WorkflowProcurement

The complete guide · November 2026

Procurement intake management, explained.

A scientist needs a lab, a manager needs a survey tool, and neither knows the buying policy. Procurement intake is the first step of every purchase: someone reads what the employee asked for, checks whether the company already pays for it, works out which rules apply and who signs, then follows the request to a purchase order, the document that commits the company to pay.

Read this if you ask for, route or sign purchases at a drug, biotech or device company: a head of procurement, a procurement operations lead, a category manager, an IT or finance sponsor, a legal or security reviewer, or a leader deciding whether to automate the work. No background needed.

See one case, screen by screen →
Watch with transcript →
A quick example · fictional

Imagine you are a patient advocacy manager at a mid-size biotech, Northwind Bio. It is October 7, and your patient advisory panel needs a survey tool. You liked one at a conference, Pollen Survey: about 40 seats, roughly $18,000 a year. You have no idea who to ask, so you type it in a sentence.

Pollen Survey would be a new supplier. It would need an IT security assessment, a privacy review and three quotes: four to six weeks. Your company already holds an enterprise license for Thornquill Research Cloud, renewed in April, with 312 seats nobody is using, and security approved it for panel members' personal data under assessment SA-2291. Clause 7.5 of the buying policy says unused seats come before a new tool.

As asked
Tool
New supplier
Time
4 to 6 weeks
As routed
Tool
License you own
Time
Seats tomorrow
New supplier held backYour own license, $0, no purchase order.You can still ask for Pollen Survey, and a person decides that exception.

Good intake catches what the company already pays for while the request is one sentence long, and it records the clause behind each step.

Procurement intake management guide
Part A · Understand it

Procurement intake from "I need this" to a purchase order: routes, rules, sums and people in life sciences

Why life sciences buying is harder than it looks, which rules a single request can trip, and what the published numbers do and do not show. No product appears in this part. If you are new to procurement, start here.

01 · In plain words

One place to ask, and a route from the first sentence to a purchase order: procurement intake defined

On one ordinary morning, the people at a drug company may need pipette tips, a lab to validate an assay, a writer to finish a regulatory summary, a chilled courier between a lab and a hospital, a survey tool for patients, and an exhibit for a medical congress. Most of them have never read the buying policy, and they have no reason to. They are scientists and managers with work to do.

So the request arrives however it arrives: an email to a buyer, a chat message to a colleague in finance, a form picked at random, or an invoice from a supplier who has already done the work.

A person in procurement then has to read it, ask what is missing, look for an existing contract, work out which rules apply, and type it all into the finance system as a requisition, the internal request to buy. Only after approvals does it become a purchase order, or PO, the document that commits the company to pay.

Procurement intake is the name for that first stretch. Software sellers define it in similar words. Zycus, one of them, describes intake management as a way to simplify and automate "initiating, routing, and tracking procurement requests".1 Zip, another, calls intake-to-procure a "centralized, structured process that guides purchase and supplier requests from initial intake".2 You will also hear related names: guided buying, procurement front door and procurement orchestration.

The work has one central question: what is the right way to buy this, given what we already own, what the policy says, and who has to agree? Most requests have a clear answer, if someone looks. The trouble is that the looking takes days, and the answer lives in five different places: the buying policy, the delegation of authority (the table of who may commit how much), the contract files, the register of software licenses, and the supplier master (the finance system's list of suppliers).

When nobody looks, the damage is quiet. A new supplier gets added when an agreement already covers the work. A new tool gets bought while seats sit idle. Nobody notices at the time, because the purchase itself goes through without complaint.

A survey tool's five stages, from one sentence to forty seats

  1. The employee asksIn plain words, in chat, by email or on a form, with a quote attached if there is one. In the example, a patient advocacy manager asks for a survey tool on October 7.
  2. The request is read and routedIs it a purchase at all? Is it in the catalog? Does a contract or license cover it? Only then a new supplier. This step is what this guide is about.
  3. The policy steps runQuotes, a security review, a privacy review, supplier due diligence, a statement of work, whichever the route and the value call for.
  4. People approve, in orderThe delegation of authority sets the chain from the value, apart from any small orders the policy approves automatically. Nobody approves their own request.
  5. The order goes out, and the record staysA person posts the requisition to the finance system, the PO issues, and the requester can see where it went. In the example no PO is needed: seats are assigned the next day.

This example's people, companies and figures are fictional.

Four surprises in life sciences buying: idle seats, doctors' fees, slow reviews and shrinking teams

The cheapest purchase is often none

Zylo, which sells software to manage licenses, says the average organization uses 54% of the licenses it provisions (its own 2026 index).3 That is a vendor's figure and its method is not on the page, yet the point is easy to test: ask for your own register.

Some requests are not purchases at all

A fee to a doctor follows a different process from a box of gloves. In the US it can be a reportable payment to a covered recipient under Open Payments, so it should never travel as an ordinary invoice.4

Speed is a control

The US Department of Justice (DOJ) asks whether a company's vendor review works "in a timely manner".5 A process so slow that people go around it is a weak control.

Workload rises while teams shrink

The Hackett Group projects procurement workloads up 8% in 2026 while head count and operating budgets fall.6 Re-keying email into requisitions is work a smaller team can least afford.

Buying vocabulary to learn first: requisition, delegation of authority, call-off, statement of work

Requisition

The internal request to buy, in the finance system. It becomes a purchase order after approval.

Delegation of authority

The table that says who may commit how much money. Often shortened to DoA.

Call-off

An order placed under an existing agreement at its agreed prices, with no new competition.

Statement of work

A SOW sets out deliverables, milestones, acceptance criteria and price for a service.

Thirteen terms are defined in the one-page summary.

02 · Five ways to buy

Five ways to buy at a life sciences company, and the requests that are not purchases

In shortMost buying policies name a fixed order: the catalog, then an existing contract or license, and only then a new supplier, a sourcing event or a new statement of work. Each route triggers its own checks and its own clock. An employee cannot be expected to know which applies. Sorting the request correctly in the first hour decides whether it takes minutes or weeks.

The order matters because each step down costs more. A catalog item has a negotiated price and needs almost no judgment. An existing contract was already competed and already passed legal review, so an order under it borrows that work. A new supplier means sanctions screening, a questionnaire, bank verification, perhaps a financial review, and often a security assessment. The exact routes differ by company, but their logic rarely does.

RouteTypical purchaseWhat it borrows or owesWho usually runs it
CatalogPipette tips, gloves, plates, laptops of a standard modelBorrows negotiated prices. A policy may approve small orders automatically within budgetThe requester
Existing contract or licenseAssay validation on a rate card, a congress exhibit under a framework, unused software seatsBorrows an earlier competition and legal review. Check the scope, the term and the data termsBuyer or license owner
New supplierA local courier, a specialist auditor, new softwareOwes due diligence, bank verification, set-up, often security and privacy reviewsProcurement operations, with reviewers
Sourcing eventA large custom synthesis, a multi-year serviceOwes a formal competition, or a written sole-source justificationCategory manager
Statement of workMedical writing, consulting, market researchOwes deliverables, milestones and acceptance terms, usually under a master agreement, a contract that sets terms for later ordersCategory manager and legal
Not a purchaseFees to doctors, grants, donations, sponsorships, travelLeaves procurement for its own process and its own reportingHCP engagement, grants or travel team

HCP means healthcare professional. A category manager is the buyer who owns one kind of spend, such as research services. The table is our summary of common practice; your policy sets your routes.

Every route past the catalog adds checks, and a sourcing event carries the most

Which checks a route commonly triggers, on a typical buying policy

RarelyBy value or dataUsuallyAlways
QuotesDue diligenceSecurityPrivacyLegalSign-offCatalogRarelyRarelyRarelyRarelyRarelyRarelyContract or licenseRarelyRarelyBy value or dataBy value or dataRarelyBy value or dataNew supplierBy value or dataAlwaysBy value or dataBy value or dataBy value or dataBy value or dataSourcing eventAlwaysUsuallyBy value or dataBy value or dataUsuallyAlwaysStatement of workBy value or dataBy value or dataBy value or dataBy value or dataAlwaysBy value or data

Illustrative · replace with your own numbers · An illustration of typical policy, for orientation. Write your own policy into this grid: where a cell surprises your team, you have found a training gap or a policy gap.

Show the numbers
QuotesDue diligenceSecurityPrivacyLegalSign-off
CatalogRarelyRarelyRarelyRarelyRarelyRarely
Contract or licenseRarelyRarelyBy value or dataBy value or dataRarelyBy value or data
New supplierBy value or dataAlwaysBy value or dataBy value or dataBy value or dataBy value or data
Sourcing eventAlwaysUsuallyBy value or dataBy value or dataUsuallyAlways
Statement of workBy value or dataBy value or dataBy value or dataBy value or dataAlwaysBy value or data

Why "do we already own it?" comes before any quote or review

A review that runs in the wrong order wastes everyone's week. If security assesses a tool before anyone checks the license register, the assessment may be for a purchase nobody needs. If a buyer collects three quotes before anyone notices the request is a fee to a doctor, the quotes are wasted and the request is in the wrong process.

So the first question is always whether it is a purchase at all, and the second is whether you already own it. Only then do thresholds and reviews matter. Getting this order right costs nothing and removes whole steps.

03 · Why life sciences differs

Lab services, coded samples and doctors' fees: what makes buying harder at a drug company

In shortThree things separate life sciences buying from a general office budget. Much of the spend is research services, priced on rate cards (schedules of agreed prices) and hard to compare. Some suppliers touch regulated work, so the buyer stays responsible for them. And some requests carry patient data or involve doctors. A request form cannot see any of that; someone has to ask the right question at the start.

Suppliers whose work ends up in a regulated record

A drug manufacturer stays answerable for what it buys. Under US good manufacturing practice (GMP), a supplier's report of analysis can stand in for most testing of a component only if the manufacturer runs at least one specific identity test and "establishes the reliability of the supplier's analyses" through validation at intervals.7 The quality unit also answers for products made under contract by another company.8

ICH Q10, the global guideline on pharmaceutical quality systems, puts it in one line: the company "is ultimately responsible" for having processes that assure the control of outsourced activities and the quality of purchased materials.9 The EU GMP guide adds that before outsourcing, the company is responsible for assessing "the legality, suitability and the competence" of the other party.10 FDA's 2016 guidance on quality agreements says the same of contract manufacturing: the owner remains responsible for its products, whoever makes or tests them.11

Clinical trials work the same way. ICH E6(R3), the global guideline on good clinical practice, in effect in the EU since July 23, 2025, says the sponsor, the company running the trial, is responsible for "assessing the suitability of and selecting the service provider", and that agreements should be documented before activities begin.12

Device makers have their own version: FDA's Quality Management System Regulation, effective February 2, 2026, removed Subparts C through O of the old Part 820, and with them the purchasing controls at 21 CFR 820.50. It brings in ISO 13485, the international standard for device quality systems, whose clause 7.4 has a company evaluate suppliers in proportion to the effect and risk of what they supply.13

What this means for intake: "just use this lab" is rarely a simple request. A lab already qualified under a master agreement carries different risk from one a scientist found at a conference, even at a lower price. That is one reason buying policies push requests toward what has already been checked.

