Public Procurement Audit: A Canadian Guide to Compliance & Accountability

What is a public procurement audit? (And how it differs from other audits)

Plain-language definition of a public procurement audit

A public procurement audit is a structured review of purchasing activity. It looks at how an organization identified a need, selected a procurement approach, invited and evaluated bids, awarded a contract and managed the work. The reviewer compares evidence, such as plans, approvals, evaluation records and contract documents, with the policies and requirements that apply to the organization.

The review may focus on one contract, a set of purchases or a particular process stage. Its purpose is to assess whether the work followed the applicable process and whether the file supports the decisions made. The scope determines what the auditor examines; it does not automatically cover every purchase or requirement.

Why audits matter for accountability and public trust

Public organizations need to show how they reached purchasing decisions and used public resources. A well-supported file lets a reviewer follow the path from the original need to the contract outcome. It can also help staff identify unclear procedures, approvals that need better documentation or controls that could be improved.

For teams, a review provides a practical basis for learning. Clear records make it easier to explain decisions, respond to questions and consider corrective actions. An audit does not guarantee that every decision was ideal, but it can help an organization understand what the evidence shows and decide what to do next.

Procurement audit vs. financial audit vs. performance audit

Different audits can examine the same activity from distinct angles. A financial review may include purchases as part of an organization’s accounts, while a procurement review centres on purchasing decisions and process records. A performance review asks whether programs or activities are achieving intended results. The exact scope depends on the audit mandate.

Who performs audits: internal auditors, external auditors and procurement professionals

Internal auditors work within an organization and may review procurement as part of its assurance activities. External auditors work independently of the organization being reviewed, under the authority and scope applicable to their role. Procurement professionals may explain processes, locate records and respond to questions, but they are not necessarily the auditors.

Responsibilities should be clear from the start: who sets the scope, gathers evidence, reviews it and receives the report. The people involved vary by organization and assignment. Understanding their roles helps staff cooperate while preserving the reviewer’s independence.

Key steps in conducting a public procurement audit

A planned review follows a clear sequence: define the question, decide what evidence is needed, assess it against applicable criteria, communicate findings and track agreed actions. The work should be proportionate to the assignment and grounded in organizational policies and relevant requirements. These steps offer a starting point, not a substitute for an audit mandate or jurisdiction-specific direction.

Step 1: Define the audit objective and scope

Write down what the review is meant to determine. The objective might concern one procurement file, a type of purchasing activity or whether specified procedures were followed. Set boundaries by identifying the period, transactions, process stages and records included. A precise scope prevents misunderstandings and keeps evidence gathering focused.

Step 2: Assess risk and plan the audit approach

Consider which parts of the process need closer attention in relation to the objective. The audit plan can identify relevant controls, responsible roles, likely records and the approach to reviewing transactions. Document the rationale, including any limitations. This gives the team a consistent method and helps explain why certain files or stages were selected.

Step 3: Gather evidence: documentation, interviews and sampling

Collect records related to the scope, such as needs assessments, approvals, solicitation documents, bid submissions, evaluation notes, award decisions, contract amendments and deliverable records. Interviews can explain how a process worked, but statements should be considered alongside documents. If the review uses sampling, record how files were selected and what the method can and cannot establish.

Step 4: Analyze findings against policies and applicable rules

Compare the evidence with the criteria identified in the audit plan, such as organizational procedures and applicable requirements. Note supporting evidence and gaps. Keep the analysis within scope, and distinguish a missing record from evidence that a step did not occur. If criteria are unclear, seek direction through appropriate organizational channels rather than making assumptions.

Step 5: Report findings and recommendations

Present each finding in language readers can understand. Explain the relevant criterion, the evidence reviewed and why the difference matters. Recommendations should address the issue and be practical for the responsible team to consider. Let the organization verify factual details before finalizing the report, while keeping the auditor’s conclusions independent.

Step 6: Follow up on corrective actions

Agree on who will respond to each accepted recommendation, what action is planned and when progress will be reviewed. Keep evidence of completed changes, such as revised procedures, approval records or staff guidance. Follow-up links reporting to improvement; without later review, an action plan may not show whether the issue was addressed.

Audit preparation checklist

Before fieldwork, confirm the scope, points of contact and secure process for sharing records. A consistent index helps reviewers trace evidence and reduces repeated requests. Staff seeking a structured foundation can consider Procurement Training. Individual, which offers Canadian-focused learning alongside workplace procedures.

