Five weeks from “yes” to signature: how a public company actually buys software
The evaluation team picked a vendor on 30 April. The contract was signed on 4 June. In between: sanctions screening, security, privacy, legal, negotiation, FP&A and a three-level approval chain. The path, the documents and the mistakes that cost a week.
Most project management courses treat procurement as a chapter you memorize for the exam: contract types, the point of total assumption, a formula or two. In a real company, procurement is where your schedule goes to die if you don't understand it. This is the story of one purchase, followed from the scoring sheet to the purchase order.
The project is Ledger: replacing an old, partly custom travel-and-expense tool at a public software company of about 2,000 people. Expense reports took eleven days to reimburse. Accounts payable spent hundreds of hours a month chasing receipts. And because expense data flows into the general ledger, the system matters for Sarbanes-Oxley, which brings formal controls to everything that follows.
Step one: score the vendors before you meet them
The single most important procurement habit is boring: agree the evaluation criteria and their weights before any proposal is opened, so the evaluation can't be bent toward a favorite. Ledger's team agreed theirs on 12 March, before the RFP went out.
| Criterion | Weight | Spendwise | Expensa | TripTally |
|---|---|---|---|---|
| Functional fit to the BRD (Musts and Shoulds) | 30% | 4 | 5 | 3 |
| Integrations (Okta SCIM, Workday, NetSuite, card feeds) | 20% | 5 | 3 | 3 |
| Security and privacy (SOC 2, data residency, sub-processors) | 15% | 4 | 4 | 3 |
| Usability (sandbox trial with 12 employees) | 15% | 4 | 4 | 5 |
| 3-year total cost of ownership | 10% | 3 | 2 | 5 |
| Vendor viability, support model, references | 10% | 4 | 4 | 3 |
| Weighted score | 4.10 | 3.90 | 3.50 |
Recommendation: Spendwise. Expensa had the richest features but weaker integration claims; TripTally was cheapest and best-liked by trial users but failed two Must requirements. Note for the record: Spendwise's SCIM claim rests on its RFP response; logged as assumption A-01 with a sandbox test before go-live.
That last note is the most valuable sentence on the page. The team noticed that the winner's strongest score rested on a claim, not a demonstration, and logged it as an assumption to test. In August the claim turned out to be partly false. Nobody was surprised, the contract already contained the language the PM needed, and the response had been planned months earlier.
Two more disciplines kept the process honest. An independent cost estimate, prepared before bids arrived, put the implementation partner's work at $165k–$210k; one bid came in at $142k and turned out to exclude hypercare and cutover support, a scope gap the estimate exposed. And a recorded bidder conference on 22 March gave every bidder the same information, with every question and answer published to all of them in writing.
Step two: understand the company's rules before you promise anything
Read that again as a scheduler. Security and privacy reviews alone can take two weeks each. A project plan that puts “contract signed” three days after “vendor selected” isn't optimistic. It's fiction.
Step three: the five weeks
Spendwise was selected on 30 April. The contract was signed on 4 June: five weeks, one week later than planned. Here is the path, reconstructed from the purchase request's history in Zip.
| Step | Dates | What happened |
|---|---|---|
| Sanctions screening | 30 Apr – 3 May | The vendor's full legal name was needed; the first attempt used the brand name |
| Security review | 3 – 17 May | Questionnaire returned 7 May; two follow-ups on sub-processors; third-party risk logged |
| Privacy review (parallel) | 3 – 18 May | Data processing agreement negotiated: EU data-region pinning, sub-processor notification |
| Legal review (parallel) | 6 – 26 May | Vendor paper redlined: liability cap raised to 2× annual fees; SCIM support written into the SLA exhibit |
| Negotiation | 10 – 24 May | 3-year term; renewal cap +5% a year; VAT module bundled; migration tooling included for signature by 30 June |
| FP&A and approvals | 26 May – 2 Jun | Coupa approval chain by contract value: FP&A → VP IT → CFO |
| Signature and PO | 3 – 4 Jun | DocuSign; purchase order released 4 June; kickoff 9 June |
The one-week slip came from the legal redline cycle. The PM's lesson for the register: start the vendor's security questionnaire during the RFP, for the finalists, not after selection.
