Getting started with procurement

If you’re part of a startup or small company and haven’t thought about procurement just yet, chances are that you should. Procurement is the method by which businesses discover, review, and purchase goods or services from an external source. While larger companies may have dedicated procurement teams, it’s important for small businesses to understand the process and consider their approach to avoid challenges down the line. 

‍

Based on our experiences as a growing company, here are some perspectives and pointers on how to start thinking about procurement — perhaps even before you have a dedicated team. We’ll cover how to build a baseline process, points to look for in the evaluation process, and critical partnerships to help stand up a foundation for your procurement program.

‍

When should I start thinking about SaaS procurement?

If you haven’t already started thinking about SaaS procurement, we encourage you to start as early as possible. This helps avoid situations where your company ends up with a significant amount of tech debt — such as too many tools (or even tools that have overlapping functionality), distributed ownership, or scattered billing on disparate credit cards. 

‍

Worse yet, without a clear process or ownership for SaaS procurement, you could end up with a lack of visibility on security and legal reviews that could put your business in potential violation of service agreements. 

‍

How do I get started with procurement?

First, it’s important to align your internal stakeholders, especially your Finance, Legal, and Security teams. To help create an internal procurement process, partner with your Finance team to consider your organization’s timeline for budgeting and spend review, and get a clear perspective on payment terms that work well for your business. In addition, work with your Security and Legal teams to understand what to look for in a security review and a legal review, and the timelines and materials needed for each. 

‍

Next, come up with a minimum viable process with defined reviews as part of your approval process. Even if it’s lightweight, this process can help requesters understand where to get started when they want to buy a specific tool or piece of software, who needs to review the request, and any materials needed. You can start with a spreadsheet to track the stages and approvals needed — which can also help keep requesters in the loop to understand where they are in the process. 

‍

At Vanta, we use Zip internally to create and track formal tickets for our procurement process, which grants our requestors visibility into the procurement process and also allows for automations that expedite the review and approval process.

‍

What should I look for in the evaluation process?

Before you begin the evaluation process, it helps to understand the needs of your project and business and to gather a list of requirements. For instance, what’s the problem you’re trying to solve — and what do you actually need for what you’re trying to buy? 

‍

For software, it can also help to understand the experience of peer or partner organizations who also use specific tools, or to draw upon your team’s experience with specific tools. In addition, it’s critical that you understand your overall SaaS toolkit across your business to help ensure there isn’t already another tool that tackles the same requirements.

‍

Next, we suggest running a request for proposals (RFP) if needed with multiple vendors to understand who meets your needs and requirements, and what’s important to you as a company. While pricing always comes into play, it’s important to stack rank and prioritize between things such as your requirements, budget, pricing, and relationship with the vendor.

‍

What should I look for with vendor security reviews?

Every company has a different process for vendor security reviews, and it’s important to work with your security and legal teams to understand their approach. 

‍

At Vanta, we typically review a business’s SOC 2 in depth, as well as recent penetration tests. Our goal is to assess their overall security posture and to understand the nature of security risk posed to Vanta by vendor relationships. 

‍

In principle, we think of security risk as the likelihood of a security incident occurring times the potential impact of such an event. Additionally, you can think of a security incident as the compromise of a vendor system or code implicating its confidentiality, integrity, or availability. We follow a defined vendor security review methodology and also work closely with our Legal team if and when needed.

‍

Who should be involved in the evaluation process?

In addition to your procurement function (no matter how new or established), we suggest involving your Legal, Security, and IT or Corporate Engineering teams for a comprehensive evaluation and review—as well as the requesting business stakeholder.

‍

Remember that things can change throughout your evaluation process, so it’s especially important to stay close to your business stakeholder to ensure that what they’re asking for is clear and aligned with the requirements throughout the procurement process. 

‍

For instance, there may be cases where your requestor may want to move quickly for business reasons—and it’s important to understand what these are and monitor any changes to avoid cases where procured software or tools then sit unused throughout the length of the agreement.

‍

Tips for getting started

Here are some additional tips from our team. We recognize that kick-starting procurement efforts can be both fun and challenging, and hope these points are helpful to keep in mind.

‍

• Do your research: Before going into conversations, have a clear sense of what your expected price and your budget are. This helps avoid last-minute surprises and can help set expectations for all parties involved. 

‍

• Ask for what you need: In the evaluation process, don’t be afraid to ask for a proof of concept (POC) to ensure the solution or product is exactly what you need. Not only does a POC offer your team a hands-on experience with the tool, but it can also help make a clear business case by ensuring it meets (or even exceeds) your requirements.

‍

• Keep track of renewals: Work closely with your Finance team to keep track of renewals—especially with differing lengths of agreements.

‍