Kean University SOP 02 – Pre‑Procurement Risk Assessment
Table of Contents
- About
- Scope
- Definitions
- Roles & Responsibilities
- Procedure
- Risk Tiers & Approvals
- Records & Retention
- Metrics & KPIs
- Related Policies
About
This Standard Operating Procedure (SOP) defines the required process for conducting a Pre‑Procurement Risk Assessment before initiating the acquisition of goods, services, software, systems, infrastructure, or consulting engagements.
The assessment ensures procurement decisions align with institutional risk tolerance, cybersecurity, accessibility, financial stewardship, and lifecycle sustainment requirements.
Scope
This SOP applies to all procurement requests that:
- Use University or grant‑funded resources
- Introduce new systems, software, cloud services, or integrations
- Involve access to, storage of, or processing of University data
- Require vendor onboarding or contractual review
- Impact operational, compliance, cybersecurity, or accessibility risk
This procedure applies to all departments, faculty, staff, and business units submitting procurement requests.
Definitions
- Pre‑Procurement Risk Assessment: A mandatory evaluation of risk performed before vendor selection or contracting.
- Lifecycle Sustainment: Review of long‑term vendor support, upgrades, and end‑of‑life planning.
- Vendor Assurance Artifacts: Documentation such as SOC 2 Type II (System and Organization Controls), HECVAT (Higher Education Community Vendor Assessment Toolkit), and VPAT/ACR (Voluntary Product Accessibility Template / Accessibility Conformance Report).
- Risk Tier: Classification of risk (Low, Medium, High, Critical) based on assessment results.
- Governance Threshold: Required approval level based on assigned risk tier.
Roles & Responsibilities
View roles
- Business Owner: Provides business justification and requirements.
- Procurement Lead: Initiates the assessment, gathers inputs, and manages workflow in Freshservice.
- Risk Manager: Performs risk scoring, assigns risk tier, and updates the Risk Register.
- Information Technology (IT) Security: Conducts cybersecurity, data protection, and architectural reviews.
- Chief Information Security Officer (CISO): Reviews and approves High and Critical risk assessments.
- Executive Leadership Team (ELT): Approves Critical risk procurements when required.
Procedure
1. Intake and Initial Review
- Business Owner submits a Procurement Request in Freshservice.
- Procurement Lead validates business justification, description of the request, and data classification involved.
- A Pre‑Procurement Risk Assessment is required by default unless explicitly exempted by policy.
2. Information Gathering
- Functional and technical requirements
- Data elements and sensitivity
- Integration methods (single sign‑on, application programming interfaces, middleware)
- Accessibility requirements
- Budget and funding source
3. Lifecycle Sustainment Review
Procurement evaluates vendor support models, upgrade cycles, end‑of‑life timelines, and known sustainability risks. Findings are documented in the procurement record.
4. Security and Data Protection Review
IT Security reviews data flows, encryption, identity and access management, integrations, and vulnerability exposure. Findings are returned to Procurement and Risk Management.
5. Accessibility Review
When applicable, accessibility documentation (VPAT/ACR) is reviewed for conformance with Web Content Accessibility Guidelines (WCAG) 2.1 Level AA.
6. Risk Scoring and Tier Assignment
The Risk Manager evaluates all findings and assigns a risk tier (Low, Medium, High, or Critical). Results and justification are recorded in the Risk Register.
7. Decision and Advancement
Procurement communicates the outcome to the Business Owner. Approved requests proceed to vendor selection and contracting. Denied requests are closed with documented justification.
Risk Tiers & Approvals
- Low Risk: Department Head approval
- Medium Risk: Procurement Lead and Risk Manager approval
- High Risk: CISO approval
- Critical Risk: Executive Leadership Team approval
Records & Retention
All risk assessments, reviews, approvals, and supporting documentation must be stored in approved systems of record, including Freshservice and the Risk Register.
Records must be retained for a minimum of seven (7) years.
Metrics & KPIs
- Percentage of procurement requests with completed risk assessments
- Number of High and Critical risk assessments per quarter
- Average time to complete pre‑procurement assessments
- Percentage of requests requiring additional security or accessibility remediation
Related Policies
- KU SRM 02 – Procurement Policy
- KU SRM 01 – Supplier Risk Management Policy
- KU SEC 10 – Policy Precedence & Governance
- KU SEC 05 – Exception Management Policy
- KU IT 01 – Asset Management Policy