Contract changes, invoices and payments

1. Regulatory Concept & Core Standards

This video focuses on how to identify controls needed after supplier selection. Follow the sequence of decisions in the example rather than simply memorising a list. Notice who is involved, what information is needed and the expected result. These points help turn the content into a practice that another person can verify. Risk arises from defining a need through payment and contract changes. For public procurement, check ZJN-3 and current official guidance. Recommended private-purchasing controls do not create identical statutory duties.

Changing a supplier’s bank account and changing contractual terms are different risks. Both need checking and traceability. In public procurement, amendments without a new procedure are limited by ZJN-3 article 95; internal approval alone is insufficient.

Apply the following rule: Article 7 generally requires register data to be kept for five years after the procedure ends, unless another Act provides otherwise. Personal data and the report’s contents are then destroyed; register metadata and the article 12(5) report may be retained longer under internal rules. This does not permit indefinite retention of the entire case. Clearly unnecessary personal data must not be collected and, if collected accidentally, must be deleted without undue delay.

2. Practical Implementation & Procedure

Confirm bank changes independently using a previously verified contact. Check the invoice against the contract and receipt. For a contract amendment document the permitted basis, extent and required publication. Do not treat every change as a general exception. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

An email requests a new IBAN just before payment. The team calls a previously verified number rather than the one in that message. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Why is replying to the same email not a sufficiently strong control? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

It may use the same compromised source. Use an independent contact and record the outcome before the change.

One mistake to avoid is: relaxing controls because of urgency or an established supplier relationship.

Now apply the national rule to a second decision. The system deletes every item two years after receipt. Is this suitable?

No. Two years since the breach ceased concerns protection, not retention. Article 7 generally uses five years after the procedure ends unless another Act provides otherwise. Distinguish destruction of personal data and contents from possible longer retention of permitted metadata and the report.