The bedding-in period is over and the Procurement Compliance Service publishes what it finds. Five governance risks decide whether an authority is exposed, and a compliance score shows where it stands.
For the first year of the Procurement Act 2023 most authorities were, reasonably, concentrating on the mechanics: new notices, the central digital platform, the competitive flexible procedure, revised contract procedure rules. That period is over.
Oversight has also matured. Compliance oversight sits with the Cabinet Office’s Procurement Compliance and Oversight function, delivered through the Procurement Compliance Service. The service investigates systemic and institutional non-compliance, considers referrals from anyone, and uses the powers in Part 10 of the Act: a notice requiring documents and assistance under section 108, recommendations under section 109 that an authority must have regard to, and guidance under section 110. It can ask for a progress report, which may include an action plan, and it can publish its findings and that report on GOV.UK.
So the practical question for a leadership team is no longer whether the new procedures have been adopted. It is whether the organisation’s procurement would hold up if someone outside it looked closely. In our experience five governance risks decide the answer.
1. Evidence scattered across emails, folders and disconnected systems
The Act expects an authority to be able to show why it did what it did: the route chosen, the value estimated, the exemption relied on, the evaluation applied. Most authorities have that evidence. Few can produce it for a given contract inside an afternoon. When the record lives in one officer’s inbox, a section 108 notice with a 30 day response period becomes a reconstruction exercise rather than a retrieval one.
2. Contract registers that are incomplete, inaccurate or out of date
The register is the first thing a reviewer opens, because it is the map to everything else. A register that omits contracts, carries wrong end dates or shows values that no longer match what is being paid tells a reviewer where to dig. It also makes the transparency duties impossible to meet reliably, since notices are driven by contract events the register is supposed to track.
3. Direct awards to incumbents without clear justification
Rolling a contract over with the existing supplier is sometimes lawful and often convenient. Under the Act a direct award needs a ground, a transparency notice published in advance, and a record of the reasoning. An award that was simply never re-competed, with no decision recorded, is the pattern most likely to draw a referral from a supplier who expected a competition.
4. Contract values drifting through extensions, variations and licence increases
A compliant award can become a problem after signature. Extensions that were never in the original term, variations that add scope, and software licence uplifts that compound year on year move a contract past the value that was approved and, at a certain point, past what the modification rules permit without a new procurement. Section 75 requires a contract change notice for qualifying modifications. Authorities that track spend by supplier rather than by contract rarely see the drift until it is large.
5. Payments that cannot be linked to a specific contract
The Act implies a 30 day payment term into every public contract, and section 70 now requires payments over 30,000 pounds under public contracts to be published. Both duties assume the authority can say which contract a payment belongs to. Where a meaningful share of spend cannot be tied to a recorded contract, the authority has either off-contract spend, an incomplete register, or both. Publication makes that visible to anyone who looks.
What the shift means
Eighteen months in, the standard has moved from adopting the Act to evidencing compliance with it. The authorities in the strongest position are not the ones with the most elaborate procedures. They are the ones that can state, with workings, how much of their spend is on contract, where the exceptions are, and what is being done about them.
That is a measurable position. Reconciling spend against recorded contracts produces a compliance score a board can understand, an analysis of the off-contract and non-compliant spend behind it, and a prioritised list of what to fix first. It is the starting point we recommend to any authority that wants to know where it stands before someone else tells it.
Sources: GOV.UK guidance on procurement compliance and oversight, updated August 2026; Cabinet Office, Procurement Compliance Service scope and remit; Procurement Act 2023, sections 68, 70, 75 and 108 to 110.