PA23 compliance built in. Not bolted on.

Is eSourcing Data fully PA23 compliant?

Yes. Built from the ground up for PA23. Every obligation - from Pipeline Notices to standstill - handled automatically.

How long are records retained?

All records retained for a minimum of 7 years in an immutable audit trail.

What if a procurement is challenged?

Your full audit pack exports in one click. Complete, formatted and ready for legal proceedings within minutes.

What compliance means under the Procurement Act 2023

The Act rebuilt UK public procurement around a set of objectives and duties rather than a set of procedural boxes. Contracting authorities must have regard to delivering value for money, maximising public benefit, sharing information so suppliers and the public can understand procurement decisions, and acting with integrity. Those objectives are not decoration. They shape how a regulator, an auditor or a court reads the decisions an authority made.

Alongside the objectives sit specific duties: equal treatment, treating suppliers without discrimination, having regard to barriers faced by small and medium sized enterprises, identifying and managing conflicts of interest, and a much broader publication regime. The move from directive style procedure compliance to duty and transparency compliance means that doing the process correctly is necessary but no longer sufficient. You also have to be able to show it.

That is the practical shift. Under the previous regime an authority could often defend itself by pointing at the procedure it followed. Under the Act the defence is the record: the reasoning behind the route to market, the analysis behind the criteria, the moderation notes behind the scores, the justification for a modification. Compliance has become an evidence discipline.

The notice regime and transparency duties

The Act extended publication across the whole life of a contract. Depending on route and value that can include pipeline notices for authorities with significant forward spend, planned procurement notices, tender notices, transparency notices where a direct award is being made, contract award notices before standstill, contract details notices after entry into the contract, contract change notices for certain modifications, contract performance notices, and contract termination notices.

The most common compliance failure here is not a missing notice at the start but missing notices later. Teams are organised around competitions, and a competition feels finished at award. Publication duties that fall due six months or three years afterwards belong to nobody unless someone assigns them, and they are exactly the sort of obligation that a spreadsheet reminder does not survive a staffing change.

Publication also has to be accurate. Notices that disagree with the contract register, or with what the authority publishes under its own transparency commitments, create an easily discoverable inconsistency. Publishing from a single authoritative record, rather than assembling each notice from scratch, is the only approach that scales past a modest volume of contracts.

• Assign ownership for post award notices explicitly
• Publish from the contract register, not from memory
• Reconcile published data with internal records periodically
• Treat transparency notices for direct award as high risk and evidence them fully

Direct award, exemptions and the decisions that attract scrutiny

Direct award is permitted in defined circumstances, including certain cases of extreme urgency, situations where only one supplier can deliver for technical or exclusivity reasons, and specific defined categories. Each of those grounds is narrow and each requires reasoning that stands up on its own. A transparency notice makes the decision public, which is appropriate and also means the justification will be read by people who did not make it.

Urgency is the ground most often misused, and the test is not whether the authority is under pressure but whether the urgency was foreseeable and attributable to the authority's own delay. A contract expiring on a known date is not an unforeseeable event. Documenting genuinely what happened, including where planning failed, is uncomfortable but far safer than a justification that will not survive a timeline check.

The same logic applies to framework call offs and to exemptions granted under an authority's own contract standing orders. Internal waivers are frequently the weakest evidenced decisions in an organisation, granted verbally and recorded afterwards in a single line. They are also the first thing internal audit samples, precisely because they are where process is being bypassed.

Conflicts of interest and integrity

The Act requires contracting authorities to take reasonable steps to identify and keep under review conflicts of interest, and to mitigate them where they arise. That covers anyone involved in the procurement, including evaluators, technical advisers and decision makers, and it is an ongoing duty rather than a form completed once at the start. Bidder lists sometimes reveal conflicts nobody anticipated, and declarations should be revisited when they do.

The practical control is a declaration process that is easy enough that people actually complete it, held in the procurement record rather than a separate register, with a documented mitigation where a conflict exists. A declared and managed conflict rarely causes a problem. An undeclared one, discovered later, casts doubt on the entire process regardless of whether it actually influenced anything.

Integrity also covers pre market engagement. Talking to potential suppliers before a procurement is encouraged, but it creates an obligation to ensure no supplier gains an advantage. Sharing the material outcome of engagement with the whole market, and allowing enough time for others to catch up, is the standard mitigation and should be recorded as a deliberate step.

Standstill, challenge and how disputes actually unfold

Standstill follows the contract award notice and gives unsuccessful suppliers a window to consider the assessment summary and decide whether to act. It exists so that a defective procurement can be corrected before the contract is entered into. Automatic suspension on issue of proceedings before contract signature is the mechanism that gives standstill teeth, and it is why the period should never be treated as an administrative formality to be compressed.

