Blog · Controls and audit

How to write a purchasing policy for a small business

Published 8 October 2026 · 5 min read

A purchasing policy says who may spend the business’s money, up to what amount, and what has to happen first. For a business of 10 to 200 people it should fit on two pages: scope, who may commit the business, approval limits, quotes, suppliers, conflicts of interest, PO numbers on invoices, receiving and paying, exceptions and a review date. Write it in an afternoon, agree it with the people who approve, then enforce the limits at the moment someone commits to a supplier, not in a review months later.

What a purchasing policy is for

Most purchases in a growing business are sensible. The policy exists for the few that aren’t, and so that a new manager knows the rules without asking around. It replaces “check with Sam first” with something written down that everyone can see.

Keep it to two pages, not twenty. A long policy doesn’t get read. Leave procedures out: how to fill in a form or where to file a quote belongs in a separate how-to. The policy says what is allowed, who decides, and up to how much.

The outline to copy

Ten short sections cover it. Each can be a single paragraph.

• Scope. Which entities, branches and kinds of spending it covers, and what it doesn’t, such as payroll, tax payments or transfers between your own companies.
• Who may commit the business. Only named roles may place an order or agree terms with a supplier. Everyone else raises a request first.
• Approval limits. An amount for each role, measured on the total excluding tax, so the same purchase gets the same answer whatever tax applies. Say who decides above the top limit.
• Quotes. When a quote is needed and how many. This is your own choice: a common pattern is one written quote above a modest amount and three for larger purchases. Funders, grant bodies and auditors often ask to see quotes, so check what yours expect before you set the numbers.
• Approved suppliers and once-off suppliers. Buy from the approved list first. A once-off supplier is allowed with a reason and the same approval; a supplier used repeatedly goes through onboarding.
• Conflicts of interest. Anyone with a personal or financial link to a supplier says so before the request goes forward, and takes no part in approving it. Nobody approves their own request.
• Purchase order numbers on invoices. Every supplier invoice must quote a PO number. An invoice without one goes back to the supplier or to the person who placed the order.
• Receiving and paying. Who confirms the goods or service arrived, and who pays. Where you have the people, neither is the person who ordered.
• Exceptions and emergencies. What counts as an emergency, who may authorise one, and that a request is raised afterwards within a set number of working days.
• Review date. Who owns the policy and when it is next reviewed, at least once a year.

Each section and the question it answers

If a section doesn’t answer its question in a sentence or two, it needs rewriting.

How to write and adopt it

Start from what already happens, not from a template. Allow a few hours over a couple of weeks.

1. Pull the last three months of supplier invoices. For each, note who ordered it and who agreed it. That is your current policy in practice; write down the gaps.
2. Name roles, not people: requester, approver, finance, owner. People change jobs; roles in the policy don’t.
3. Set an approval limit for each role on the total excluding tax. Start from what approvers already sign off today and round to figures people will remember.
4. Decide your quote rule and write the reason next to it, so nobody treats it as paperwork for its own sake.
5. Draft the ten sections on two pages. If a section runs past a paragraph, it is probably a procedure; move it to a separate how-to.
6. Review the draft with two or three approvers and whoever pays suppliers. Ask which of last month’s purchases would have gone differently under it.
7. Have the owner or the board adopt it, record the date, and put the review date in the calendar.
8. Tell your regular suppliers that from a stated date, invoices without a PO number will be sent back.
9. Give the team a short briefing: where to raise a request, what the limits are, and what to do in an emergency.

How to make it stick

A policy checked in a quarterly review only tells you what went wrong after the money was committed. Control works at the moment of commitment: before the order reaches the supplier. If an order can’t leave without the right approval, the limits enforce themselves and nobody has to police them.

That means the policy has to live where purchases are raised, not in a shared folder. In practice:

• Route each request by its amount excluding tax, so the approver is decided by the rule rather than by who happens to be nearby.
• Make it impossible for someone to approve their own request.
• Show the approved supplier list where requests are raised, so the easy choice is the approved one.
• Record each decision with a name and a time, so the review checks a record instead of memories.
• Review exceptions and emergency purchases monthly. If the same one keeps coming up, change the policy rather than living with the workaround.

Common mistakes

Most failed policies fail the same way.

• In a VAT-registered business, limits that include tax, so the same purchase needs a different approver depending on the supplier’s tax position.
• One person who can raise, approve and pay for the same purchase.
• No emergency route, so people learn to go around the policy altogether.
• No review date, so the limits drift out of step with prices and the business.

Questions

Does a small business need a written purchasing policy?

Once more than a handful of people can buy things, yes. Without one, the rules live in a few people’s heads, new managers guess, and nobody can show afterwards who agreed a purchase. Two pages is enough.

How many quotes should a purchasing policy require?

There is no single right number; it is the organisation’s own choice. A common pattern is one quote above a modest amount and three for larger purchases. If you have funders, grant conditions or an auditor, check what they expect and set your rule to meet it.

Should approval limits include VAT?

Many businesses set limits on the amount excluding tax, so the same purchase needs the same approval whether or not the supplier charges VAT. Whatever you choose, say it in the policy so nobody has to guess.

How often should a purchasing policy be reviewed?

At least once a year, and whenever the business changes shape: a new entity, a new branch or a big change in what you buy. Put the date in the policy and name who owns the review.

Who should approve the purchasing policy?

Usually the owner, the directors or the board: whoever is accountable for the business’s money. Record the date it was adopted so everyone knows which version applies.