How to Set Purchasing Controls for a Small Team

Three kinds of purchase, three kinds of control

Purchasing controls tend to work poorly when a business tries to apply one set of rules to everything it buys, because 'buying' actually covers three quite different situations that need different handling. There's routine, recurring purchasing from known suppliers — materials, stationery, standard services — where speed matters more than scrutiny once the supplier relationship itself has been checked. There's recurring subscriptions, which are easy to start and easy to forget, and which quietly accumulate cost over time if nobody is specifically watching them. And there's one-off or unusual purchases, which need the scrutiny your approval thresholds already provide.

Splitting these three out, rather than running one generic purchasing process, lets you be fast where speed is safe and careful where carelessness is expensive. Most of the frustration small teams have with purchasing controls comes from treating every purchase as if it needs the same level of scrutiny as the largest one you've ever made.

Building a preferred-supplier list

A short preferred-supplier list is one of the simplest purchasing controls available, and it solves a problem most small teams don't notice until it's already cost them money: without one, different people buying the same category of item over time will naturally drift towards different suppliers, at different prices, with different payment terms, none of which anyone is comparing.

Build the list by identifying your handful of recurring purchase categories — materials, common supplies, standard services — and agreeing, deliberately rather than by habit, which supplier is the default for each. This doesn't need to be exclusive; it's reasonable to allow a second option for when the first is unavailable, but the point is that someone made an active choice rather than the list forming itself by accident.

Do a basic check on any new supplier before adding them to the list — confirm their company details are genuine, check their payment and bank details independently rather than trusting whatever appears on an invoice, and get terms in writing even for a small, ongoing relationship. This is proportionate diligence for a small business, not the scale of check a large procurement team would run, but it's still worth doing properly rather than skipping because the supplier seems fine.

1. List your recurring purchase categories.
2. Choose a default supplier for each, deliberately rather than by habit.
3. Verify new suppliers' company and payment details independently before adding them.
4. Get basic terms in writing, even informally.
5. Share the list with anyone who buys on the business's behalf.

Subscriptions: the category that drifts silently

Recurring subscriptions are, in almost every small business that hasn't specifically controlled them, the category where cost creeps up fastest without anyone deciding it should. A subscription is easy to start — often a single click during a free trial — and easy to forget, because unlike a one-off purchase it doesn't require a new decision each time it renews. The result, over a year or two, is often a list of subscriptions considerably longer and more expensive than anyone would have chosen if asked to build it from scratch.

The fix is not to ban subscriptions but to give the category a named owner and a fixed audit date, the same way you would for any other recurring cost. The owner's job is to hold a current list of every active subscription, what it costs, who requested it, and whether it's still genuinely in use — reviewed at least twice a year, ideally quarterly for a fast-growing team.

During the audit, the test for each subscription should be simple: is someone actively using this, and would we sign up for it again today at its current price if we were starting from scratch. Anything that fails either test is a strong candidate to cancel, and it's worth being honest that most small businesses find at least one subscription during their first proper audit that nobody remembers actively choosing.

If you can't name, right now, everyone using a subscription your business currently pays for, you're overdue for a subscription audit.

One-off purchases: let your existing thresholds do the work

One-off or unusual purchases don't need a separate purchasing process invented specifically for them — they should simply follow whatever approval thresholds your general spending policy already sets. If a purchase falls within the no-approval band, it goes ahead without extra process; if it's above that, it follows the approval route you've already agreed. Building a bespoke purchasing procedure on top of thresholds you've already set just creates two systems to remember instead of one.

The one addition worth making for one-off purchases specifically is a brief note of the business reason, even a single sentence, attached to the purchase record. This matters more for one-off spend than for routine recurring buying, because a one-off purchase is exactly the kind of thing that's hard to reconstruct months later if a question comes up and nobody wrote down why it happened.

Payee verification: a small but real check

Before paying any supplier for the first time, or when a supplier's bank details change, verify the details independently rather than relying solely on what's printed on an invoice or emailed to you — invoice and payment detail fraud, including cases where a genuine supplier's email is compromised and altered bank details are sent through what looks like a normal invoice, is a real and growing risk for small businesses, and it is entirely preventable with a short check.

The check itself doesn't need to be elaborate: call the supplier on a number you already have on file, not one taken from the email in question, and confirm the bank details verbally before paying anything to a new or changed account. This single habit, applied consistently, closes off one of the more common ways small businesses lose money to fraud.

Keeping purchasing controls proportionate

The risk with any purchasing control system is over-engineering it for a team that doesn't yet need the complexity — a ten-step purchase order process makes sense for a business processing hundreds of purchase orders a month, and makes no sense at all for a five-person team buying a modest, predictable set of things. Match the weight of the control to the actual volume and risk of what you're buying, and be willing to simplify a process that's clearly slowing routine work down without adding real protection.

A useful test is to ask, for any control you're considering adding, what specific problem it would have caught in the last six months of your actual purchasing history. If you can't point to a real example, it's reasonable to hold off adding the control until you can, rather than building process against a risk that hasn't actually shown up yet.

Reviewing the whole system periodically

Set one fixed date each year — the same time as your general spending policy review is a sensible anchor — to look at all three categories together: is the preferred-supplier list still accurate, has the subscription audit actually been happening on schedule, and are the approval thresholds for one-off purchases still set at the right level given how the business has grown. Doing this review at a fixed point, rather than waiting for something to prompt it, is what keeps purchasing controls credible over time rather than becoming a document that was accurate once and has quietly gone stale.