MAINSYSTEMS 
identify controls needed after supplier selection
1. Regulatory Concept & Core Standards
This video focuses on how to identify controls needed after supplier selection. Follow the sequence of decisions in the example rather than simply memorising a list. Notice who is involved, what information is needed and the expected result. These points help turn the content into a practice that another person can verify. Examples address preventive purchasing controls. Public procurement and private purchasing have different legal frameworks. For public procurement, consider amendment NN 48/2026: general commencement on 16 May 2026, specified provisions on 1 September and the transitional rule for procedures already started.
Public Procurement Act Article 314 permits modification without a new procedure only under Articles 315–320. The 2026 amendment adds EOJN RH publication within 30 days of modifications under Articles 315, 318, 319 and 320, subject to the applicable transitional regime. An internal signature alone does not establish legality. Payment-recipient verification is a separate control.
Apply the following rule: Article 18 requires a record of every report and preservation in a durable form under national rules on protection and processing of documentation. It does not establish a universal five-year period or justify indefinite processing of all personal data. Determine applicable documentation and archival duties and GDPR purpose and retention limits. Under Article 15, manifestly irrelevant personal data must not be collected and, if collected accidentally, must be deleted without undue delay.
2. Practical Implementation & Procedure
Compare contract, actual delivery, invoice and authority. Check a modification’s legal basis and publication duty. Verify changed bank details through an independently established contact. Record the check and approval; urgency does not itself waive controls. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.
3. Case Study & Compliance Action
An urgent message requests a new IBAN for an outstanding invoice. The team uses a previously verified contact and learns that the supplier requested no change. The control prevents payment based on an apparently genuine email. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.
The exercise is as follows: Why should the new IBAN not be checked only through the number supplied in the message? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.
That contact may form part of the same fraudulent request. Verification needs an independent, previously verified source. The procedure must specify who confirms and what evidence they retain.
One mistake to avoid is: relaxing controls because of urgency or an established supplier relationship.
Now apply the national rule to a second decision. The system deletes every case five years after receipt, regardless of the country and any pending proceedings. Is that appropriate?
No. Identify the local rule, starting event and any limits or extensions. A uniform schedule may delete records too early or retain them too long. Document the decision by category, include copies and define who reviews a suspension of deletion, rather than keeping everything indefinitely.