Testing and approving incoming materials drew 161 FDA citations in fiscal 2025, among the larger sections of Part 211

Our count of citations by section of 21 CFR Part 211, six of 47 sections, out of 2,608 in all

211.22 Quality control unit309
211.192 Production record review236
211.67 Equipment cleaning204
211.100 Written procedures201
211.160 Laboratory controls176
211.84 Testing incoming components161

Source 14 · Our count: we added FDA's frequency column for every row on its Drugs sheet that cites a section of Part 211, and read the 15 rows for 211.84 by hand. FDA's table leaves out Form 483s prepared by hand, so the count does not cover those. A citation is an inspector's observation, and most concern a plant's own controls. A purchase route alone does not cure any of them.

Show the numbers
ItemValue
211.22 Quality control unit309
211.192 Production record review236
211.67 Equipment cleaning204
211.100 Written procedures201
211.160 Laboratory controls176
211.84 Testing incoming components161

Requests that carry patient data, and how little it takes

A survey tool that holds names and emails of a patient panel is software holding personal data. A blood sample labeled with a code in place of the patient's name can carry personal data too. Four points of EU law shape the review such a request needs, and the answer can depend on who holds the data, so ask your privacy team.

Coded data can still be personal

Data from coded blood samples sent to a lab can still be personal data under the EU's GDPR, whose Recital 26 says data that has been pseudonymized and can be attributed to a person using additional information is information on an identifiable person.15

Who holds the code key matters

In EDPS v SRB (September 4, 2025), on the parallel rules for EU institutions, the Court of Justice said pseudonymized data is not personal data in all cases and for every person.16 The company that holds the code key is in a different position from a lab that cannot identify anyone.

Outside firms must offer guarantees

GDPR Article 28 lets a controller, the organization deciding how data is used, use "only processors providing sufficient guarantees". Processors are the outside firms handling the data for it. So a privacy review and a data-transfer agreement often stand between a request and a purchase.15

US transfers are still in court

Transfers to the US can rest on the EU-US Data Privacy Framework, which is still being tested in court: the appeal against it, Case C-703/25 P, was still pending when this guide was written.17

Payments to doctors that must not travel as purchases

Under the US Open Payments program, an applicable manufacturer, broadly a maker of a covered drug, device, biological or medical supply, reports payments and other transfers of value to covered recipients, such as doctors and teaching hospitals, to the Centers for Medicare & Medicaid Services (CMS) each year.4 Penalties are civil and set per item, at 2025 levels that the Department of Health and Human Services (HHS) left unchanged for 2026.18

An item not reported

$1,443 to $14,432 per item, up to $216,490.18

A knowing failure to report

$14,432 to $144,329 per item, up to $1,443,275.18

A $1.55 million recovery

In August 2026 the Justice Department announced this civil penalty against one company, which allegedly "knowingly failed to report", and called it "the largest Sunshine Act recovery since the law was passed in 2010". The Justice Department uses "Sunshine Act" as another name for Open Payments.19

Speaker programs carry their own warning: the HHS Office of Inspector General issued a Special Fraud Alert on them in November 2020.20

Judging those payments belongs to compliance. Procurement's job is to spot the request early and hand it over, with the details filled in so the employee does not start again.

04 · The rules in 2026

The rules one purchase request can trip in November 2026: GxP, BIOSECURE, DOJ's data rule, Open Payments and SOX

In shortNo law governs procurement intake as such. Each request may fall under rules owned by other teams: quality (GxP, the good-practice rules for manufacturing, labs and trials), privacy, compliance, finance and national security. Two of them are new. BIOSECURE, which limits federal money going to certain biotechnology companies, became law in December 2025, with its limits still to start. DOJ's data rule took full effect in October 2025. Intake is where those rules first meet a purchase, so it is the cheapest place to ask the question.

Five rule changes since 2025 reach purchase requests at drug and device makers
  1. Apr 8, 2025DOJ data rule in effect

    Vendor agreements with covered persons can be restricted transactions.

  2. Jul 23, 2025ICH E6(R3) in the EU

    Sponsors assess and oversee service providers.

  3. Oct 6, 2025DOJ due diligence and audit

    Parts of the data rule follow.

  4. Dec 18, 2025BIOSECURE enacted

    Public Law 119-60, section 851. Its limits start after a later rule change.

  5. Feb 2, 2026FDA QMSR in effect

    ISO 13485 supplier controls for device makers.

Source 21,12,22,13,23

Show the numbers
WhenWhat
Apr 8, 2025DOJ data rule in effect
Jul 23, 2025ICH E6(R3) in the EU
Oct 6, 2025DOJ due diligence and audit
Dec 18, 2025BIOSECURE enacted
Feb 2, 2026FDA QMSR in effect
Dec 2026OMB list due
Dec 2, 2027EU AI Act Annex III rules

BIOSECURE reaches federal contractors and grantees, and a private purchase can touch it

BIOSECURE is law: section 851 of Public Law 119-60, approved December 18, 2025. Once its limits apply, an executive agency may not buy biotechnology equipment or services from a biotechnology company of concern. Nor may it contract with an entity that uses such equipment or services in performing the federal contract, if acquired after the effective date. Loan and grant recipients face matching limits.22

The limits have not started, and they wait on the steps in the chart below. We found no published list or FAR revision on November 3, 2026. So a company with federal contracts or grants needs to know which of its purchases could feed that work. The section does not ban private buying as such. Intake is a sensible place to flag the supplier and the program, and legal decides.

BIOSECURE's limits start only after a list, guidance and a FAR revision
  1. 1The list

    The Office of Management and Budget (OMB) owes its list.

    OMBWithin one year of enactment
  2. 2The guidance

    OMB owes its guidance.

    OMBWithin 180 days after the list
  3. 3The FAR revision

    The Federal Acquisition Regulation (FAR) must be revised.

    Within a year of the guidance
  4. 4The limits start

    Timing depends on how a company came to be listed.

    60 or 90 days after the revision
  5. 5Earlier contracts

    For equipment or services under a contract signed before that date, the contractor and grantee limits wait longer.

    Five years from the revision

Our reading of the sources 22

Show the numbers
StepWhat happensWhoTime
The listThe Office of Management and Budget (OMB) owes its list.OMBWithin one year of enactment
The guidanceOMB owes its guidance.OMBWithin 180 days after the list
The FAR revisionThe Federal Acquisition Regulation (FAR) must be revised.Within a year of the guidance
The limits startTiming depends on how a company came to be listed.60 or 90 days after the revision
Earlier contractsFor equipment or services under a contract signed before that date, the contractor and grantee limits wait longer.Five years from the revision

DOJ's data rule treats some vendor agreements as restricted transactions

The rule, on access to sensitive US personal data by countries of concern, is 28 CFR Part 202. It took effect April 8, 2025, with due diligence and audit parts following on October 6, 2025.21

Its "vendor agreement" covers any agreement "in which any person provides goods or services to another person" for payment. If that vendor is a covered person, broadly a company or individual tied to a country of concern by ownership, base, employment or residence, or sits in a country of concern, and the data passes a bulk threshold, the transaction may be restricted or prohibited. The thresholds are low for this industry.

100

US persons: above this, human genomic data counts as bulk.21

28 CFR Part 202
1,000

US persons: above this, other human 'omic data, such as protein or RNA data, counts as bulk.21

28 CFR Part 202
10,000

US persons: above this, personal health data counts as bulk.21

28 CFR Part 202

Sections 202.510 and 202.511 hold exemptions, on conditions, for certain regulatory approval data and FDA-regulated clinical investigations; the rule's own examples show they do not cover every vendor arrangement.21 Ask counsel. A request for a lab or data host should prompt the question early.

Which team owns each rule, and the one question intake should ask

Rule, status November 2026What it asksWho owns itThe question at intake
21 CFR 211.84, 211.22; ICH Q10 2.7; EU GMP Chapter 7, in forceAssess, qualify and stay responsible for suppliers and contractors7,8,9,10QualityDoes this touch a GMP material or activity?
ICH E6(R3) section 3.6, in effect in the EU since July 23, 2025Assess, agree in writing and oversee service providers12Clinical qualityIs this for a clinical trial?
QMSR and ISO 13485 clause 7.4, effective February 2, 2026Evaluate suppliers in proportion to risk13Device qualityDoes it go into a device or its production?
GDPR Article 28 and transfers, in forceSufficient guarantees from processors15PrivacyWill it hold names, health data or coded samples?
28 CFR Part 202, in forceLimits on vendors that are covered persons or sit in countries of concern, above bulk thresholds21LegalWhere is the vendor, and what data reaches it?
BIOSECURE, Public Law 119-60, section 851, law since December 18, 2025; list and FAR revision pending, limits not yet startedLimits tied to federal contracts and grants22LegalDoes this feed federally funded work?
Open Payments, 42 CFR 403.904, in forceReport payments to covered recipients4ComplianceIs any of this paid to a doctor?
Sarbanes-Oxley (SOX) section 404, in force for US public companiesManagement assesses internal control over financial reporting24FinanceIs there an approved PO before the work?
DOJ compliance program guide, updated September 2024Vendor risk review integrated into "procurement and vendor management processes"5ComplianceIs this firm dealing with officials for us?

Detailed checks live with each owner: intake only needs the question that routes the request to them. Vendor security reviews and anti-bribery reviews of distributors go much deeper than intake does, and they belong to their own teams.

Who is an employee and who is a contractor: the test keeps moving

A request for "writing help" can hide a staffing question. If a person works under your direction, on your premises, for an open-ended time, labor law may treat them as your worker whatever the statement of work says.

In the US, the Department of Labor proposed on February 27, 2026 to rescind the analysis in its 2024 independent contractor rule and replace it with its 2021 analysis, with a few changes, which treats control and opportunity for profit or loss as the two core factors. Comments closed April 28, 2026, and we found no final rule on November 3, 2026, so this is still a proposal.

Since May 1, 2025 the department's own investigators have not applied the 2024 analysis, and its bulletin says the 2024 rule stays in effect for private lawsuits until further action.25

National tests differ and change, so most policies send these requests to a contingent worker process run with human resources. Intake's part is one plain question: will this person deliver something finished, or work day to day inside your team?

05 · Documents behind a route

The five records that decide a route, and why each one is usually out of date somewhere

In shortA correct route rests on a policy, a delegation of authority, a contract set, a license register and a supplier master, plus whatever the employee attached. They sit in different systems with different owners. A person who knows all five is rare and overloaded. Clean, dated records do more for routing than any clever software, so check them first.