• Confirm the audit objective, period and process boundaries.
• Identify the policies and criteria named in the review plan.
• Locate approvals, solicitation records, evaluation documents and contract files.
• Record who owns each document and how it will be provided.
• List questions requiring clarification and track responses.
• Note any missing records or scope limitations accurately.

Preparation means making relevant evidence accessible, not creating records after the fact. If a document is missing, record that clearly and follow the organization’s process for responding to the auditor.

Canadian compliance context: rules, policies and trade agreements

Why Canadian public procurement is shaped by multiple layers of rules

Public purchasing requirements can come from several sources. An organization may need to consider its procurement policy, applicable legislation, funding conditions and trade agreement obligations. Requirements depend on the organization, purchase and circumstances. For an audit, identify the criteria that applied at the time of procurement, then assess the file against them rather than relying on a general checklist.

An introductory look at trade agreements such as the CFTA and CETA

The Canadian Free Trade Agreement (CFTA) and the Canada-European Union Comprehensive Economic and Trade Agreement (CETA) include procurement commitments for covered entities and purchases. The Canadian Free Trade Agreement’s procurement materials set out thresholds that vary by province and procurement category. Check coverage and requirements against the current agreement text and applicable schedules; an agreement’s name alone does not establish whether a purchase is covered. The Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP) may also be relevant to some procurements.

When reviewing a file, look for records showing how the organization considered applicable coverage, thresholds and process requirements. A threshold is not a universal figure across Canada. Confirm current official information for the relevant jurisdiction and purchase before drawing a conclusion.

Federal, provincial, territorial and municipal differences, and where to find official guidance

Requirements and guidance can differ among federal, provincial, territorial and municipal organizations. Start with official procurement resources for the organization’s jurisdiction, then check its own policy and the applicable agreement text. Federal departments can consult Government of Canada procurement resources; provincial and territorial organizations should use their government’s procurement services; municipalities should check their local authority’s official guidance.

Staying in scope: this guide and jurisdiction-specific requirements

This guide introduces compliance review; it does not determine which rules apply to a specific procurement. If a requirement is unclear, document the question and seek guidance through the organization’s appropriate channels. Keep audit criteria tied to the assignment and current official sources. Procurement Training. Individual can support foundational learning, while organization-specific questions should be resolved using relevant policies and official guidance.

Common risks, red flags and typical audit findings in Canadian public procurement

Risk areas auditors watch for: planning, evaluation, sole-source and contract management

Risk review often follows the purchasing process. In planning, an auditor may examine whether the need, budget and procurement approach were documented. During competition, the review may consider whether evaluation criteria were clear, applied consistently and supported by records. A non-competitive or sole-source purchase may require a documented rationale and approval under applicable rules. After award, contract management records can show whether deliverables, amendments, payments and performance concerns were handled as intended.

Generic red flags and warning signs in procurement files

A warning sign is a reason to examine evidence more closely, not proof of misconduct. Examples include a missing approval, evaluation notes that do not explain scoring, criteria that appear to change during the process, or contract amendments without a clear rationale. A file gap may reflect poor recordkeeping, an incomplete transfer of documents or a process concern. The auditor should establish what the available evidence supports and note its limitations.

• Check whether approvals are dated and linked to the relevant decision.
• Compare solicitation requirements with the evaluation record and award rationale.
• Look for a documented basis for non-competitive decisions and contract changes.
• Trace key contract obligations to acceptance, performance and payment records.

How findings are typically categorized and communicated

Findings generally describe the criterion, the evidence observed and the difference between them. Reports may explain why an issue matters, such as creating uncertainty about consistent process application. Wording and categories vary with the audit mandate and organization. A careful report distinguishes a confirmed control gap from a question needing more evidence and avoids claims beyond the review’s scope.

What happens after an audit finding

An organization may be asked to confirm facts, provide additional records or respond to recommendations. Responsible managers can consider corrective actions, assign ownership and set a follow-up approach under internal processes. An audit finding alone does not establish misconduct or determine a consequence. Respond calmly, preserve relevant records and use established reporting channels if a concern needs separate attention.

For staff developing their knowledge, Procurement Training. Individual is a Canadian-focused learning option. Its stated format is a Combination of self-directed learning with instructor-led live sessions, within a Comprehensive progression path from beginner to procurement expert and Canadian-focused public sector procurement training with PDP certification.

