MAINSYSTEMS 
identify controls needed after supplier selection
1. Regulatory Concept & Core Standards
This video focuses on how to identify controls needed after supplier selection. Follow the sequence of decisions in the example rather than simply memorising a list. Notice who is involved, what information is needed and the expected result. These points help turn the content into a practice that another person can verify. Examples focus on procurement prevention controls. Public procurement rules differ from private purchasing procedures. Adapt measures to sector, risk and decision authority rather than treating internal examples as universal legal requirements. The law of 16 May 2023 governs the reporting channel. Proposed risk plans, codes, calendars and control tools are organisational good practice unless a separate applicable rule creates a duty. Public-service or public-procurement requirements must not be generalised to every private business.
An initially proper procurement may be compromised by unjustified price, quantity or scope changes. Receipt must establish delivery and the invoice must match what is due. Bank-detail changes are another sensitive point. Controls must connect records with actual performance, not merely completed fields.
Apply the following rule: Article 23 subjects processing to data-protection law. Apply GDPR article 5(1)(e): keep identifiable data only as long as necessary for the purposes, subject to lawful exceptions. The whistleblowing law does not prescribe a universal five-year period for all channels. Under article 23(2), clearly irrelevant personal data must not be collected or must be deleted without undue delay. Document duration, purpose, starting event and review, including copies and any applicable legal or public-archive obligations.
2. Practical Implementation & Procedure
Match contract or order, receipt evidence and invoice. Review changes and approvals. Check duplicates and unusual payments. Confirm bank changes independently through a previously verified contact under the procedure. Do not rely only on contact details in the change request itself. Record exceptions and authorisation. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.
For public procurement, consult the law of 8 April 2018 and the current official procurement portal. A contract amendment needs a permitted legal basis and its conditions, not merely management approval. The Grand-Ducal Regulation of 17 September 2026 on standardised specifications was published on 29 September and takes effect on 3 October 2026, after this edition's reference date. It is not presented as already in force on 1 October. This course does not reproduce a complete procurement procedure or monetary thresholds.
3. Case Study & Compliance Action
An urgent message requests a new IBAN for an outstanding invoice. The team uses a previously verified contact and learns that the supplier requested no change. The control prevents payment based on an apparently genuine email. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.
The exercise is as follows: Why should the new IBAN not be checked only through the number supplied in the message? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.
That contact may form part of the same fraudulent request. Verification needs an independent, previously verified source. The procedure must specify who confirms and what evidence they retain.
One mistake to avoid is: relaxing controls because of urgency or an established supplier relationship.
Now apply the national rule to a second decision. The system deletes every case five years after receipt, regardless of the country and any pending proceedings. Is that appropriate?
No. Identify the local rule, starting event and any limits or extensions. A uniform schedule may delete records too early or retain them too long. Document the decision by category, include copies and define who reviews a suspension of deletion, rather than keeping everything indefinitely.