Two details show how procurement and project management feed each other. The SCIM assumption from the evaluation became a contractual commitment in the SLA exhibit, with a date. And the negotiation turned a risk into a closed item (the VAT module, bundled) and an opportunity into a saving (free migration tooling if signed by 30 June). The contract value: three years at $380k a year, $1.14M.
The agreement stack
A SaaS purchase is never one document. Ledger's included a master subscription agreement (the legal terms), an order form (products, quantities, price, term), a service level agreement (availability, support response times, credits), a data processing agreement with standard contractual clauses for international transfers, and a security addendum. The implementation partner added a statement of work under its own master services agreement.
| Term | What it means for the PM |
|---|---|
| Limitation of liability | A cap on damages, often a multiple of fees. Ledger raised it to 2× annual fees. |
| Acceptance | How and when the buyer confirms deliverables. Passive acceptance after N days protects sellers from silence. |
| Service credits | The usual remedy for missed SLAs. Rarely large enough to matter; the real value is a structured way to escalate. |
| Change order | A written modification to scope, price or schedule, signed by both parties. Verbal agreements create disputes. |
| Termination for convenience | Ending without fault, with notice and payment for work done. |
The most dangerous sentence in procurement
After the signature: acceptance is not payment
The implementation partner, Apex Advisory, worked under a firm fixed price with four milestones. The PM's tracker deliberately separated acceptance (a project decision, made by a named person against written criteria) from payment (a finance transaction, triggered by acceptance and approved in Coupa by someone else). That separation is a Sarbanes-Oxley control: the person approving the invoice can see the acceptance record, and the person accepting the deliverable isn't the one releasing the money.
| Milestone | Acceptance criteria | Amount | Accepted by | Status |
|---|---|---|---|---|
| M1 Design | Design document approved; walkthrough with Internal Audit | $45,000 | Business Lead | ✓ Paid 6 Aug |
| M2 Configuration and SIT | Tenant passes SIT exit criteria (≥ 98% pass, no open critical/high) | $78,000 | Program manager | ✓ Paid 8 Oct |
| M3 UAT and cutover | UAT signed off; cutover complete; runbook delivered | $21,000 | Business Lead | ✓ Invoiced 5 Oct |
| M4 Hypercare exit | Hypercare report; admin handover guide; knowledge transfer | $36,000 | Program manager | Q4 |
| CO-A | 92 h re-sequencing and extended SIT support for the SSO delay | $18,000 | Sponsor | Approved 26 Aug |
| CO-B | VAT line-level configuration for 6 countries | $14,000 | Sponsor | Approved 26 Aug |
When Coupa would have said no
One more procurement lesson hides in the budget. Ledger's plan put $310k of spending in fiscal Q3, plus about $60k of expected contingency, against an FP&A allocation of $330k: a $40k gap. Asking for more money mid-quarter meant competing with other projects; moving work meant moving go-live. The PM moved payments instead. The partner's milestone 4 ($36k) was tied to hypercare exit, which fell on 5 November, in Q4; a $4k training invoice moved with it. The gap closed without touching the schedule.
The book puts it plainly: the reconciliation took two emails and a calendar check. Discovering the gap in October, when Coupa refused the purchase order, would have taken a crisis.
How students practice this
In week 8, students write the procurement statement of work, agree weighted criteria, prepare an independent cost estimate, publish bidder-conference answers, draft the purchase request and its approval chain, and build a contract term sheet. In week 12 they run the vendor relationship: the milestone tracker, a scorecard with evidence for every score, and an SLA credit claim.
Adapted from Projects, For Real, chapters 20, 25 and 35. The projects, people, vendors and numbers are the book's fictional case studies, set against GitLab's publicly documented practices. Gantt Guild is not affiliated with GitLab Inc.