Challenges rarely begin with a claim form. They begin with a debrief question, then a request for more detail, then a letter before action. Each of those stages is an opportunity to resolve the matter, and each is answered from the procurement record. Authorities that respond promptly, specifically and consistently with what they published tend to see matters close. Authorities that respond slowly and generically tend to see them escalate.

The assessment summary is the pivotal document. It has to explain how the tender was assessed against each criterion and, where relevant, how it compared with the winning tender. It is written from the moderation record, which means the quality of a challenge defence is determined at evaluation, not at the point the letter arrives.

• Do not compress standstill for convenience
• Answer debrief questions promptly and specifically
• Never say anything in feedback that the record does not support
• Keep the whole procurement file intact once a dispute is foreseeable

Records, retention and audit readiness

An audit ready procurement file contains the business case and approval, the route to market decision and its reasoning, market engagement records, the published notice and documents in their final form, the clarification register, the submission log, conflict declarations, individual and moderated scores with rationale, the award recommendation and approval, the standstill correspondence, and the contract as executed. If any of those live only in an individual's mailbox, the file is not complete.

Retention periods should reflect both limitation periods for potential claims and the practical need to answer questions during the life of the contract and its successor. Deleting too early is a real risk, but so is keeping personal data indefinitely without a basis, since procurement files routinely contain named individuals on both sides. A stated retention schedule applied by the system beats a policy applied by intention.

Internal audit and external scrutiny ask different questions. Audit tends to test whether the authority followed its own contract standing orders and delegated authority limits. Challenge tests whether it followed the published rules and treated bidders equally. A single record captured during the process answers both. A record assembled retrospectively is both expensive to produce and less convincing.

Sector context: where compliance pressure concentrates

Local authorities face the widest exposure because of volume and because contract standing orders add a second layer of rules on top of the Act. The most common findings are not dramatic breaches but weak evidence around waivers, extensions and low value spend, which is where volume is highest and process discipline lowest. Below threshold duties under the Act make that area more visible than it used to be.

NHS bodies run under the Act for non clinical spend while healthcare services follow the Provider Selection Regime, and the compliance risk sits in the boundary. Getting the route determination wrong at the start is far harder to correct than any subsequent error. Housing associations must first establish whether they are contracting authorities, since that single determination changes every duty that follows, and building safety obligations add a further evidence burden.

Utilities operate under a distinct regime. Utilities dynamic markets replaced qualification systems under the Act, and utilities may charge suppliers membership and award fees and run member only tenders. General contracting authorities may not charge membership fees, and applying utilities practice by analogy is a mistake worth avoiding.

Dynamic Markets, frameworks and compliant routes to market

Dynamic Markets replaced Dynamic Purchasing Systems and carry their own compliance obligations. They are permanently open, membership cannot be capped, applications must be assessed within a reasonable time, and pending applications must be considered before a competition concludes. That last duty is the one most likely to be missed operationally, because it requires the competition team to check the application queue before award rather than treating membership as a fixed list.

Frameworks remain a legitimate and often sensible route, but a call off is only compliant if it follows the framework's own rules on direct award or further competition. Using a framework because it is quick, without checking whether the requirement falls within its scope and lot structure, is a well established route to a challenge from a supplier who was not on it.

For cloud software and related support, G-Cloud is a compliant and fast route. eSourcing Data software is available to public buyers through RM1557.15 G-Cloud 15, with 28 software services listed on the Digital Marketplace plus cloud support services. Framework purchases are made as call off contracts, so the buyer documents its search and evaluation on the Digital Marketplace and contracts under the framework terms.

How eSourcing Data supports compliance and audit

eSourcing Data covers source to contract including governance and audit, so notices, documents, clarifications, submissions, conflict declarations, scores, moderation rationale, award decisions, contract records and modifications sit in one place with a single audit trail. The design intent is that the compliance file assembles itself while the team does the work, because retrospective file building is where both cost and doubt come from.

Analytics and reporting give a compliance lead visibility across the portfolio rather than one competition at a time: which notices are due, which contracts are approaching expiry, where waivers cluster, which categories consistently attract few bids. That portfolio view is what turns compliance from a series of interventions into a managed position. Data is held in the UK and the platform operates in line with GDPR.

For authorities wanting to test their current position, the PA23 readiness checker gives a structured self assessment and the Procurement Library explains the official guidance, Procurement Policy Notes and commercial playbooks. Where the gap is capacity rather than knowledge, consulting and outsourced procurement support are available, and the software itself can be bought through G-Cloud 15 as a call off contract.