Procurement Governance
The Role of Delegation of Authority and Approval Workflows in Strengthening Procurement Governance in Saudi Corporations
Published October 2026
Abstract
Procurement governance depends on how authority, information and accountability are connected when organizations make commitments to suppliers. A delegation matrix may identify approval limits while leaving the meaning of individual decisions, escalation conditions and evidence requirements unclear. This paper develops an integrative framework explaining how delegation of authority and approval workflows can support procurement governance in Saudi corporations. A targeted review combines organizational economics, purchasing research, contract governance, internal control and digital workflow literature with official governance sources. The synthesis identifies four mechanisms: matching decision rights with relevant knowledge, distinguishing different forms of procurement authorization, preserving evidence before commitments arise and reviewing exceptions through independent oversight. Three proposed matrices describe decision responsibilities, workflow risks and performance indicators. Two original diagrams illustrate conditional routing and the relationships requiring empirical validation. The analysis argues that additional approval layers do not necessarily strengthen control; their usefulness depends on decision purpose, reviewer capability and the treatment of nonstandard exposure. Contract approval, signing authority, service acceptance and payment release are treated as related but distinct decisions. The framework proposes a balance between timely delegation and proportionate challenge without prescribing universal monetary thresholds. No corporate audit, survey or causal performance estimate is reported. The contribution is an operational account of how formal authority can become informed and traceable procurement decision-making, subject to organizational and regulatory context.
Keywords: delegation of authority; approval workflows; procurement governance; decision rights; internal control; Saudi corporations
1Introduction
Procurement involves several decisions that can be mistaken for a single approval. An organization may authorize a budget, select a supplier, accept contract terms, execute an agreement, confirm delivery and release payment through different functions. If those decisions are not distinguished, an employee can interpret one approval as permission for an action that nobody has reviewed. The governance problem is therefore broader than identifying a financial limit. It concerns what is being decided, by whom, using which information and with what consequences.
Delegation of authority, abbreviated as DOA, is defined here as an organizational allocation of decision rights subject to specified scope, limits, conditions and accountability. An approval workflow is the sequence or combination of activities through which evidence is assembled, reviewed and translated into an authorized decision. The DOA defines who may decide; the workflow determines how the organization obtains and records that decision. Their effectiveness depends on alignment. An accurate matrix cannot compensate for a workflow that uses an obsolete version or bypasses a required specialist review.
Saudi corporations operate within different legal forms, ownership structures and regulatory environments. The Capital Market Authority’s Corporate Governance Regulations provide a relevant reference for listed joint stock companies, including the distribution of responsibilities and executive oversight (CMA, 2023). Their application differs between market categories, and the regulations should not be represented as a universal procurement manual for every Saudi business. This paper therefore develops organizational principles while keeping entity-specific authority and applicable requirements distinct from proposed management practices.
1.1Aim and research questions
The aim is to explain how DOA and approval workflows can strengthen procurement governance through informed, accountable and traceable decisions. Five objectives guide the paper: clarify the different decisions within procurement; examine the relationship between delegated authority and information; identify controls over commitments, changes and exceptions; propose indicators balancing timeliness and control quality; and develop propositions suitable for testing in Saudi corporations. The analysis concerns governance design rather than the performance of any named corporation.
Three questions organize the inquiry. How should procurement decision rights be allocated across organizational roles? Which workflow mechanisms preserve effective challenge without creating unnecessary delay? What evidence would demonstrate that a DOA arrangement improves governance rather than merely increasing the number of approvals? These questions require attention to both formal policies and working practice because the location of authority on paper can differ from the location of influence over an actual decision.
2Literature review
2.1Agency relationships and decision control
Jensen and Meckling (1976) examine agency costs arising when parties act on behalf of others. Eisenhardt (1989) reviews the contribution of agency theory to understanding incentives, uncertainty and information. Baiman (1990) considers agency research in managerial accounting. These perspectives help explain why procurement governance requires more than trust in individual judgment. The person initiating expenditure may possess essential operational knowledge while also having incentives that differ from those of finance, procurement or the organization as a whole.
Fama and Jensen (1983) distinguish elements of decision management and decision control. Applied to procurement, the distinction supports separating preparation and implementation from appropriate ratification and monitoring. It does not imply that every decision needs a committee or that small organizations can duplicate the staffing of large corporations. The proposed interpretation is functional: the organization should identify who develops a recommendation, who authorizes the commitment and how its outcome will be reviewed, with compensating controls where resources constrain separation.
2.2Formal authority and relevant knowledge
Aghion and Tirole (1997) distinguish the formal right to decide from effective control over decisions through information. Dessein (2002) examines delegation as an alternative to communicating information up the hierarchy. These theoretical contributions identify a central trade-off: central approval can preserve control while distancing the decision from specialist knowledge. Delegation can improve responsiveness but requires an understanding of incentives, competence and exposure. Neither complete centralization nor unrestricted local discretion follows as a universal prescription.
Bloom et al. (2012) investigate differences in decentralization across firms and countries, with attention to trust and organization. Their evidence supports considering institutional and organizational context when discussing delegated decisions; it is not a test of Saudi procurement matrices. A technically complex acquisition may depend on local operating knowledge, while a commitment affecting multiple business units may require wider coordination. The appropriate authority arrangement should therefore consider the distribution of knowledge alongside financial magnitude.