RecordWhat it settlesWhere it goes wrong
Buying policyThe order of channels, quote thresholds, what is not a purchaseWritten for auditors, in clauses employees never read. Old versions linger on the intranet
Delegation of authorityWho signs at what value, and who may notNames change faster than the table. A reorganization leaves cost centers with no valid approver
Agreements and rate cardsWhat is already priced and competed, the term, the scope, the data schedulePDFs in folders. The rate that matters sits on a schedule, page 40. Expiry dates are not in the finance system
License registerWhich software you own, how many seats are free, which data it was cleared forHeld by IT, out of procurement's sight. The security clearance lives in another tool
Supplier masterWho is set up, with which bank account, and the purchase historyNear-name duplicates. A firm with a similar name can look like an approved supplier and be another company
The request and its attachmentsWhat is wanted, the value, the date, the named supplierA free-text email with half the facts. A quote that reads as a decision already made

Why one contract search can take a morning

Take a scientist who needs a ligand-binding assay validated: a test that measures a drug or marker in blood, validated under ICH M10, the global guideline on bioanalytical methods.26

A buyer must first translate that into the words used on a rate card. Then they must find which master agreements cover bioanalysis, open the schedules, confirm the analyte count (how many substances the test measures), check the contract is in term, check whether it was competitively sourced, check whether the data schedule allows coded samples, and see whether this supplier has run this assay before.

None of those steps is hard. Each one lives in a different document, and the buyer has twenty other requests open.

World Commerce & Contracting, a trade association, put the broader cost of weak contracting at 9.2% of contract value in 2014. Its update with Deloitte, on more than 1,200 organizations, put it at 8.6%, as reported in August 2023.27 Those figures cover far more than intake, and they are its own estimates. They still show why buyers bring agreements into the conversation from the first sentence.

06 · The sums

How thresholds, split purchases and approval chains are worked out, with the arithmetic

In shortThree calculations sit under every route: which value band a request falls in, whether requests must be added together, and who signs at that value. Each one is simple alone. The errors come from using the wrong value: the first year instead of the contract's lifetime, one invoice instead of the whole series, or the supplier's quote instead of the rate-card price.

Value bands: a sample policy's three quote rules

The figures in this section come from the guide's fictional buying policy, a realistic shape that your own will vary from.

Under $10,000

One quote.

$10,000 to $100,000

Three written quotes, or a call-off under an existing contract.

Above $100,000

A sourcing event led by procurement, or a call-off under a contract that was itself competitively sourced.

If a purchase above $100,000 is not competed, the requester files a sole-source justification, a written reason for buying without competition, and a category manager approves it.

Adding up a split purchase: two $54,000 requests make one $108,000 purchase

A team plans a patient video series of eight films and splits the budget across two quarters. Part 1 goes in on October 2 for $54,000. Part 2 goes in on October 7, also for $54,000, to the same supplier from the same cost center. Each sits comfortably under $100,000. Together they come to $108,000, and the policy adds requests to the same supplier within 30 days from the same cost center. So the purchase needs a sourcing event.

Splitting is often innocent: budgets come in quarters, and nobody meant to dodge anything. A control has to catch it either way, and asking one question separates the cases: is part 2 a separate project, or the same series?

Two requests under the line add up to one purchase over it

The fictional video series, against the sourcing line in the fictional policy

Part 1, October 2$54K
Part 2, October 7$54K
The two added together$108K
Sourcing event line$100K

Fictional example from this guide

Show the numbers
ItemValue
Part 1, October 2$54K
Part 2, October 7$54K
The two added together$108K
Sourcing event line$100K

Reading a delegation of authority: why $164,800 needs three names

The sample table gives a cost-center manager authority up to $25,000, a director from $25,001 to $150,000, a vice president from $150,001 to $500,000, a senior vice president to $2,000,000 and the CFO above that. Above $100,000, procurement signs as well. And nobody approves a request they raised, or a request for a supplier they manage. So a $164,800 assay validation runs to a budget owner, then a vice president, then a procurement sign-off. At $96,000 it would stop with a director.

A $164,800 work order passes three signatures before a person posts it
  1. 1Budget owner

    Director of the cost center agrees the spend.

    Director, Translational SciencesDay 1
  2. 2Value holder

    Above $150,000, a vice president signs.

    VP, R&D OperationsDay 1
  3. 3Procurement sign-off

    Above $100,000, procurement adds its name.

    Category managerDay 2
  4. 4Requisition posted

    A person posts it to the finance system.

    BuyerDay 2
  5. 5PO issued

    The supplier can start.

    Finance systemDay 2

Fictional example from this guide

Show the numbers
StepWhat happensWhoTime
Budget ownerDirector of the cost center agrees the spend.Director, Translational SciencesDay 1
Value holderAbove $150,000, a vice president signs.VP, R&D OperationsDay 1
Procurement sign-offAbove $100,000, procurement adds its name.Category managerDay 2
Requisition postedA person posts it to the finance system.BuyerDay 2
PO issuedThe supplier can start.Finance systemDay 2

Comparing two prices fairly: rate card against a new supplier's quote

Price is rarely the only sum. In the guide's example, the scientist's preferred lab quotes $182,400 and could start around November 24, after 15 to 25 working days of set-up. The agreement's rate card says $164,800 and a start of October 27. The difference is $17,600 and about four weeks.

Whether four weeks matter depends on the program. In published work from the Tufts Center for the Study of Drug Development, one day of delay in Phase II or III costs about $40,000 in direct trial cost. The same dataset gives about $500,000 in lost sales in the journal article and about $800,000 in its white paper.28,29 Those are averages across trials, and a lab validation does not always sit on a critical path, so ask whether yours does.

07 · Leakage and idle seats

Idle licenses and off-contract buying: what vendors' own benchmarks claim, and how to test them

In shortAlmost every published number here comes from a company selling a fix, so read each one as a claim with its date on it. They agree in direction: many licenses sit unused, a large share of spend runs outside contracts, and approvals take long. No independent life sciences figure was found. Your own register and spend file can answer the question in a week.

One vendor says only 54 of every 100 software licenses are in use
54 in 100

provisioned software licenses in use at the average organization, per Zylo's own 2026 SaaS Management Index (a seller of license management software), page updated March 19, 2026

Source 3

Show the numbers
MeasureValue
provisioned software licenses in use at the average organization, per Zylo's own 2026 SaaS Management Index (a seller of license management software), page updated March 19, 202654 of 100

Zylo says the waste comes to about $19.8 million a year at the average organization in its data.3 Its method is not on the page we read, and its customers are companies already worried about software costs.

A seat that looks idle may also be held for a reason: a pending hire, a seasonal study, or a license tier that does not fit the new need. So a free seat is a reason to ask, and fit still has to be checked. For patient data, that means asking whether the tool was cleared for that kind of data, which is why the check belongs next to the license record.

In Zip's own survey, 32% say approval takes three weeks or longer

Share of 1,056 US finance and accounting professionals, Zip's survey, reported April 1, 2025

Say securing approval takes three weeks or longer32%
Say some purchases need more than 10 approvals27.1%

Source 2 · Zip sells intake software. The same page says close to half of companies need six or more cross-functional approvals for a new software or supplier purchase. Its questions and sampling are not on the page.

Show the numbers
ItemValue
Say securing approval takes three weeks or longer32%
Say some purchases need more than 10 approvals27.1%

On off-contract buying, Zycus, another seller, cites Ardent Partners' 2025 report for the figure that "only 62.2% of enterprise spend is contract compliant".30 We could not read Ardent's report itself, so treat it as a figure passed along by an interested party. Zycus's post also says each maverick dollar, meaning money spent outside agreed contracts or channels, costs "12% to 18% more", naming no source. We leave that one out, and you should ask anyone who quotes it where it came from.

Testing the vendors' claims on your own spend in a week

The claimThe test on your own dataWho has the data
Licenses sit idleList enterprise licenses with seats bought, assigned and active in the last 90 days, then match them to new software purchases this yearIT asset management and accounts payable
Spend bypasses agreementsTake last quarter's new-supplier requests. For each, ask whether an agreement in term covered the scopeProcurement and legal
Approvals take weeksExport request date, each approval date and PO date. Report medians by routeFinance system
Work starts before a POCount invoices dated before their PO, or carrying noneAccounts payable
08 · What goes wrong

Work before a PO, a split requirement, a near-name supplier: the seven common failures in a purchase request

In shortMost failures start with a request nobody read properly: work already begun, a requirement split in two, a near-name supplier taken for an approved one, a doctor's fee sent as an invoice. Few are fraud, and each is cheap to catch at the start and expensive after the fact. Published fraud data shows why the controls exist, and a European case shows what an unreliable contractor can cost.

1. Work begins with no PO

An urgent deadline, a friendly supplier, an invoice weeks later. Many policies call this "no PO, no pay" and require someone to ratify it after the fact and report it.

2. A requirement is split

Often because budgets arrive in quarters. A threshold stops working if nobody adds the parts together.

3. A supplier nobody needed

The requester names who they know. The new record costs weeks and leaves an existing agreement underused.

4. A near-name match

Two firms with similar names, one approved. Treating them as one company puts money and data in the wrong place.

5. A fee paid as a purchase

A doctor's advisory fee on an invoice can miss the fair market value check and the transparency report.

6. Data leaves unreviewed

A small software purchase, under every threshold, holding patient names. Value bands do not see data.

7. A worker dressed as a deliverable

A statement of work for someone who attends daily stand-ups and uses your document system.

Plus: the bank change

An email says a supplier's account has changed. New-supplier set-up and later changes both need a call-back to a known number.

No public figure was found for how often the first seven happen at drug or device companies. Section 07 shows how to count your own.

Billing schemes appear in one in five occupational fraud cases, with a $90,000 median loss

Share of 2,402 cases, ACFE 2026; a case can include more than one kind of scheme

Corruption45%
Noncash assets23%
Billing21%
Expense reimbursements13%
Check and payment tampering10%

Source 31 · Billing means a fraudster makes the company pay a false invoice. Corruption's median loss is $150,000. Billing schemes ran a median of 14 months before anyone caught them. These are cases that fraud examiners investigated, in all industries.

Show the numbers
ItemValue
Corruption45%
Noncash assets23%
Billing21%
Expense reimbursements13%
Check and payment tampering10%

Tips matter as well. The Association of Certified Fraud Examiners found that 43% of the frauds in its study came to light through a tip, and that almost one third of tips came from vendors and customers.31 A supplier who sees something odd needs a route to say so, and that route starts with knowing who owns the relationship.

Reported losses to business email compromise passed $3 billion in 2025

FBI Internet Crime Complaint Center, all sectors

$2.9B2023
$2.8B2024
$3B2025

Source 32 · 24,768 complaints in 2025. The FBI's category covers more than supplier payments. Self-reported losses, so the true figure is unknown.

Show the numbers
PeriodValue
2023$2.9B
2024$2.8B
2025$3B

When a contractor's records fail: more than 400 medicines reviewed, and suspensions across the EU

In 2023 and 2024 the European Medicines Agency reviewed generic medicines tested by one contract research organization, Synapse Labs, after a good clinical practice inspection found "irregularities in study data and inadequacies in study documentation", along with problems in its computer systems and data procedures. The Commission's binding decision came on May 24, 2024, and suspensions followed for medicines without other supporting data. EMA said there was "no evidence of harm or lack of effectiveness" with the affected medicines.33

This case is about one regulator's finding on one firm, and no purchase route would have revealed it. It does show what sits behind the rule that a sponsor stays responsible: the companies whose products relied on that testing bore the consequence.

09 · The software market

Who sells intake-to-procure software, what analysts say, and what the adoption figures leave out

In shortIntake became its own software category over the past few years, and procurement suites and independent specialists both sell it. Analysts place it on a path to the mainstream. Adoption of AI in procurement is rising quickly from a low base, and large-scale use remains rare. The strongest results are vendor stories about unnamed customers, so treat them as things to test on your own requests.

Gartner placed intake management on its Hype Cycle for Procurement and Sourcing Solutions in 2023, with mainstream adoption predicted "to mature within 2-5 years", in the words of a vendor named in that report, writing in August 2023.34 We did not read Gartner's report. Sellers include specialist intake firms, large source-to-pay suites that added it, and workflow tools. Compare all three if you can: they differ most in how much they read for themselves and in how they connect to your finance system.

Many procurement teams pursue AI, and few run it at large scale

The Hackett Group's 2026 Procurement Key Issues study, release of March 17, 2026

Name AI-enabled technology as the most transformational trend for the next five years80%
Reach AI through capabilities embedded in existing procurement platforms69%
Actively pursuing AI deployment43%
Report large-scale implementation12%

Source 6 · The release gives no sample size. Hackett sells advisory services on this subject.

Show the numbers
ItemValue
Name AI-enabled technology as the most transformational trend for the next five years80%
Reach AI through capabilities embedded in existing procurement platforms69%
Actively pursuing AI deployment43%
Report large-scale implementation12%

Analysts are cautious about the speed. Gartner said in July 2025 that generative AI for procurement had entered "the trough of disillusionment" and projected it would become fully productive within five years, as DCAT Value Chain Insights reports.35 A Gartner survey of 101 chief procurement officers in January and February 2026 found only 36% very confident in their ability to redesign roles and processes for AI. We read a trade summary of that release, dated May 19, 2026.36

One vendor's customer story: 12 hours of processing per request down to 16 minutes

ORO Labs on an unnamed top-five drug company, page last updated June 30, 2026

BeforeAfter
Average processing time per request720 minutes16 minutes

Source 37 · ORO Labs wrote and published this about a customer it does not name, with no method. We found nothing from the drug maker itself. It says "more than 12 hours" in one place and "12 to 13 hours" in another; we draw 12. Its headline says 90%, though 12 hours to 16 minutes is about 98%. It also says the platform "eliminated 55–60% of manual operational effort", without saying per request, and claims 97% compliance accuracy over more than 300,000 requests, a figure it also calls tickets. Elapsed time to a PO is a different measure.

Show the numbers
BeforeAfter
Average processing time per request720 minutes16 minutes

How to read a vendor's number on intake

Which clock?

Processing minutes for a person, time to a route, and days to a PO are three different measures. A vendor can win on one and leave another untouched.

Which requests?

Catalog orders inflate a median. Ask for the figures on services and new suppliers, separately.

Measured by whom?

A customer story has no control group. A pilot on your own past requests does.

Against what?

A saving counted against the requested price may vanish against the rate card. Agree the baseline before you look at results.

10 · AI in routing

AI reads and matches purchase requests well: what regulators have said, and where people stay in charge

In shortAI reads free text, finds the matching agreement and drafts the next form well. It can also misread a clause, and a supplier's quote may carry hidden instructions. Most regulators' AI texts do not aim at this kind of internal work, but quality, privacy and finance rules still apply to its results. Keep people on exceptions, approvals and posting, and show the source for every step.

Seven AI and records texts an intake tool may meet, with their status in November 2026

TextStatusWhat it means for intake
FDA draft guidance on AI for regulatory decisionsDraft, January 2025; not final on November 3, 2026Excludes "operational efficiencies (e.g., internal workflows, resource allocation...)" that do not affect patient safety, drug quality or study reliability. Routing a request usually sits outside it. Your own assessment should say so38
Draft EU GMP Annex 22Draft; EudraLex Volume 4 lists no Annex 22 on November 3, 2026Says generative AI and large language models "should not be used in critical GMP applications". A purchase route is not one. Deciding a GMP supplier's qualified status would be close to it, so that stays with quality.39 EMA's report of a June 30, 2026 workshop says comments supported allowing such models and the drafting group has discussed widening the scope; no revised text is published40
EU AI ActAI Omnibus in force July 27, 2026: Annex III rules December 2, 2027, Annex I August 2, 2028On our reading, routing purchases does not sit in an Annex III category. Check any tool that also ranks workers or suppliers, with counsel23
FDA Computer Software AssuranceFinal, February 2026Its scope is computers and automated data processing in device production or the quality system. It applies to intake only where intake forms part of those41
21 CFR Part 11In forceApplies to electronic records under agency records requirements. On our reading an ordinary PO is usually outside it and a GMP supplier approval usually inside. Your quality team sorts the records42
ISPE GAMP guide on AIPublished July 2025. We read ISPE's page on the guide, which it sellsIndustry guidance for AI-enabled computerized systems in GxP areas, useful if your intake tool also touches GxP records43
MHRA GXP data integrity guidanceRevision 1, March 2018; page updated September 27, 2021; not withdrawn on November 3, 2026Records should be attributable, legible, contemporaneous, original and accurate, and complete, consistent, enduring and available. A good habit for any audit trail, and MHRA's expectation for GxP records44
Start where the reading is heavy and the cost of an error is low; keep people on the rest
Cost of a wrong answer →
People decide, software fetches
People decide, software drafts
Leave it simple
Automate first
Sorting a requestChecking recordsDrafting formsAdding up a splitChoosing between suppliersRatifying a late purchaseApproving spend
How much reading the task takes →

Illustrative · replace with your own numbers · Our judgment. Move the points for your own risks and record why.

Show the numbers
ItemHow much reading the task takes (0–1)Cost of a wrong answer (0–1)
Sorting a request0.850.10
Checking records0.880.22
Drafting forms0.720.33
Adding up a split0.100.12
Choosing between suppliers0.880.57
Ratifying a late purchase0.100.55
Approving spend0.100.70

Hidden instructions, chatbot promises and near names: three risks when software reads a request

A quote is outside text

The OWASP security project lists prompt injection first among risks in AI applications, including "indirect" injection from files.45 A supplier's PDF could hide an instruction. Treat attachments as data, and keep routing rules outside what they can touch.

A chatbot's answer can bind you

In Moffatt v. Air Canada (2024), a Canadian tribunal held the airline liable for what its chatbot told a customer, and rejected the idea that the chatbot was a separate entity.46 A tool that promises a price or a supplier to an employee creates a problem of that kind inside your company.

Near names fool similarity

Reading software is good at similarity, and similarity is the error here. Two firms with near names need a person, or a check of registration and bank records.

11 · How teams do it today

From shared mailbox to purchase order: who handles a request by hand, and where about six working days go

In shortA typical request passes through a requester, a buyer, one or two reviewers and a chain of approvers, mostly by email. An estimated six working days go by before a PO on a request covered by an existing contract, and much of that is finding out, asking and re-keying. Approvals take time as well, though they often take the blame for time spent elsewhere.

The six roles a purchase request passes through, from requester to accounts payable

RQ

Requester

A scientist, manager or assistant with a need and a date. Names who they know.

Cares about: getting the thing, and knowing who to ask.
PO

Procurement operations lead

Owns the queue, decides exceptions, ratifies late purchases, owns the rules.

Cares about: not spending the week re-keying email.
CM

Category manager

Owns research services or another category. Runs sourcing events and signs sole-source requests.

Cares about: no new supplier nobody needed.
IT

IT security reviewer

Assesses software that holds company or personal data. Often owns the license register.

Cares about: a complete form, once.
LG

Legal and privacy

Check templates, data transfers and clauses. Rarely see the request until late.

Cares about: seeing it before the work starts.
FN

Approvers and finance

Budget owners sign by value. Accounts payable matches invoices to orders.

Cares about: an approval with its reasons attached.
A by-hand request crosses at least five desks before it reaches a purchase order
  1. 1Email arrives

    A requester writes to a buyer, or to whoever answered last time.

    RequesterDay 0
  2. 2Questions go back

    The buyer asks for the cost center, the date and the scope.

    BuyerDay 1
  3. 3Records searched

    Catalog, agreements, license register, supplier master.

    Buyer, ITDay 2
  4. 4Requisition keyed

    The request is typed into the finance system.

    BuyerDay 3
  5. 5Approvals in order

    Budget owner, then others by value.

    ApproversDay 4 to 5
  6. 6PO issued

    A person posts it, and the supplier hears.

    Buyer, financeDay 6

Illustrative · replace with your own numbers · A typical shape for a request under an existing contract, in an estimate. Map yours.

Show the numbers
StepWhat happensWhoTime
Email arrivesA requester writes to a buyer, or to whoever answered last time.RequesterDay 0
Questions go backThe buyer asks for the cost center, the date and the scope.BuyerDay 1
Records searchedCatalog, agreements, license register, supplier master.Buyer, ITDay 2
Requisition keyedThe request is typed into the finance system.BuyerDay 3
Approvals in orderBudget owner, then others by value.ApproversDay 4 to 5
PO issuedA person posts it, and the supplier hears.Buyer, financeDay 6
Four of six working days go to finding out and typing, before a single approver signs
Working out the way to buyChasing detailsChecking recordsRe-keyingApprovals and posting
A by-hand request, about 6 working days1 day1 day1 day1 day2 days

Illustrative · replace with your own numbers · An estimate for a request bought under an existing contract, offered as a starting point for your own count. No public study of these steps at drug or device companies was found.

Show the numbers
Working out the way to buyChasing detailsChecking recordsRe-keyingApprovals and posting
A by-hand request, about 6 working days1 day1 day1 day1 day2 days

Five ways to run intake, from a shared mailbox to software that reads

WayWhat it does wellWhere it falls short
Shared mailbox and buyersFlexible, human, costs nothing newDepends on who reads it. No record of why a route was chosen
Forms and a ticketing toolStructured data, tracking, routing by fixed rulesEmployees must pick the right form, which is the question they cannot answer. Forms grow long
A shared service or outsourced deskCapacity and consistent hoursStill re-keys. Life sciences research services are hard for a general desk to place
Guided buying in a procurement suiteClose to the catalog and the finance systemStrongest for goods. Services and new suppliers often fall back to a form
Software that reads and asksTakes plain words, checks records, drafts next stepsOnly as good as the records beneath it. Needs tests, and a person on exceptions
Part B · See it working

A survey tool and a $164,800 lab request, routed by Botminds Procurement Intake Management on its own screens

Here the work from Part A runs in the Botminds product, at a fictional biotech, Northwind Bio. Every company, supplier, person, agreement and number on these screens is sample data. Software agents, each with one job, read the request, check the records and draft the next step. People decide exceptions, sign in order and post the requisition. One standing rule sits apart: the sample policy approves catalog orders under $1,000 automatically, within budget, and section 14 shows it.

12 · A survey tool, routed

Sam's one-sentence request for a survey tool meets 312 free seats, and the route changes

In shortThe survey tool from the top of the page, now on screen, on October 7. Sam Patel, a patient advocacy manager, types what he needs and names a tool he likes. The conversation asks two questions while the route builds beside it. The company's license has free seats cleared for panel data, so the tool he named is held back with its clause. He gets 40 seats the next day, and he can still ask for his choice as an exception.

1

A place to ask, with no form to choose

Sam opens New request. There is one line: what do you need? Beside it, the route waits to be built, in the order the buying policy sets: is it a purchase, the catalog, contracts and licenses, and only then a new supplier or quotes. A thin line of sample figures sits above, and the company's records wait behind: 4,310 catalog items, 212 agreements, 38 licenses with 1,904 seats unassigned.

He writes: "We need a survey tool for our patient advisory panel, about 40 seats, roughly $18,000 a year. We liked Pollen Survey."

The starting screen. No form, no list of categories. The route on the right stays empty until the employee says something.
2

Seats found before anything new, and the named tool held back

The request classifier reads a software subscription in the $10,000 to $100,000 band. The catalog has no survey software. The Thornquill Research Cloud license has 312 unassigned seats, which fits if it may hold the panel's data, so the conversation asks exactly that. Pollen Survey shows as held back, with clause 7.5 beside it: unused seats come before a new tool.

Each row names the agent behind it, and the clause chip opens the passage.

What the company already pays for. One question now decides the route, so it is the only one asked. The tool Sam named is held back and stays visible.
3

Two answers, and the route is set with its reasons

Sam taps two answers: yes, names and emails; by November 1. Thornquill passed IT security assessment SA-2291 for panel members' personal data, so the route is the company's license: seats ready tomorrow, no cost to his budget, no PO needed. Three agents confirm it in 2.0 seconds on this sample. Each numbered reason opens the record behind it.

A note keeps the choice open. Pollen Survey as a new supplier needs a security assessment, a privacy review and three quotes, typically four to six weeks, and one link sends it to a person as an exception.

The route, set. The route says what happens, when and at what cost, and shows the way to ask for the named tool anyway.
4

Who signs, and what Sam sees next

With no spend, there is nothing for a director to approve. The Thornquill administrator assigns the seats, and Laura Kessing, Sam's director, is informed. Sam sends it, and request REQ-24131 opens with a tracker: asked, route chosen, seat request sent, 40 seats assigned, welcome email to his team.

In the Requests list this one reads Existing license, $0 and seats, at the stage called Release drafted, the sample's word for the seat request.

Policy steps and who signs. Steps that do not apply say so, with the reason, so nobody asks later why they were skipped.
The requester's tracker. Sam follows the request here in place of an email thread.
For Sam, the license route replaces about five weeks with one day

The fictional case; the new-supplier figure is the midpoint of the screen's four to six weeks

Pollen Survey, new supplierThornquill license
Calendar days until seats are usable35 days1 day

Fictional example from this guide

Show the numbers
Pollen Survey, new supplierThornquill license
Calendar days until seats are usable35 days1 day
13 · A named lab, decided

A scientist names a lab, an agreement already covers the assay, and the $164,800 route waits for a person

In shortA scientist, Dr. Maya Chen, attaches a $182,400 quote from a lab that is not a supplier. An agreement covers the same assay at $164,800, and that lab ran it last year. The agents are 88% sure, and she named someone else, so the route waits for Priya Ranvelle, the procurement operations lead. She compares two options side by side and confirms one. The work order and the note to Maya are drafted, and a person posts the requisition.

1

The request and the checks behind it

Maya asked at 8:12 am for a lab to validate the sTRX-7 ligand-binding assay on VLT-302 serum samples, attaching a quote from Kelbrook Bioanalytics. The intake guide read the quote, three analytes and 12 weeks, and asked two things: will coded patient samples leave Northwind, and which cost center pays?

Priya's screen lays out the routing decision as a list of tests, each with the passage behind it. Marrowbrook Lab Services covers it under master agreement MSA-0418, rate card item BA-14. The agreement was competitively sourced under request for proposal RFP-2025-031, and its Schedule 4 covers the coded samples. Kelbrook is not in the supplier master. A different firm, Kelbrook Lab Supplies GmbH, is, with another registration number and bank account, and the agents do not treat them as one company.

A request that needs a decision. Each test cites its passage, and the right-hand panel shows it. The clause text on these screens is sample text written for the example.
2

Two routes, side by side

The Marrowbrook agreement starts October 27 at $164,800, as a statement of work under MSA-0418, about 2 days to a PO. Adding Kelbrook as a new supplier would start about November 24 at $182,400, after due diligence and a sole-source justification, 15 to 25 working days to a PO. Each option cites its clause. Priya can also send the question back to Maya.

The approval chain is already built from the value: Dr. Henrik Aldersen, the director and budget owner; Grace Whitfield, the vice president, in the $150,001 to $500,000 band; and Omar Haddad for procurement's sign-off above $100,000.

Choose the route. Priya decides. The recommendation is marked, and both options keep their facts on screen.
3

The work order and the note, drafted

Priya confirms. Work order SOW-0418-031 is drafted from rate card BA-14: method transfer in week 2, validation runs in weeks 3 to 9, a validation report in week 12 that meets ICH M10 criteria, $164,800 fixed. Maya's note says the lab starts a week before her date, at $17,600 below the Kelbrook quote, and it explains why.

Drafts stay drafts. A person posts the requisition, and the agent that pre-fills forms cannot change agreed prices. The tracker nudges the next approver once a working day, with the request and its reasons attached.

Prepared for you. The drafts cite the same passages as the decision. The buttons are for a person.
14 · Requests a form misses

A split video series, an invoice with no PO, a writer who may be staff, and fees that leave procurement

In shortFour more sample requests show why a form is not enough. Two parts of a video series add up to a sourcing event. A translation invoice arrives with no PO and must be ratified. A writing request could be a deliverable or a person working under direction. And fees to doctors go to a different process with the details filled in. Pipette tips, meanwhile, fall under the sample policy's one automatic approval: catalog orders under $1,000, within budget.

$54,000 and $54,000: the split purchase the 30-day window catches

Sam asks for part 2 of a patient video series from Hollin Story Films, five days after part 1. The agent asks whether it is a separate project, and Sam says it is the same series, split across two budget quarters. The two together reach $108,000, above the $100,000 line. The recommendation is one sourcing event, and Priya can keep two requests only with a justification on record. Nobody is accused of anything: the screen states the arithmetic and the clause.

Possible split purchase. The 30-day window is a setting drawn from the policy, and every change to it is recorded.

$9,800 with no purchase order: ratifying work already done

Wordmere Language Partners sent an invoice for 14 patient materials translated into six languages, delivered September 22, with no PO reference. Tom Halwick, in Medical Affairs, explains that a leaflet update had a 10-day deadline from the agency. The route is a ratification after the fact by Priya and the cost-center owner, with the reason recorded and the case listed in the October exceptions review. The supplier did the work it was asked to do. The gap was on Northwind's side.

An invoice before a PO. The choice is to ratify and raise the PO or return the invoice. Each choice leaves a recorded reason.

Deliverable or day-to-day: a 61% call that goes to a person

Dr. Aisha Rahman, in Regulatory Affairs, needs writing help to finish the Module 2.7 clinical summaries of a drug application, about $96,000. Asked whether the writer delivers finished summaries or works inside her team, she says mostly finished summaries, with daily stand-ups and use of the document system. The agents are 61% sure, well under the 90% line for confirming a route on their own, so the question goes to Priya.

One option is a deliverable-based statement of work under Halvorsen Regulatory Consulting's MSA-0377. The other sends it to human resources as a contingent worker. Clause 6.4 is on the screen for both, and the deliverables are defined in the draft.

Statement of work or a contingent worker. Low confidence is shown as a number, and it sends the case to a person. The right-hand card carries the sample's "not a purchase" tag: in plain terms, it leaves procurement for human resources.

Advisory board fees and pipette tips: the two ends of the buying order

Sam also needs to pay 8 dermatologists at an advisory board in November, about $19,200. One question, are they paid healthcare professionals, takes it out of procurement under clause 8.1. The engagement request is filled in with his details, so he does not start again, and compliance drafts the contracts, with fees set at fair market value. Compliance also decides what kind of engagement this is: the sample's wording mixes speaker fees and an advisory board, and those are handled differently.

Maya's 20 racks of filter pipette tips go the other way. The LabNorth catalog has item 77-2041 at $4.68 a rack, $93.60 in all, and the sample delegation of authority approves catalog orders under $1,000 automatically, within the cost-center budget. PO 4500311902 issues in six minutes on the sample. People wrote that rule into the policy, and every other purchase on these screens waits for a named approver.

Not a purchase. Fees to healthcare professionals leave procurement, with the details filled in.
The fastest route. The same conversation, ending at a catalog order the sample policy approves automatically.
15 · Procurement's view

The route board, the policy library and the dashboard: every open request and the clause behind it

In shortProcurement sees every open request as a stop on a line, with late ones marked and exceptions waiting below. The Requests list filters by route and status. The policy library shows what the agents read, highlighted where each request cites it. The dashboard counts requests, days, route mix and clauses. Dashboard figures are design targets on sample data, and they are measured live once the solution runs on your requests.

The route board. 210 open requests on five routes on this sample. Open a station and its requests appear below, here the 12 at security and privacy review, one of them late.
Exceptions and live arrivals. Priya's queue on the left. On the right, routine requests routing themselves in seconds.
Every request, filterable. Route and status filters, a search box, and waiting clocks. The red entry is a security review past its clock.
What the agents read. The buying policy here is sample text for a fictional company, and your own replaces it. "Cited in" shows which requests rest on it.
The approval table. The chain on every request comes from this table, including the rule that nobody approves what they raised.
On the sample, 58% of requests stay on the catalog or an existing agreement
Catalog: 31%Existing contract: 27%Statement of work: 19%New supplier: 9%Not a purchase: 8%Sourcing event: 6%
1,842requests
  • Catalog31%
  • Existing contract27%
  • Statement of work19%
  • New supplier9%
  • Not a purchase8%
  • Sourcing event6%

Fictional example from this guide · Sample dashboard, last 30 days. 58% is a design target, measured in the live solution.

Show the numbers
PartValue
Catalog31%
Existing contract27%
Statement of work19%
New supplier9%
Not a purchase8%
Sourcing event6%
On the sample, an existing contract reaches a PO in under two working days and a new supplier in sixteen

Request to PO, working days of 8 hours, by route

Catalog (6 minutes)0.01 days
Existing contract (15 hours)1.9 days
Statement of work7.3 days
New supplier16 days
Sourcing event18 days

Fictional example from this guide · Sample dashboard. These are targets and sample figures, never results from a real company.

