Risk Management and Compliance

In the context of public procurement, risk management and compliance play a decisive role to guarantee the proper use of public funds, preserve the reputation of contracting entities and ensure the reliability of the purchasing process. Contracting authorities face a multitude of risks (legal, financial, operational, ethical, etc.) that may impact the quality of public service and the satisfaction of needs. It is therefore essential to set up a structured framework to identify, assess, control and monitor these risks, while ensuring compliance with legal and regulatory obligations.

In this article, we examine the main risks related to public procurement, present the tools and methods of risk management, and explain the importance of a robust compliance system to secure public procurement.

Why is risk management crucial in public procurement?

Respect of the general interest

• Public funds must be used efficiently and transparently, without waste or misuse.
• Poor risk management can lead to delays, additional costs, even loss of citizens’ trust.

Legal security

• Public bodies are subject to a strict framework (laws, regulations, European directives).
• Irregularities (lack of competition, failure to comply with procedures) expose them to litigation, financial sanctions or contract annulment.

Fraud and corruption prevention

• Public contracts can be targeted by unlawful practices (favoritism, conflict of interest, collusion, bribes).
• Establishing controls and alert mechanisms limits these risks and protects the organization’s reputation.

Performance steering

• Unforeseen events (price fluctuations, delivery delays, stockouts) affect quality and costs.
• Identifying and anticipating these risks enables informed decisions and helps maintain contract performance.

The main risks in public procurement

Legal and regulatory risks

• Non-compliance with procedures (publicity, competition, selection),
• Non-compliant contractual clauses, unlawful amendments,
• Conflicts of interest or legal incompatibilities.

Financial risks

• Budget overruns, poor cost estimates,
• Late payments (default interest), additional costs due to disputes,
• Supplier financial failure (supply disruption, non-completion of works).

Operational risks

• Delivery or execution delays (works, services),
• Technical non-conformity, quality or performance defects,
• Coordination difficulties between actors (subcontractors, project owners, etc.).

Ethical and reputation risks

• Corruption, favoritism, bid-rigging,
• Misappropriation of funds, overbilling,
• Negative media coverage, loss of public trust.

CSR and environmental risks

• Insufficient consideration of social and environmental criteria,
• Uncontrolled ecological impact (carbon emissions, pollution, etc.),
• Non-compliance with labor standards and human rights in the supply chain.

The steps of risk management

Risk identification

• Context analysis: legal environment, type of contract (works, supplies, services), complexity, organization’s history.
• Mapping: list sensitive areas (large financial volume, nature of the asset, supply criticality), use past experience.

Assessment and prioritization

• Probability of occurrence: determine the frequency or likelihood of the risk appearing (low, medium, high).
• Severity of impact: measure the potential effect on cost, deadlines, quality or image (minor, moderate, critical).
• Risk matrix: prioritizes the most critical risks (high probability + strong impact).

Treatment and control plan

• Prevention: strengthen internal control, train officers, clarify procedures, require financial guarantees from suppliers.
• Reduction: introduce contractual clauses (late penalties, performance obligations), separate sensitive tasks, diversify supply sources.
• Transfer: take out insurance (civil liability, decennial guarantee), outsource certain missions.
• Acceptance: for low or controlled residual risks (cost of control > benefit).

Monitoring and update

• Continuous control: performance indicators, internal audits, periodic reviews.
• Map update: take into account legislative, technological or economic developments.
• Communication: share information with stakeholders (management, buyers, technical services) to strengthen risk culture.

Compliance: a major challenge in public procurement

Definition of compliance

Compliance consists of respecting all laws, rules and ethical principles applicable to the activity of the public organization. In public procurement, this implies:

• Strict application of the regulation (codes, directives) on awarding and execution,
• Anti-corruption measures (ethics charter, code of conduct, conflict-of-interest control),
• Procedures against fraud, collusion and money laundering,
• Internal and external control mechanisms (audit, regulatory authorities).

Implementing a compliance system

• Compliance policy:
  • Express clearly the organization’s values and commitments (zero tolerance for corruption, absolute respect of competition rules).
  • Develop a code of conduct, internal regulations, specific charters (gifts, hospitality, conflicts of interest).
• Accountability and governance:
  • Appoint a referent (compliance officer, deontologist) or a compliance committee, in charge of regulatory watch and coherence of the system.
  • Identify relays in each department (legal, procurement, finance).
• Training and awareness:
  • Regularly inform and train public agents on ethics issues, sanctions, good practices (consultation processes, electronic signature, confidentiality).
• Controls and sanctions:
  • Set up regular controls (internal control, audits, corrective action plans).
  • Provide disciplinary and legal measures in case of serious breach.
• Alert line and reporting mechanisms:
  • Allow agents and suppliers to report suspicious behavior (whistleblowing) while guaranteeing the protection of whistleblowers.
  • Analyze alerts and take the necessary corrective measures.

Tools and methods to strengthen risk management and compliance

Procurement Information Systems (S2P, P2P)

• Automation of award and execution processes, traceability of decisions, approval management.
• Blocking of spending non-compliant with internal policies.

Analytics and data-mining solutions

• Anomaly detection, transaction monitoring (contracts, invoices) to identify fraudulent patterns (e.g. illegal splitting, overbilling).

Dematerialization platforms

• Centralization of tenders, transparency, electronic archiving, market watch.
• Enhanced security (encryption, electronic signature) to limit the risks of falsification or data corruption.

Dynamic risk mapping

• Real-time update of risk factors (legal developments, lessons learned, incidents), displayed on a shared dashboard.

Internal/external audit

• Periodic audit program to assess the compliance and relevance of the risk management framework (see Control and Audit of Public Procurement).
• Integration of the CSR dimension (social and environmental criteria) and analysis of supplier risks (bankruptcy, dependency).

Key success factors for high-performance execution

• Management support: a strong political will is essential to establish an ethics and control culture and unlock the necessary resources (budgets, hiring).
• Global and integrated approach: risk management and compliance must be cross-functional (procurement, finance, legal, technical) and not siloed.
• Continuous training: regularly raise awareness among agents, update knowledge on regulation, fraud methods, good practices.
• Communication and transparency: disseminate rules, sanctions, performance indicators, value lessons learned.
• Continuous improvement dynamic: draw lessons from audits, adjust policies, tools and procedures, monitor the evolution of technologies and threats.

In summary

In the public procurement sector, risk management and compliance are major levers to:

• Protect the public organization from errors, fraud, corruption and financial risks,
• Improve performance (quality, deadlines, cost control),
• Comply with legislative and regulatory rules, ensuring the general interest.

For Procurement professionals and students, it is essential to:

• Know the specific risks (legal, financial, operational, ethical) and the control mechanisms (internal control, CSR, anti-corruption plan, audits),
• Set up a risk management system (mapping, assessment, action plan) and a robust compliance program (code of conduct, training, reporting),
• Leverage digital tools (S2P, data analytics) to strengthen traceability, anomaly detection and transparency,
• Adopt a cross-functional and collaborative approach, bringing in internal stakeholders (finance, legal, management) and external ones (suppliers, supervisory authorities) in the fight against risks and the promotion of ethics.

Overall, the systematic and structured consideration of risks and compliance in public procurement guarantees a sound, performance-oriented and sustainable management of public spending, in line with legal requirements and society’s expectations.