Building audit-ready procurement practices and where to learn more

Audit readiness comes from ordinary work habits, not a last-minute effort to make a file look complete. Clear records help staff explain decisions and give reviewers a reliable path through the procurement. Consistent practices also support handovers when responsibilities change. The aim is to retain useful evidence as work happens and make accountability part of the process, not to create paperwork for its own sake.

Habits that make future audits easier: documentation, transparency and consistency

Record decisions close to the time they are made. Use a consistent file structure, name documents clearly and keep approvals, correspondence and decision records with the procurement they concern. When a decision changes, note what changed, who approved it and why. Follow organizational rules for records management and access, including requirements for handling confidential information.

Consistency across the file lets a reviewer trace the need, approvals, process, decision and contract administration without relying on one employee’s memory. A brief note explaining a decision can be more useful than an unexplained document added later. Do not recreate missing records as though they were contemporaneous; describe the gap accurately and use established procedures to respond.

How auditors and procurement teams can work together constructively

Good cooperation starts with clear roles and a shared understanding of the review scope. Procurement staff can identify record owners, explain terminology and point to relevant procedures. Auditors can describe the evidence they need and how it relates to the review. Both sides benefit from organized requests, timely responses and questions that distinguish a clarification request from a formal finding.

Keep responses factual and traceable. If a record is unavailable or a process is unclear, say so rather than guessing. Respectful exchanges help auditors understand the file while preserving review independence. They also give the team a chance to identify improvements based on evidence, not assumptions.

A hypothetical learning scenario: preparing a file for review

Imagine a staff member has been asked to prepare a file for an upcoming review. They start with the approved index, check that key decisions can be followed from the needs record to contract management, and note where a document is held elsewhere. They find that an approval is not in the folder, so they record the gap and ask the appropriate record owner whether the approval exists. This helps the reviewer understand the available evidence without suggesting a missing item has been recovered or recreated.

Next steps for building foundational procurement knowledge in Canada

Choose a learning goal tied to your work, such as understanding file documentation, evaluation records or contract administration. Compare that goal with official guidance and your organization’s procedures. For structured study, Procurement Training. Individual is one option to explore. Procurement Training. Individual offers a Comprehensive progression path from beginner to procurement expert, Canadian-focused public sector procurement training with PDP certification, and a Combination of self-directed learning with instructor-led live sessions.

Frequently Asked Questions

What is the purpose of a procurement audit?

The purpose of a procurement audit is to assess whether purchasing decisions followed applicable policies and whether the procurement file supports those decisions. Beyond checking for errors, an audit helps organizations document accountability, identify unclear procedures and strengthen controls, which supports public trust in how public resources are used.

What are the 5 C's of audit?

The 5 C’s of audit are commonly described as criteria, condition, cause, consequence and corrective action. Together, these elements shape audit findings: what standard applies, what the evidence shows, why a gap exists, what impact it has, and what steps will address it. Teams preparing for a public procurement audit benefit from understanding how reviewers structure their findings.

What are the 7 stages of procurement?

The 7 stages of procurement typically include identifying the need, planning the procurement approach, soliciting bids, evaluating submissions, awarding the contract, managing the contract and closing out or reviewing the work. A procurement audit examines how an organization carried out these stages and whether records support the decisions made at each one.

What are the 5 pillars of procurement?

The 5 pillars of procurement are generally described as value for money, transparency, fairness, accountability and ethical conduct. These principles guide how public organizations plan, compete, award and manage purchases. Auditors compare procurement files against these expectations to see whether the process supported sound, defensible decisions.

What are the three C's in procurement?

The three C’s in procurement are commonly identified as compliance, cost and quality, though some frameworks use different terms. Compliance means following applicable policies and requirements, while cost and quality relate to achieving value for money. In a public procurement audit, evidence such as approvals, evaluations and contract records shows how these considerations were addressed.

How does a procurement audit differ from a financial audit?

A procurement audit centres on purchasing decisions and process records, asking whether the procurement file supports the steps taken. A financial audit focuses on an organization’s accounts, transactions and reporting instead. The same purchase activity can appear in both reviews, but each examines a different set of questions and documentation.

Who can conduct a public procurement audit?

A public procurement audit can be carried out by internal auditors who work within the organization or by external auditors who work independently under their own mandate. Procurement professionals often help by explaining processes and locating records, but their role is to support the review while preserving the auditor’s independence.