Show the numbers
ItemValue
Catalog (6 minutes)0.01 days
Existing contract (15 hours)1.9 days
Statement of work7.3 days
New supplier16 days
Sourcing event18 days
Dashboard, first screen. The page says plainly that these are targets on sample data.
On the sample, the channel-order clause does the most work

Times each policy clause was cited, last 30 days, sample dashboard

2.1 Channel order642
3.2 Quotes and thresholds511
6.2 Statement of work344
7.3 Privacy and data transfer201
7.5 Software security188
5.1 New-supplier due diligence160
8.1 Not a purchase97

Fictional example from this guide

Show the numbers
ItemValue
2.1 Channel order642
3.2 Quotes and thresholds511
6.2 Statement of work344
7.3 Privacy and data transfer201
7.5 Software security188
5.1 New-supplier due diligence160
8.1 Not a purchase97
Where the time goes, and what was kept. A sample count of clauses shows which rules do the work. The lower table shows spend steered to agreements by supplier.
Your rules. Thresholds change only as a new policy version for CFO approval, and the channel order is part of the policy. Who decides each exception is your choice.
16 · Agents and signatures

Who does what on a purchase request: six agents that draft, people who sign, and targets to test

In shortSix agents ask, classify, match, route, draft and track, each with something it must never do. A route confirms itself only above the confidence line, and only when no exception applies. Everything else waits for a person. Named people approve the spend under the delegation of authority, apart from the small catalog orders the policy approves automatically. The solution works with the channels and records you already have. Outcome figures are design targets, measured when the solution runs on your requests.

Intake guide to request tracker: what each agent does and must never do

Intake guide

Talks with the requester in plain words, reads attached quotes and drafts, and asks only the questions the route depends on.

Never promises a supplier or a price.

Request classifier

Sets the category, the value band and whether it is a purchase at all. Puts a confidence on every label.

Never confirms a low-confidence label: it goes to a person.

Supplier & contract matcher

Searches the catalog, agreements and rate cards, licenses with unused seats and the supplier master, in that order, and cites every match.

Never assumes a near-name match is the same company.

Policy router

Applies the buying policy and delegation of authority: channel order, thresholds, splits, late purchases, services, privacy and security. Builds the approval chain.

Never decides an exception, and the requester never approves their own request.

Form pre-filler

Drafts what comes next: a seat request, work order, quote request, supplier set-up, review forms, a sole-source form and the note to the requester.

Never posts a requisition or changes an agreed price.

Request tracker

Keeps the requester's tracker live, nudges late approvers with the reasons attached, and records every step.

Never nudges more than once a working day by default.

The solution's page calls the matcher the Contract & license matcher. It is the same agent as on these screens.

Who signs what on a purchase request: exceptions, values and reviews

Person, in the sampleSigns or decidesThe rule
Priya Ranvelle, procurement operations leadRouting exceptions, late-purchase ratificationsRequester-named suppliers, possible splits, low confidence and late purchases wait for her
Omar Haddad, category managerSole-source justifications, procurement sign-off above $100,000, sourcing eventsIn addition to the business approvers
Directors and vice presidentsSpend, by value bandSet by the delegation of authority, never by the requester
Jonas Harbeck, IT securitySoftware security assessments, rule changes that touch securityForm pre-filled, the decision his
Dana Okafor, legalStatement of work templates, respondent-fee clausesForm pre-filled, the decision hers

The four-eyes rule, that no one checks their own work, runs through it: the person who raises a request cannot approve it, and a person who manages a supplier cannot approve a purchase from that supplier. If a cost-center manager raises a request, it routes up a level.

Every agent step, decision, nudge and setting change lands on the activity trail with who and when. The product's own security credentials are a SOC 2 Type II audit and information security managed to ISO 27001. For your GxP and financial duties, the solution provides controls that support your compliance, and the responsibility stays with you.

From one sentence to a posted requisition: the records read and the drafts produced

From the employee

  • A request in plain words, by chat, page or email
  • Quotes and draft scopes
  • Supplier invoices with no PO

From your records

  • Buying policy and delegation of authority
  • Agreements and rate cards
  • Catalog and preferred suppliers
  • Supplier master and license register
Agents read, match and draft Every test cites its clause
Exceptions go to a person
People post requisitions

Outputs

  • Structured purchase request
  • Route with cited policy: way to buy, steps, who signs
  • Pre-filled next steps
  • Live tracker for the requester
  • Route board and dashboard for procurement
  • An activity trail for every request

Chat, contract repository, license register, ERP: where a purchase request plugs in

Company chat and intake pageWhere people ask
Procurement mailbox and accounts payableEmails and invoices without a PO
Contract repositoryAgreements, rate cards, data schedules
IT asset registerLicenses, seats, security clearances
Supplier masterSuppliers and purchase history
Punch-out catalogNegotiated items and prices
ERP, your finance and purchasing systemRequisition drafts, the PO number back
HCP engagement, grants and travel toolsRequests handed over, details filled in

1.9 days to a PO and 58% kept on what you own: design targets to test on your requests

1.9 days

median from request to PO, against an estimated 4 to 8 by hand.

Design target
58%

of requests kept on the catalog, an agreement or a license. On the sample, 94% routed right the first time.

Design targets
Your numbers

The pilot in section 21 tells you what these become on your own requests. No figure here is a customer result.

What to do with them
Part C · Ready to automate?

Before you buy intake-to-procure software: leakage, return, readiness and a fair pilot

You decide here, on your own numbers. This part covers what leakage (money lost to idle seats, unneeded suppliers and buying outside agreements) and delay can cost, how to size a return, a scored readiness check, what to ask any vendor, including us, and a pilot you can run on last quarter's requests.

17 · What leakage costs you

The price of idle seats, unneeded suppliers and a slow route at a drug or device company

In shortNo independent life sciences benchmark was found for most of this. Published figures describe contracts, trial delay and fraud in general. Your real costs sit in license renewals, new-supplier set-ups, buyer hours and work that started late. A week with your finance export, your license register and your last 100 requests gives you a number you can defend.

$40,000

a day in direct cost for a delayed Phase II or III trial, in Tufts' published work, with about $500,000 to $800,000 a day in lost sales depending on the paper.28,29

Tufts CSDD, 2024. An average, so ask if your purchase sits on the critical path
8.6%

of contract value lost to weak contracting, across more than 1,200 organizations, against 9.2% in 2014 research.27

WorldCC with Deloitte, 2023. Far wider than intake
$90,000

median loss in a billing scheme, which ran a median 14 months before discovery.31

ACFE, 2026, all industries
Finding out, chasing and re-keying are where a request's days can come down; approvals mostly stay

One request bought under an existing contract, in working days

By hand, estimatedWith the solution, design estimate
Working out the way to buy1 day0.05 days
Chasing missing details1 day0.1 days
Checking catalog, agreements, licenses1 day0.05 days
Re-keying into a requisition1 day0.05 days
Approvals in order1.5 days1.2 days
Posting and issuing the PO0.5 days0.4 days

Illustrative · replace with your own numbers · The solution's own estimates for one kind of request, about 6 days falling to about 1.9. Replace them with a count from your own requests.

Show the numbers
By hand, estimatedWith the solution, design estimate
Working out the way to buy1 day0.05 days
Chasing missing details1 day0.1 days
Checking catalog, agreements, licenses1 day0.05 days
Re-keying into a requisition1 day0.05 days
Approvals in order1.5 days1.2 days
Posting and issuing the PO0.5 days0.4 days

Where procurement leakage hides, and how to find your number in a week

CostWhere it hidesHow to find your number
Buyer hours per requestSalaries and shared mailboxesAsk three buyers to log time on their next 20 requests, by the steps in section 11
New suppliers you did not needSupplier set-up tickets, reviewer time, a longer list to monitorCount last quarter's new suppliers that an agreement in term already covered (section 07), then price one set-up from its tickets and reviewer hours
New tools bought over idle seatsDepartmental budgets and expense cardsAdd up what you paid for this year's new software where a license with free seats had the same purpose (section 07)
Paying above the rate cardQuotes from suppliers outside an agreementCompare services invoices with the matching rate card items for one category
Work started before a POAccounts payable holds, month-end exceptionsTake the late invoices from section 07, group them by cost center, and add up the time spent ratifying them
Days from request to POBetween systems, because the clock starts in an emailSample 100 requests. Take the first email date, not the requisition date

Costs a return calculator leaves out: a delayed study, a bad bank change, an unreviewed tool

A delayed studyA lab that starts four weeks late may move nothing, or may move a filing. Only your project plan can say.
A diverted paymentReported business email compromise losses reached $3.05 billion in 2025 across all sectors.32 New-supplier set-up and bank changes are where you defend against it.
A tool that holds patient data, unreviewedA breach or a regulator's question costs far more than the subscription. No reliable figure ties this to intake.
A fee that missed its reportOpen Payments penalties run to $1,443,275 for knowing failures at 2025 levels, before any other exposure.18
Goodwill of the people askingWhen employees cannot find the route, they stop looking. That cost shows up as off-policy buying a year later.
Your time on auditsA cited reason on each request answers a Sarbanes-Oxley walkthrough question in minutes. A mailbox search does not.
18 · Your return

Buyer hours, avoided suppliers and reused seats: the return on routing purchase requests

In shortThe return comes from buyer hours, new suppliers you avoid and seats you reuse. A fourth lever, time to a PO, matters and carries no dollar figure here. Defaults below are illustrative. The seat price comes from the guide's fictional example. Replace every input with your own before you show this to anyone.

Three formulas for the return, and the lever left out of the sum

Buyer hours

Reading, chasing and re-keying come off buyers

Buyers keep sourcing, negotiation and exceptions.

requests × hours saved × hourly cost
New suppliers

Fewer set-ups you did not need

Each avoided supplier saves due diligence, review time and a longer list to watch.

suppliers avoided × set-up cost
Seats

Idle seats used before new tools are bought

Check fit and data clearance first. A free seat is a reason to ask.

seats reused × yearly price per seat
Not counted

Time to a purchase order

Faster starts can matter more than everything above, for a few projects. Measure the days, and leave them out of the sum.

median days, request to PO, by route

What 6,000 purchase requests a year could return, or your own count

Your volume
What you stop buying
Illustrative yearly value
Buyer hours freed0
Buyer time, valued$0
Set-ups avoided, valued$0
Seats reused, valued$0
Total, before software cost$0

Formulas: buyer time = requests × (hours today − hours after) × hourly cost; set-ups = suppliers avoided × set-up cost; seats = seats reused × price per seat. Every default is an assumption for you to replace, and we found no published source for them. Freed hours turn into money only if the team spends them elsewhere or grows more slowly, so state which. The total leaves out software and running costs.

19 · Readiness check

Scoring your buying policy, agreements and license register for automated routing

In shortPick the answer closest to your team today. Eight questions score 0 to 2, and the last one is for reflection. Routing software reads your records, so most of these questions ask how good those records are. A low score points to useful work you can start now, and that work pays back with or without software.

1
The buying policy

Is your policy current, numbered and in one place?

Why it mattersA route has to cite a clause, so software cannot quote what your team cannot find.
A strong answer"One numbered policy, versioned, approved by the CFO, last revised this year."
2
Delegation of authority

Can a system read who approves what, with today's names?

Why it mattersA chain built from an old table sends approvals to people who left.
A strong answer"The table is in the finance system and synced to HR, with rules for self-approval."
3
Agreements and rate cards

Can you list agreements in term, with scope, rates and data schedules?

Why it mattersThis is the largest source of avoidable new suppliers, and the hardest record to get clean.
A strong answer"A repository with every master agreement, its schedules and expiry dates."
4
License register

Do you know seats bought, seats free and what each tool was cleared to hold?

