What a procurement internal audit should test now the Procurement Act 2023 is in force

A procurement internal audit now needs to test more than whether quotes were obtained and purchase orders approved. The Procurement Act 2023 has applied to procurements started on or after 24 February 2025 in England, Wales and Northern Ireland. A useful audit should test 6 things:

• Whether your policies and financial thresholds reflect the Act and the revised thresholds from 1 January 2026
• Whether the required notices are published on the Central Digital Platform on time
• Whether conflicts of interest are assessed and recorded for each procurement
• Whether exclusion and debarment checks are carried out and evidenced
• Whether contracts worth more than £5 million have at least 3 KPIs that are monitored and reported
• Whether undisputed invoices are paid within 30 days and payment reporting is accurate

The biggest risks usually sit after contract award, not before it, so a good audit gives contract management as much attention as tendering.

That’s the core of it. Below, we set out what each area involves, the evidence an auditor should ask for, and the findings we would expect to see in organisations still adjusting to the new regime.

Why the Act changes the scope of a procurement audit

The Procurement Act 2023 replaced the Public Contracts Regulations 2015 and related regimes for new procurements. It introduced new procedures, a single online platform for notices, tougher transparency requirements and much more focus on what happens after a contract is signed.

That shift matters for internal audit. Under the old rules, many procurement reviews concentrated on the tender process: was the opportunity advertised, were bids evaluated fairly, was the decision documented? Those questions still matter. But the Act now places legal duties on contracting authorities throughout the life of a contract, including publishing KPI performance, payment data and contract changes.

Contracts let under the old regulations generally continue under those rules. So for several years, most organisations will run 2 regimes side by side. An audit that tests only one of them will miss half the picture.

The thresholds that decide which rules apply

The financial thresholds were revised for procurements starting on or after 1 January 2026, and they are inclusive of VAT. Your contract standing orders, scheme of delegation and procurement templates should reflect them.

The thresholds fell slightly from their previous levels, so more contracts are now caught. We often see organisations update the headline figures in a policy but leave old values in tender templates, approval forms or e-procurement system rules. An auditor should test all 3.

Below-threshold contracts still carry obligations. Where a notifiable below-threshold contract is awarded, generally above £12,000 for central government and £30,000 for other contracting authorities including VAT, a contract details notice is required.

What to test: the core control areas

The table below sets out the main areas a procurement internal audit should cover under the Act, with the kind of evidence auditors should expect to see.

The government’s Procurement Act 2023 guidance documents set out each duty in more detail and are a sensible reference point for building an audit programme.

Conflicts of interest are now a documented duty

Contracting authorities must identify and manage conflicts of interest, and prepare a conflicts assessment before publishing a tender notice or transparency notice. That assessment must be kept under review throughout the procurement.

The auditor’s question is whether this happens in substance, not just on paper. Signed declarations collected once a year don’t meet the test on their own.

Testing should check that:

• Everyone involved in the procurement, including evaluators and approvers, has declared any interests
• The conflicts assessment was completed before the relevant notice was published
• Any declared conflicts led to a clear mitigation, such as removing someone from the evaluation panel
• The assessment was revisited when the panel changed or new information emerged
• Board members and senior officers with approval rights were included, not just the procurement team

In our experience reviewing governance across public and private sector organisations, conflicts processes often work well inside the procurement team but stop at the point of senior approval. That’s precisely where the risk tends to sit.

Exclusions, debarment and supplier due diligence

The Act sets out mandatory and discretionary exclusion grounds and introduces a central debarment list. Contracting authorities must consider whether suppliers, and in some cases their subcontractors or associated persons, are excluded or excludable.

An audit should test whether those checks are carried out for each relevant procurement, whether the outcome is recorded and whether decisions to proceed despite discretionary grounds were properly reasoned. It’s also worth checking whether anyone looks at supplier financial resilience. A key supplier in financial difficulty is a delivery risk long before it becomes a legal one. Where an audit highlights that kind of exposure, business recovery and restructuring specialists can help assess the position and the options.

Award decisions and assessment summaries

Before a contract is awarded, each supplier that submitted an assessed tender must receive an assessment summary explaining how their tender was evaluated against the award criteria. A standstill period, typically 8 working days, usually follows the contract award notice before the contract can be entered into.

Testing should confirm that evaluation followed the published criteria, scoring was moderated and documented, and summaries were issued before the award notice. Weak evaluation records are one of the most common reasons decisions are challenged.

Transparency: the notices that are easy to miss

The Act requires a series of notices on the Central Digital Platform throughout the procurement lifecycle. They include tender notices, contract award notices, contract details notices, contract change notices and contract termination notices. Some also have tight deadlines. For example, a contract details notice is generally due within 30 days of entering into the contract.

An auditor should maintain a sample of contracts and trace each one through the notices it should have generated. Missing contract change and termination notices are a typical finding, because those events happen during contract management, often outside the procurement team’s view.

Further transparency duties have been commenced since January 2026, including payments compliance notices and contract performance notices. The government’s summary of new legislative requirements explains the commencement dates.

