The audit trail that isn't
Email threads are not an audit trail. They are a discoverable, unstructured liability. SOX 404 controls assume reproducible approval chains; a forwarded thread with three signatures and a missing attachment doesn't qualify.
Once you cross 50 US employees you're typically also crossing into multi-state nexus, 1099 vendor onboarding obligations, and (often) bank covenants that require documented procurement controls.
The cash you're already losing
Typical symptoms: duplicate POs, off-contract maverick buys, missed auto-renewals and low realized savings.
The five risks compliance teams flag first
When we walk a US compliance officer through an email-based procurement workflow, the same five flags come up — every time.
- Vendor 1099 / W-9 collection happening informally in DMs
- Approval requirements handled informally rather than through a documented human review
- PII and pricing exchanged over unencrypted reply chains
- No segregation of duties between requester, approver and AP
- Departed employees still copied on supplier threads months later
What 'good' looks like at 50–500 employees
You don't need an enterprise suite. You need: a request form, one approver before every PO, a vendor master with W-9s on file, and a monthly savings reconciliation. That's it. Anything heavier is over-engineering for this stage.