Why it mattersA free seat helps only if security has cleared it for the data in question.
A strong answer"The IT register shows seats and security assessment status for every enterprise license."
5
Supplier master

Is your supplier master free of duplicates, with GxP status marked?

Why it mattersA near-name duplicate leads to the wrong match, and quality needs to know who is qualified for what.
A strong answer"Deduplicated yearly, with registration numbers, and a quality-approved list linked."
6
Requests that leave procurement

Do HCP fees, grants and contingent workers each have a named process to hand to?

Why it mattersA route out of procurement needs somewhere to land, or the request comes straight back.
A strong answer"Each has an owner, a form and a turnaround we can state."
7
Baseline numbers

Do you know your days to a PO and your route mix, measured from the first email?

Why it mattersMost published numbers are vendors' own, so your count is the only fair comparison.
A strong answer"Median 6 days under contract, 22 for a new supplier, counted on our last 100."
8
An owner for exceptions and rules

Is one person accountable for exceptions, and have legal, privacy, quality and finance agreed the route rules?

Why it mattersA route that cites a rule nobody owns will be argued over at the first exception.
A strong answer"The operations lead decides exceptions. Each function signed the rules that touch it."
9
Every request, routed right the first time · for reflection

If every employee got the right route in minutes, what would your buyers do with the days they got back, and which new supplier would you never have added?

Why it mattersYour answer shows whether this is a staffing case, a sourcing case or a control case.
A strong answerA specific one, for example: "Move two buyers to research services sourcing, and stop adding bioanalysis labs."

What a procurement team does at each score

0–6

Explore

Put the policy in one numbered document, list agreements in term, and get the license register from IT. Count 100 requests by hand. This helps with or without software.

7–11

Ready to pilot

Replay last quarter's requests through a tool, and compare its routes with what your team chose. Argue about the differences, because they will show you policy gaps too.

12–16

Ready to implement

Go live on one category or one site, with a person on every exception. Keep a list of reversed routes and retune weekly.

20 · Questions for vendors

Twelve questions for intake-to-procure vendors on routes, clauses, unused seats and your data

In shortAsk for a demonstration on your own policy and your own requests. Software that reads well on its own sample tells you little. Ask us too. These questions are written so a strong answer shows on the screen, and a weak one sounds like a roadmap.

A

Reading a request and finding what you own

A1

Here is a real email from last quarter. Show me the route, and the clause behind each step.

Why it mattersCitations separate a route you can defend from one you have to trust.
Strong answerEach step opens the passage in your own document.
A2

How do you find an agreement that covers a service described in a scientist's words?

Why it mattersResearch services rarely use rate card language. Keyword search misses them.
Strong answerIt reads schedules and rate cards, and shows the matched item with the term and data schedule.
A3

What happens with two suppliers with near-identical names?

Why it mattersA false match puts money and data in the wrong place.
Strong answerIt flags them, shows registration and bank differences, and leaves the match to a person.
A4

Do you check unused seats and what they are cleared for?

Why it mattersA free seat on a tool not cleared for patient data is no answer at all.
Strong answerBoth come from your register, on screen, with the assessment reference.
B

Keeping people in charge of the money

B1

What can your software approve or post on its own?

Why it mattersSarbanes-Oxley controls and your delegation of authority depend on the answer.
Strong answerOnly what your policy lets approve itself, like small catalog orders. A person posts the rest.
B2

Show me a split purchase across two cost centers and a 45-day gap. What do you catch, and where is that rule set?

Why it mattersRules that sit in code are hard to audit or change.
Strong answerThe window is a visible setting, and changes are logged with an approver.
B3

How low does confidence go before a person sees the route?

Why it mattersA confidence score nobody can set is decoration.
Strong answerYou set the line. Named suppliers and low confidence always go to a person.
B4

What happens when a policy clause changes on Monday?

Why it mattersOld routes citing an old clause fail an audit.
Strong answerNew versions apply from a date, and past requests keep the version they used.
C

Patient data, hidden instructions and GxP claims

C1

Can an instruction hidden in a supplier's PDF change a route?

Why it mattersQuotes are outside text, and OWASP lists prompt injection first.45
Strong answerAttachments are treated as data, routing rules are held apart, and you can test it yourself.
C2

Where does our data go, and is it used to train anything?

Why it mattersRequests carry prices, personal data and program names.
Strong answerA clear data map, your own data kept apart from every other customer's, and a written no-training term.
C3

What audit evidence do you hold, and what do you say about GxP?

Why it mattersA product cannot be certified for GxP or Part 11. Claims that it is should worry you.
Strong answerA named audit report such as SOC 2 Type II, and controls that support your compliance, with the responsibility left with you.
C4

Where did your benchmark numbers come from?

Why it mattersMost in this field are customer stories with no method.
Strong answerA method, a date and the scope, or a plain offer to measure on your requests instead.
21 · A pilot on your requests

Replay 300 of last quarter's purchase requests, then take one category live: an eight-week pilot

In shortReplay real requests first, because you already know how they turned out. Compare the routes with your team's choices and argue about each difference. Then run one category live, such as research services, with a person on every exception. By week eight you will have your own numbers for days, routes and buyer hours.

Replay before you go live, and measure from the first email
Your teamVendor
Baseline: 100 requests by hand
Load policy, DoA, agreements, licenses
Replay 300 past requests
Review differences with reviewers
Live on one category
Measure and decide
Week 02468

Illustrative · replace with your own numbers

Show the numbers
ActivityFromTo
Baseline: 100 requests by hand02
Load policy, DoA, agreements, licenses02
Replay 300 past requests24
Review differences with reviewers35
Live on one category47
Measure and decide78

Route match, citations and days to a PO: scoring the replay and the live category

MeasureHowPasses if
Route matchReplay against what your team chose, then have a senior buyer rule on each differenceYou set it first. Count the differences where the software was right as well
Wrong routes that cost somethingCount a fee sent as a purchase, a missed split, a false near-name matchNone reaches a PO unseen by a person
CitationsSample 50. Open each clauseEach one says what the route claims
Days to a POMedian by route, from first message, against your baselineA fall on existing-contract requests. New suppliers fall less
Buyer hoursSame time log as the baselineHours move from re-keying to exceptions and sourcing
Requester experienceShort survey and repeat usePeople return without being told to
Deep questions before you sign: seven for your own team
  • What happens when a request sits in two routes, such as a service with a software component? Who decides?
  • How are prices protected? Can any draft alter an agreed rate?
  • How does the tool treat a legal entity in another country with its own buying policy?
  • Does each function (quality, privacy, legal, finance) sign off its own rules, and is that recorded?
  • What is your rollback if a policy version routes wrongly for a day?
  • How do you handle a supplier on a government or sanctions list, or one affected by BIOSECURE or the DOJ data rule? Which team gets the question, and how fast?22,21
  • Can your audit team pull every request that cited one clause, between two dates, without asking the vendor?
22 · Questions people ask

What buyers search about procurement intake: intake-to-procure, no PO no pay, split purchases and AI approvals

In shortWhat people type into a search box on this subject, each answer written to stand alone. Vendor figures carry the vendor's name and date. Rules are stated as of November 2026.

What is procurement intake management?

Procurement intake management is the first stage of buying: taking in what an employee needs, working out which way to buy applies, what checks and approvals it triggers, and tracking it to a purchase order. It can be run by people with a mailbox, by forms, or by software that reads the request. It sits before sourcing, contracting and invoicing.

What is intake-to-procure?

Intake-to-procure is a common name for procurement intake and for the software that runs it. Zip, a seller, defines it as a "centralized, structured process that guides purchase and supplier requests from initial intake" (April 1, 2025). It usually means one place to ask, with routing and approvals from there to a purchase order.

What is the difference between intake-to-procure and procure-to-pay?

Procure-to-pay covers the transaction from requisition to order, receipt, invoice and payment. Intake sits in front of it and decides what the requisition should be, or whether one is needed at all. Many companies run the two in connected systems, with the finance system still issuing the order.

What is guided buying?

Guided buying steers employees to approved options, often through a catalog or preferred supplier list within a procurement suite. It works best for goods. Services and new suppliers often still fall back to a form, which is why many teams look at intake software that handles free text.

What does "no PO, no pay" mean?

It is a policy that a purchase order must exist before work starts, or the invoice is not paid in the normal way. In practice, late invoices are usually ratified by named people, recorded as exceptions and reported. The rule protects budgets and approvals, and its point is lost if the exceptions are never counted.

How do you detect split purchases?

Add together requests to the same supplier from the same cost center within a window your policy sets, before applying thresholds. This guide's sample policy uses 30 days. Then ask whether the parts are one project. Most splits have innocent reasons, such as quarterly budgets, so the control states the arithmetic and the clause, and a person decides.

What is a delegation of authority in procurement?

A delegation of authority is a table that says who may commit how much money, usually by value band and sometimes by category. It often adds rules, such as a procurement signature above a set value, and that no one approves their own request. Intake uses it to build the approval chain automatically from the value of a request.

How much software license waste is typical?

Zylo, which sells license management software, says the average organization uses 54% of provisioned licenses, about $19.8 million a year in waste (its 2026 SaaS Management Index, page updated March 19, 2026). That is one vendor's data, and its method is not on the page. Check your own register by comparing seats bought, assigned and active over the last 90 days.

Does procurement intake software need GxP validation?

It depends on what it touches. Routing an ordinary purchase is usually outside GxP, while approving a GMP supplier or holding a required record is inside it. Your quality team should classify the use and record the reasoning. A product can be assessed and can offer controls that support your compliance, and it cannot itself be certified for GxP or 21 CFR Part 11.

How should fees to doctors be handled when they come through procurement?

Send them out of the purchasing route early, to your healthcare professional engagement process, with the details filled in. Those fees carry fair market value checks and, in the US, reporting to the Centers for Medicare & Medicaid Services (CMS) under 42 CFR 403.904. Civil penalties for a knowing failure can reach $1,443,275 at 2025 levels, unchanged for 2026.

Does BIOSECURE apply to a private company's purchases?

Section 851 of Public Law 119-60, approved December 18, 2025, reaches executive agency contracts, loans and grants, including contractors that use a listed company's equipment or services in performing the federal contract. It does not ban private buying as such. Its limits start 60 or 90 days after the Federal Acquisition Regulation is revised, and we found no list or revision on November 3, 2026. A company with federal contracts or grants should ask counsel, and flag relevant suppliers at intake once the list is published.

Can AI approve purchase requests?

Software can apply a rule your policy allows, such as approving a small catalog order within budget. Exceptions, spending approvals and posting should stay with named people, under your delegation of authority. AI is well suited to reading, matching and drafting, and it needs to show the source for each step.

How long should a purchase request take to reach a PO?

No independent life sciences benchmark was found. Vendors publish their own: ORO Labs, in its own customer story, reports about 16 minutes of processing per request at a top-five drug company it does not name (page updated June 30, 2026), a measure of processing time and different from elapsed days. Measure your own median by route, starting from the first email.

23 · One-page summary

Procurement intake at a glance: the buying order, the rules as of November 2026 and 13 terms

Print this page

In shortEight steps of method, the rules, the readiness bands and the terms, in one view to print or to share.