These duties do not all apply in the same way across the UK. The duty to publish details of payments above £30,000 does not apply to transferred Northern Ireland contracting authorities, for example. Northern Ireland bodies should confirm exactly how each requirement applies to them, alongside any procurement policy notes issued by the Department of Finance.

Contract management, KPIs and performance notices

This is where the Act moves furthest from the old regime. For public contracts worth more than £5 million, contracting authorities must generally set at least 3 KPIs. Performance against those KPIs must be assessed and published at least once a year in a contract performance notice. Notices may also be required where a supplier breaches a contract or fails to perform to the required standard and doesn’t improve after being given the opportunity.

An audit should test whether:

• Qualifying contracts have at least 3 KPIs that are relevant and measurable
• Performance data comes from reliable sources rather than supplier self-reporting alone
• Assessments are completed and published on time
• Poor performance is escalated and recorded consistently
• Contract managers understand that their records may be published

We often see contract management treated as an administrative afterthought, owned by whoever happens to use the service. Under the Act, that approach creates both a compliance risk and a reputational one.

Paying suppliers within 30 days

Public contracts carry an implied term that undisputed invoices are paid within 30 days, and that requirement flows down the supply chain to subcontracts. Contracting authorities in scope must also publish payments compliance notices showing how promptly they pay.

Testing should cover the accuracy of invoice receipt dates, the way disputed invoices are recorded and the reliability of the data used for reporting. Payment reports are only as good as the dates captured in the finance system. If invoices sit unregistered in an inbox for a week, the reported figures won’t reflect reality.

Prompt payment matters to suppliers too. If you supply the public sector and rely on those payments, strong invoicing and cash flow processes help. Our SME business solutions team supports suppliers with exactly that.

Procurement fraud and red flags

A procurement audit isn’t a fraud investigation, but it should be alert to the warning signs. Common indicators include:

• Repeated awards just below approval thresholds
• Unusual single-supplier patterns
• Contract modifications that steadily increase value without clear justification
• Suppliers that share addresses or bank details with staff

Our guide to the early warning signs of employee fraud covers some of the behavioural indicators. Where an internal audit finds something that needs deeper investigation, it’s usually better to bring in forensic accounting and fraud investigation specialists. That keeps the original review focused while preserving evidence properly.

Larger organisations should also consider the failure to prevent fraud offence, which has applied since 1 September 2025. Our article on the failure to prevent fraud offence explains why smaller organisations in public sector supply chains may still be affected.

Grant-funded and not-for-profit organisations

Not every organisation buying with public money is a contracting authority under the Act. Many charities, community organisations and businesses receiving grant funding must still follow procurement conditions set by their funders. These conditions often require competitive quotes or tenders above set values.

Internal audit can test whether those conditions are understood and followed, because a breach can lead to funding being clawed back. Our guide to your first internal audit as a grant-funded organisation explains what to expect. Where grant expenditure also needs to be reflected in statutory reporting, your external audit team will want to see that funding conditions have been met.

If your organisation develops new products or processes for public sector clients, it may also be worth checking whether the work qualifies for R&D tax relief. Innovation projects in public sector supply chains are easy to overlook as a source of relief.

How to scope the audit so it adds value

A procurement audit that tries to test everything in one go tends to produce long reports and little change. A risk-based approach works better. Focus on high-value contracts, direct awards, contract modifications and areas where the Act has introduced new duties, then sample enough lower-value activity to test whether controls hold across the organisation.

Internal audit in the UK public sector now works to the Global Internal Audit Standards, which emphasise risk-based planning and clear, actionable reporting. Recommendations should be specific, owned and time-bound, with follow-up to check they’ve been implemented.

Frequently asked questions

What is a procurement internal audit?

A procurement internal audit is an independent review of how an organisation plans, buys and manages goods, services and works. It tests whether controls are designed properly, work in practice and comply with relevant law and policy. Under the Procurement Act 2023, that includes transparency notices, conflicts assessments, KPIs and prompt payment.

Does the Procurement Act 2023 apply in Northern Ireland?

Yes. The Act applies to procurements by contracting authorities in England, Wales and Northern Ireland that started on or after 24 February 2025. Some transparency duties apply differently to transferred Northern Ireland contracting authorities, so NI bodies should check each requirement alongside guidance from the Department of Finance.

How often should procurement be audited?

There is no fixed rule, but most public bodies include procurement in their risk-based internal audit plan regularly, given the money and risk involved. Major changes, such as a new procurement regime, revised thresholds or significant new contracts, are good triggers for a review sooner than planned.

What are the most common procurement audit findings?

Common findings include outdated policies and templates, missing or late notices, conflicts of interest declared but not assessed, weak evaluation records, contract changes made without proper approval, and poor contract management. Under the Act, missing KPI reporting and inaccurate payment data are increasingly likely to feature too.

Get independent assurance over your procurement

The Procurement Act 2023 has changed what good procurement looks like, and many organisations are still working through the detail. An independent review can show where your controls are strong, where they need work and what to fix first.

SCC provides outsourced, co-sourced and targeted reviews for public and private sector organisations across Northern Ireland, Ireland and the UK. Speak to our internal audit services team to scope a procurement review around your risks, contracts and reporting obligations.