Compliance means something different for every organization. It starts with the fact that every industry has its own set of rules. The level of regulation plays a major role in determining the role of compliance in the day-to-day operations of departments such as Procurement and Accounts Payable. This is evident from the story of Procurement Officer Annemarie van den Hout and Operations Manager Ronald de Heij, both of the Dutch Development Finance Institution (FMO). What does compliance mean to them?
FMOis a financial institution with a banking license. This means it is regulated by De Nederlandsche Bank (DNB) and the European Banking Authority (EBA). Therefore, it must operate in accordance with the guidelines set by these authorities.
In addition, they must, of course, comply with the law. These range from general laws that apply to every company, such as the General Data Protection Regulation (GDPR), to specialized laws for financial institutions, such as the Anti-Money Laundering and Counter-Terrorist Financing Act (Wwft).
Annemarie started as a Procurement Officer at FMO in 2020. Her task? To set up a professional, centralized, and compliant procurement process. “At that time, procurement was scattered throughout the organization.There were different procedures,” she explains.
Since Annemarie joined, that has changed. This shift is largely driven by the strict guidelines from DNB and the EBA. For example, theoutsourcing guidelines published by the EBA in 2019 prescribe in detail how companies like FMO must deal with critical suppliers, of which 4CEE is one.
Ronald explains: “4CEE handles our entire automated invoice processing. If that were to come to a halt, we’d have a major problem.” That’s why the contract between the two parties includes an EBA addendum, which sets out the additional requirements not included in the standard contract.
“It’s not a matter of ‘I need something and this supplier provides it, so we’ll sign a contract.’ No, there are rules for that.”
These guidelines play a major role in Annemarie’s work. After all, without suppliers, there’s no procurement. Requirements are set for every phase of the relationship between FMO and the supplier. It starts right from the first meeting; even before the contract is signed, many issues need to be considered.
Annemarie: “In addition to‘know your customer,’‘know your supplier’ is a crucial part of compliance. It’s not a matter of ‘I need something and this party supplies it, so we’ll sign a contract.’ No, there are rules for that. You have to think carefully in advance about who you’re partnering with.”
For example, they assess whether the supplier is financially sound. Can they weather setbacks, and are they not on the verge of collapse? Of course, this is closely monitored later on, throughout the entire partnership; after all, things can always change. The focus is therefore on proactive credit management.
FMO also examines the supplier’s organizational structure and whether the company, like 4CEE, is ISO-certified. This provides additional assurance that they have quality and safety standards in place.
FMO operates extensively in high-risk areas. For suppliers in these types of locations, a few additional checks apply. For example, FMO must verify whether the party in question has ever been convicted of financial crimes and whether there are anypolitically exposed personsinvolved. “That increases the risk of bribery,” Annemarie explains.
We also check whether the party is subject to sanctions. “What about the war in Ukraine? Can we still work with certain parties, or do we need to look for an alternative?”
If a supplier passes all the checks, then we can work together. But the EBA’s requirements don’t stop there. Annemarie: “Supplier management is important. It’s crucial to continuously monitor potential risks and mitigate them jointly as much as possible. The supplier—in this case, a company like 4CEE—bears a major responsibility in this regard. It’s up to that party, for example, to maintain its certification, to regularly test its own systems and backups, and to continue reporting on its status. We’ve also included these kinds of provisions in a Service Level Agreement (SLA). This ensures the quality and reliability of their services.”
"It’s important to continuously monitor potential risks and work together to mitigate them as much as possible."
A SaaS Service Level Agreement sets out agreements between the customer and the provider regarding, among other things, the quality, availability, and security of the service. 4CEE offers SLAs with various service levels. FMO has opted for the most comprehensive Service Level Agreement, as it offers the greatest certainty and guarantees.
For example, it includes agreements regarding the promised uptime for Basware and the additional 4CEE solutions. It also contains agreements on response times in the event of issues, how long data is stored, and how it is protected. But another key part of the Service Level Agreement is that 4CEE provides access to the full audit reports for the ISO certifications and that comprehensive monthly reports are provided on how the service is performing.
Annemarie says, “You can never have a 100 percent guarantee, but you can prevent as much as possible.” That is exactly what this Service Level Agreement is for: it not only guarantees the highest possible quality of the solution but also complete transparency. As a result, both parties always know where they stand, and nothing is left to chance.
Let’s go back to EBA’s requirements for a moment. These aren’t just about the period before and during the relationship with the supplier; the end of that relationship must also be considered. “We need to have a detailed exit plan ready for every supplier,” Annemarie explains.
“For example, we can’t switch from one automated invoice processing solution to another overnight. That’s not something you can just do; it requires a plan. That’s why, when we entered into the partnership with 4CEE, we already discussed what that plan would look like, should it ever come to that. In fact, it’s just like a marriage or a cohabitation agreement; you also lay out in advance who gets what if you ever split up.”
In summary, Annemarie says: “A lot is expected of us and our suppliers.We can’t cut any corners; we have to stay on top of things.”
Ronald adds: “That ultimately pays off. If you have as many things as possible in order at the front end of the purchase-to-pay process, then at the back end you really just have to verify.” That’s why compliance plays only a minor role in the day-to-day operations of Accounts Payable and Receivable compared to Procurement. Of course, employees need to be vigilant when processing invoices to ensure they don’t spot anything suspicious, but we’re talking about exceptions here.”
“For us, compliance primarily means meeting all requirements,” Annemarie concludes. “That’s an ongoing effort, because those requirements change regularly and generally only become stricter. The specific implementation is always risk-based. What do we need, at a minimum, to minimize our risk?”