The method
  1. Give people one place to ask, in their own words.
  2. Ask first if it is a purchase at all. Hand fees, grants and contingent workers to their own process.
  3. Check the catalog, then contracts and licenses, and only then a new supplier.
  4. Ask only the questions the route depends on: data, date, cost center, named supplier.
  5. Add related requests together before applying thresholds.
  6. Build the approval chain from the delegation of authority. Nobody approves their own request.
  7. Cite the clause for each step. Send exceptions and low confidence to a named person.
  8. Draft the next forms. A person posts. Count days from the first message.

Add up the eight readiness scores of 0 to 2 each. A total of 0–6 means explore, 7–11 pilot, 12–16 implement.

As of November 2026: ICH E6(R3) in EU effect July 23, 2025 · FDA QMSR effective February 2, 2026 · DOJ data rule, April 8 and October 6, 2025 · BIOSECURE law since December 18, 2025 (Public Law 119-60, section 851), list due within a year, limits start after a FAR revision · Open Payments penalties at 2025 levels · DOL contractor rule proposed February 27, 2026, no final rule found · FDA AI guidance still a draft · draft Annex 22 not adopted · EU AI Act Annex III December 2, 2027.

13 terms
Requisition
Internal request to buy, before it becomes an order.
Purchase order (PO)
The document committing the company to pay.
Delegation of authority (DoA)
Who may commit how much money.
Catalog
Approved items at negotiated prices. Punch-out means it opens on the supplier's site.
Master agreement
Contract setting terms for later orders.
Rate card
A schedule of agreed prices under an agreement.
Call-off
An order under an existing agreement.
Statement of work (SOW)
Deliverables, milestones, acceptance and price for a service.
Sourcing event
A formal competition among suppliers, such as a request for proposal.
Sole-source justification
Written reason for buying without competition.
Split purchase
One need divided into smaller requests, on purpose or not.
Maverick spend
Buying outside agreed contracts or channels.
Ratification
Approval after the fact of work already done.
24 · Sources

Sources

Accessed November 2026. Regulatory status statements are as of November 2026. Where a vendor published the figure, or we could read only a summary of a source, the entry says so.

  1. Zycus, "Introduction to intake management", August 22, 2024. zycus.com
  2. Zip, "What is intake-to-procure", April 1, 2025, with Zip's survey of 1,056 US finance and accounting professionals. A vendor's own survey. zip.com
  3. Zylo, "Tracking Employee SaaS Usage Uncovers Significant Underutilization", first published May 9, 2023, updated March 19, 2026 with figures from its 2026 SaaS Management Index. A vendor's own figures; the method is not on this page. zylo.com
  4. 42 CFR 403.904, reports of payments or other transfers of value to covered recipients, 2025 edition. govinfo.gov
  5. U.S. Department of Justice, Criminal Division, "Evaluation of Corporate Compliance Programs", updated September 2024, section E, pages 8 and 9. justice.gov
  6. The Hackett Group, "The Hackett Group Reports Rapid Progress in Procurement's AI Agenda", press release on the 2026 Procurement Key Issues study, March 17, 2026. The release gives no sample size. thehackettgroup.com
  7. 21 CFR 211.84, testing and approval or rejection of components, 2025 edition. govinfo.gov
  8. 21 CFR 211.22, responsibilities of the quality control unit, 2025 edition. govinfo.gov
  9. ICH Q10, Pharmaceutical Quality System, section 2.7, Management of Outsourced Activities and Purchased Materials. database.ich.org
  10. European Commission, EudraLex Volume 4, EU GMP Chapter 7, Outsourced Activities, in operation January 31, 2013, paragraph 7.5. health.ec.europa.eu
  11. FDA, guidance, "Contract Manufacturing Arrangements for Drugs: Quality Agreements", November 2016. fda.gov
  12. ICH E6(R3), Good Clinical Practice, Principles and Annex 1, adopted January 6, 2025, section 3.6. In effect in the EU from July 23, 2025. database.ich.org
  13. FDA, Quality Management System Regulation final rule, 89 FR 7496, February 2, 2024, effective February 2, 2026; preamble on ISO 13485 clause 7.4 and on Subparts C through O being removed and reserved. govinfo.gov Former 21 CFR 820.50, in the edition revised as of April 1, 2025: govinfo.gov
  14. FDA, inspection citation data for fiscal year 2025, Drugs sheet. Counts by CFR row, our tally; Form 483s prepared by hand are left out. fda.gov
  15. Regulation (EU) 2016/679 (GDPR), Recital 26 and Article 28, Publications Office of the EU. publications.europa.eu
  16. Court of Justice of the European Union, press release No 107/25, September 4, 2025, on Case C-413/23 P, EDPS v SRB, under Regulation 2018/1725. We read the press release, not the judgment. curia.europa.eu
  17. Appeal brought on October 31, 2025 by Philippe Latombe, Case C-703/25 P, Official Journal C/2025/6610, Publications Office of the EU. No ruling found on November 3, 2026. publications.europa.eu
  18. HHS, "Annual Civil Monetary Penalties Inflation Adjustment", 91 FR 3665, January 28, 2026 (45 CFR 102.3); HHS later announced no adjustment for 2026 (FR Doc. 2026-21524). govinfo.gov
  19. U.S. Department of Justice, press release on Veloxis Pharmaceuticals, August 10, 2026. justice.gov
  20. HHS Office of Inspector General, Special Fraud Alert: Speaker Programs, November 16, 2020. oig.hhs.gov
  21. U.S. Department of Justice, final rule on access to US sensitive personal data by countries of concern, 28 CFR Part 202, 90 FR 1636, January 8, 2025, effective April 8, 2025; some due diligence and audit parts from October 6, 2025. govinfo.gov
  22. Public Law 119-60, section 851, prohibition on contracting with certain biotechnology providers, approved December 18, 2025. govinfo.gov
  23. European Commission, AI Act regulatory framework page, on Regulation (EU) 2026/1744, in force July 27, 2026. digital-strategy.ec.europa.eu
  24. 15 U.S.C. 7262, management assessment of internal controls (Sarbanes-Oxley Act section 404). law.cornell.edu
  25. U.S. Department of Labor, Wage and Hour Division, notice of proposed rule, "Employee or Independent Contractor Status Under the Fair Labor Standards Act, Family and Medical Leave Act, and Migrant and Seasonal Agricultural Worker Protection Act", 91 FR 9932, February 27, 2026, RIN 1235-AA46, comments through April 28, 2026; it recounts Field Assistance Bulletin 2025-1 of May 1, 2025. No final rule found on November 3, 2026. govinfo.gov
  26. ICH M10, Bioanalytical Method Validation and Study Sample Analysis, adopted May 24, 2022. database.ich.org
  27. World Commerce & Contracting, "Are organizations unlocking their full financial potential?", August 18, 2023: value erosion of 9.2% of contract value in its 2014 research and 8.6% in the update with Deloitte, on more than 1,200 organizations. news.worldcc.com
  28. Smith, DiMasi, Getz, Therapeutic Innovation and Regulatory Science 58(5):855-862, 2024, PMID 38773058: about $500,000 in lost sales and about $40,000 in direct cost per day, Phase II and III. pubmed.ncbi.nlm.nih.gov
  29. Tufts Center for the Study of Drug Development, day-of-delay white paper, August 2024: about $800,000 in lost sales a day. csdd.tufts.edu
  30. Zycus, "Contract Compliance and Maverick Spend: How to Plug the Leaks", June 18, 2025, citing Ardent Partners' 2025 Procurement Metrics That Matter report. A vendor citing a research firm; Ardent's report itself was not read. zycus.com
  31. Association of Certified Fraud Examiners, Occupational Fraud 2026: A Report to the Nations, 2,402 cases in 143 countries. Read in the copy hosted by ACFE Mexico. acfe-mexico.com.mx
  32. FBI Internet Crime Complaint Center, Internet Crime Report 2025: complaints and losses by type for 2023 to 2025. ic3.gov
  33. European Medicines Agency, Synapse Labs referral under Article 31, binding European Commission decision May 24, 2024, with EMA's December 2023 news item on more than 400 medicines reviewed. ema.europa.eu EMA news
  34. Tonkean, on Gartner's 2023 Hype Cycle for Procurement and Sourcing Solutions, August 22, 2023. A vendor's account of Gartner; the Gartner report itself was not read. tonkean.com
  35. Patricia Van Arnum, "State of the State: AI in Procurement", DCAT Value Chain Insights, citing Gartner press releases of July 30 and August 4, 2025. dcatvci.org
  36. Gartner, "Gartner Survey Shows Just 36% of Chief Procurement Officers Are Very Confident in Ability to Redesign Function for AI", May 19, 2026, 101 CPOs, January and February 2026. We read a trade summary of the release, in DC Velocity. gartner.com dcvelocity.com
  37. ORO Labs, customer story, "Top 5 Global Pharmaceutical Company", last updated June 30, 2026. ORO Labs wrote and published it, about a customer it does not name; no method and no earlier date on the page. orolabs.ai
  38. FDA, draft guidance, "Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products", January 2025, Docket FDA-2024-D-4689; still a draft on November 3, 2026. fda.gov
  39. European Commission and PIC/S, draft EU GMP Annex 22, consultation July 7 to October 7, 2025; EudraLex Volume 4 listed no Annex 22 on November 3, 2026. picscheme.org
  40. European Medicines Agency, report of the multistakeholder workshop on artificial intelligence guidance development (Annex 22), June 30, 2026, EMA/156789/2026. ema.europa.eu
  41. FDA, "Computer Software Assurance for Production and Quality Management System Software", final guidance, February 2026. fda.gov
  42. 21 CFR 11.1, scope of Part 11, 2025 edition. govinfo.gov
  43. ISPE, "GAMP Guide: Artificial Intelligence", July 2025. We read the publisher's page, not the guide, which is sold. ispe.org
  44. MHRA, "GXP Data Integrity Guidance and Definitions", Revision 1, March 2018, section 3.10 on ALCOA and ALCOA+; page last updated September 27, 2021. gov.uk
  45. OWASP Gen AI Security Project, "LLM01:2025 Prompt Injection". genai.owasp.org
  46. McCarthy Tétrault, "Moffatt v. Air Canada: A misrepresentation by an AI chatbot", February 19, 2024, on 2024 BCCRT 149. mccarthy.ca
Next step

See it on your own purchase requests.

Explore the solution, or bring your buying policy, your delegation of authority and a sample of last quarter's requests, and we will compare the routes with what your team chose.

botminds.ai The complete guide to procurement intake management · November 2026. Northwind Bio, Thornquill Research Cloud, Pollen Survey, Marrowbrook Lab Services, Kelbrook Bioanalytics, Kelbrook Lab Supplies, Halvorsen Regulatory Consulting, Wordmere Language Partners, Hollin Story Films, Corbel Events, LabNorth, Polder Medical Logistics, VLT-302, sTRX-7, every other company, person, product, agreement, policy clause and figure in the example and the screens are fictional, and no real supplier is suggested. Vendors' figures are labeled as their own, with their dates. Regulatory status is as of November 2026; check the sources before relying on it. This guide is general information and is not legal advice.