2.3Procurement capability and contractual governance
Carr and Pearson (1999) connect strategic purchasing with supplier evaluation and relationship outcomes. Paulraj et al. (2006) examine purchasing maturity and supply integration. These studies support involving procurement early enough to challenge requirements and compare alternatives. Their relevance to DOA lies in the information available before approval: a reviewer cannot meaningfully authorize an award if the recommendation omits important scope assumptions, supplier dependencies or unresolved commercial qualifications.
Williamson (1979) provides a transaction-cost perspective on governance, including the importance of transaction characteristics. Schepker et al. (2014) discuss contracts as instruments of safeguarding, coordination and adaptation. Together, these perspectives suggest that approval requirements should reflect nonprice exposure as well as expenditure. Proprietary dependency, extended duration or substantial change rights may require specialist scrutiny even where the initial value is modest. The approval record should explain material trade-offs rather than reducing the decision to confirmation that funds exist.
Poppo and Zenger (2002) examine relationships between formal and relational governance, and Cao and Lumineau (2015) synthesize evidence on their interplay. Lumineau (2017) discusses how different contractual dimensions influence trust and distrust. These contributions caution against treating controls and cooperation as opposites. A clear approval route can make supplier commitments more predictable, while an opaque or repeatedly reopened decision can damage coordination. This application is conceptual; the cited studies do not establish an optimal number of approval stages.
2.4Internal control and independent oversight
COSO’s Internal Control—Integrated Framework provides a broad reference for designing and assessing internal control (COSO, 2013). The OECD (2023) emphasizes governance accountability and oversight. The Institute of Internal Auditors’ current Three Lines Model statement distinguishes organizational contributions to governance and the importance of independent assurance (IIA, 2026). Applied here, management owns procurement decisions and their controls; independent assurance evaluates their design and operation. Approval responsibility should not be transferred informally to an assurance function simply because that function identifies a weakness.
Doyle et al. (2007) investigate characteristics associated with internal-control weaknesses in financial reporting. Their setting and outcome differ from procurement approval quality, so direct effect estimates cannot be transferred. The relevant analytical lesson is to consider complexity, organizational change and resource constraints when assessing control arrangements. A matrix suitable for a stable business may become difficult to administer after restructuring or rapid growth. Governance evaluation should therefore examine whether changes in operations are reflected in authority and workflow design.
2.5Workflow design and digital information
Mendling et al. (2010) connect process-model structure with comprehensibility and error risk. Srai and Lorentz (2019) relate procurement digitalization to value drivers, while Hallikas et al. (2021) examine digital procurement and analytics capabilities. Khatri and Brown (2010) emphasize decision rights and accountability in data governance. These sources support clear routing rules and reliable information. Automating an unclear policy can distribute its ambiguity more efficiently; the underlying decision rules require validation before they become system configuration.
Digital records can make timing, reassignment and approval histories observable. They can also conceal problems when status labels are interpreted without examining evidence. A completed task may represent an acknowledgment, a substantive review or an authorization, depending on its design. The framework therefore treats workflow data as evidence requiring defined meaning. Technical access to an approval button must remain distinguishable from valid organizational authority to approve the particular commitment.
3Research methodology
3.1Review approach
The paper uses a targeted integrative review and conceptual framework development. Snyder (2019) discusses matching review methods to the research purpose, while Torraco (2005) explains integrative synthesis as a means of developing understanding across related research streams. The approach connects organizational authority with procurement administration and control. It is appropriate for identifying mechanisms and propositions, but does not justify statistical conclusions about the financial benefits of implementing a DOA policy.
3.2Source identification and inclusion
Searches combined delegation of authority, formal and real authority, procurement governance, approval workflows, internal control, strategic purchasing and contractual governance. Publisher records, institutional repositories and official governance publications were used to verify source identity and broad findings. The reference set contains 25 sources. Foundational theory was retained where it defined essential decision-rights concepts; procurement studies informed operational interpretation. Official publications supplied governance context. No exhaustive Scopus or Web of Science database search is claimed.
Sources were included when they directly informed a mechanism, an implementation requirement or an important boundary condition. Appraisal considered provenance, research design, conceptual relevance and transferability to Saudi corporations. Empirical studies from manufacturing, financial reporting or other national settings were not treated as direct observations of Saudi procurement. Where access was limited to abstracts or publisher summaries, interpretation was restricted to the broad findings available. This limitation reduces the depth of methodological appraisal for those sources.
3.3Synthesis and evidence boundaries
The analysis grouped evidence into authority allocation, decision evidence, workflow control, exception handling and oversight. It then examined where authority can become disconnected from the commitment actually made. The resulting tables and diagrams are original analytical proposals. No confidential corporate records, interviews, surveys or transaction logs were analyzed. Screening totals, observed approval times and estimated savings were not invented. Results therefore refer to the synthesis and proposed framework; its practical effects require empirical validation.
4Results and discussion
4.1Separating the decisions within procurement
The first analytical finding is that decision clarity precedes threshold design. Budget approval confirms the availability or allocation of funds within a defined planning process. