any tools duplicating each other?
4. Are seats being used, or should they be reduced?
5. Did any supplier miss expectations on quality, delivery or support?

Step by step: setting it up in a month

Week 1: Find what you already buy. Export 12 months of transactions from your accounting software and card statements. List every supplier and every recurring charge.

Week 2: Build the register and assign owners. Put every recurring commitment in the register. Assign each one a named owner. Anything nobody claims is a candidate for cancellation.

Week 3: Write the policy. One page: thresholds, who approves, the approved supplier list, how to request something new and how renewals are handled. Keep the language plain.

Week 4: Set up the workflow. Use the tools you already have: approval features in your accounting or expense software, a simple request form and calendar reminders for renewals. Announce the policy and explain why it exists.

Managing supplier risk proportionately

Not every supplier deserves the same scrutiny. NIST's Cybersecurity Framework 2.0 includes a supply chain risk management category, and its quick start guide on the subject encourages organizations to know their suppliers and prioritize them by how critical they are. For a small business, three tiers are enough:

If a supplier processes personal data on your behalf and you are subject to the GDPR, Article 28 requires a contract that sets out the subject matter, duration, nature and purpose of the processing, among other things. Most software vendors publish a standard data processing agreement; store it with the contract.

Software subscriptions deserve their own rules

Because software is easy to start and hard to see, add a few specific rules:

1. No new paid tool without checking the register, in case something similar is already paid for.
2. Company accounts, not personal ones, so access can be removed when someone leaves.
3. Annual review of seats before each renewal.
4. Owners confirm renewals at least 30 days before the notice deadline.
5. Offboarding includes software: when someone leaves, their seats are removed or reassigned.

Our SaaS negotiation playbook explains how to use renewal reviews to lower cost.

Do you need procurement software?

Start with what you have. Accounting software with bill approvals, an expense tool with card controls and a well kept register cover most small businesses. Consider dedicated procurement, spend management or SaaS management tools when:

• More than a handful of people buy regularly.
• You have dozens of subscriptions and lose track of renewals.
• You need purchase orders matched to invoices and deliveries.
• Audit or investor requirements call for stronger controls.

If you do buy one, evaluate it like any other software, using our vendor evaluation guide and a three year total cost of ownership.

Measuring whether the process works

Track a few indicators each quarter:

• Share of spend with suppliers on the approved list.
• Share of subscriptions in the register with an owner and renewal date.
• Number of renewals reviewed before the notice deadline.
• Savings from removed seats, cancelled duplicates and negotiated terms.
• Time from request to approval, to make sure the process is not slowing the business.

A sample one page purchasing policy

Adapt this template to your business.

Purpose. To make sure we buy what we need, at a fair price, from suppliers we trust, and that every ongoing commitment has an owner.

Scope. All purchases of goods, services and software, including free trials that convert to paid plans.

Thresholds. Purchases are approved according to the threshold table. Software is measured by its annual cost.

Suppliers. Use approved suppliers where one exists. New suppliers need finance approval and, if they will handle personal or confidential data, a security review.

Records. Every recurring commitment is recorded in the register with an owner, cost, renewal date and notice period before the first payment.

Renewals. Owners review each renewal at least 30 days before the notice deadline.

Leavers. When someone leaves, their software seats are removed or reassigned within one week.

What a purchase request should capture

A short request form, in your expense tool or a simple online form, avoids back and forth. Ask for:

• What is being bought, from whom, and why.
• Cost, billing frequency and contract length.
• Alternatives considered, including tools you already pay for.
• Budget line and owner.
• Whether personal or confidential data is involved.
• Requested start date.

Handling urgent purchases

Real emergencies happen. Allow urgent purchases with retrospective approval, but require them to be recorded within two working days and reviewed at the next quarterly spend review. If urgent purchases become frequent, the thresholds or approvers probably need adjusting.

Procurement terms in plain language

• Purchase order (PO): a document confirming what you have agreed to buy, at what price.
• Three way match: checking that the purchase order, the delivery and the invoice agree before paying.
• Approved supplier list: suppliers you have checked and agreed terms with.
• Spend under management: the share of total spend that goes through your agreed process.
• Maverick spend: purchases made outside the agreed process.
• Total cost of ownership: the full cost of buying, using and leaving a product over its life.

Worked example: what a register reveals

This illustrative example, built by the Businesslang team, shows a typical first review. A 30 person business exports 12 months of card and bank transactions and finds 46 recurring software charges totalling $7,900 per month. Building the register and assigning owners produces this picture:

Method. Monthly costs are the sums of the charges in each group. If the duplicates and unused tools are cancelled and seats on the four over provisioned tools are cut by half, monthly spend falls by about $1,500 ($720 + $480 + $300), or around $18,000 a year, before any price negotiation. The numbers will differ for your business; the pattern is common.

Rolling out the policy without friction

1. Explain the why. Share what the first review found, so people see the policy as fixing a real problem rather than adding red tape.
2. Make the right way the easy way. A simple request form and quick approvals matter more than strict rules.
3. Start with software. It is usually the least controlled and fastest growing category, and the register gives quick wins.
4. Report savings. Share what was saved after the first quarter; visible results build support.
5. Adjust after six months. If approvals are slowing work, raise the lower thresholds; if spend keeps escaping the process, find out why.

Where small businesses lose money most often

In our experts' procurement work, the same leaks appear again and again in small businesses:

• Auto renewals nobody reviewed, including tools for projects that ended long ago.
• Duplicate tools bought by different teams for the same job.
• Seats for former employees still being paid for months after they left.
• Promotional prices that quietly reset to standard prices at the first renewal.
• Supplier price increases accepted because no one compared alternatives.
• Late payment fees and lost early payment discounts caused by invoices sitting unapproved.

A register, an owner for every commitment and a quarterly review address almost all of them. None needs specialist software to fix.

Common mistakes

• Writing a long policy nobody reads.
• Setting thresholds so low that every purchase needs approval.
• Assigning tools to teams instead of named owners.
• Treating all suppliers the same, instead of focusing on critical ones.
• Building the register once and never updating it.

The lesson from procurement practice

Good procurement is not about saying no. It is about making sure each purchase has a clear purpose, a fair price, an owner and an exit. A one page policy and a well kept register give a small business most of that benefit in a month, and the habits scale as the business grows.