Every procurement review starts the same way. Pull the policy. Line it up against two or three well-regarded international frameworks. Circle the gaps. It feels rigorous. It looks like due diligence. And it tells you almost nothing about where the real risk actually sits.
Here is why. A policy document describes an idealised process: who signs, at what threshold, in what order. What it cannot capture is what happens when that process meets a real transaction, under real time pressure, with a real person deciding whether to follow the documented path or the faster one sitting right next to it.
So instead of comparing documents, map the behaviour. Who actually initiates a request? Who has informal influence over vendor selection long before the formal process even starts? Where do approvals get rubber-stamped because the approver never had the time, or the information, to genuinely evaluate the decision? Where have exceptions become so routine that they have quietly become the real policy?
Do this properly and a pattern emerges almost every time. The written policy is rarely the problem. The problem is the gap between who the policy says holds authority and who is actually exercising it.
And this gap does not shrink as an organisation grows. It widens. In a small operation, shortcuts are visible and get corrected fast, because everyone sits close to the transaction. In a larger institution, layered with stakeholders and governance structures, the same shortcut can become normalised long before anyone with the authority to fix it even knows it exists. By the time it surfaces, usually through an audit finding or a failed transaction, it looks like a policy failure. It almost never is. It is an enforcement failure, sitting several steps downstream of a policy that was actually written reasonably well.
None of this makes benchmarking useless. It has a real place: catching missing thresholds, unclear escalation paths, absent conflict of interest provisions. But it belongs second, not first. The first step is establishing what is actually happening today, independent of what the policy claims should happen. Only once that gap is visible does a comparison against international standards become a genuine diagnostic, instead of a comparison between two documents that might both be equally disconnected from reality.
The institutions that get real value from a procurement review are the ones willing to see that gap in writing, uncomfortable parts included, before spending another hour deciding which international standard to adopt next.