internal control

Internal control refers to the systematic measures an organisation implements to ensure that its activities are planned, carried out, and maintained in compliance with applicable laws and regulations. In public procurement, internal control means establishing routines and oversight mechanisms that ensure purchases follow the rules set out in national legislation and EU directives such as Directive 2014/24/EU.

How does internal control work?

The concept of internal control in procurement draws on the internationally recognised COSO framework, which defines three core objectives: effective and efficient operations, reliable reporting, and compliance with laws and regulations. These principles are embedded in EU procurement law through requirements for transparency, equal treatment, and sound procedural management.

At an organisational level, contracting authorities are expected to implement proportionate control systems based on risk assessments. This typically involves four stages: securing management commitment, mapping current practices, designing control measures, and ongoing monitoring. The level of oversight should reflect the size, complexity, and risk profile of the organisation's procurement activities.

Key elements of procurement internal control

• Authorisation framework: Clear delegation of authority with defined monetary thresholds for who can conclude contracts
• Procurement guidelines: Distinguishing between framework agreements, direct awards, and call-offs
• Risk assessments: Systematic identification of areas most vulnerable to errors or non-compliance
• Standardised processes: Templates and routines ensuring that procurement records are properly maintained and threshold values are respected
• Compliance monitoring: Verification that established routines are actually followed in practice

Weak internal control is a recurring factor behind illegal direct awards. Organisations without adequate control routines risk fines and reputational damage. Tools like Cobrief can help suppliers monitor public tender procedures, making it easier to participate in well-managed procurement processes.

Effective internal control is not a one-time exercise but a continuous process that must evolve with changes in regulation, organisation, and risk landscape. Investing in robust control systems reduces the risk of non-compliance and lays the foundation for better value in public spending.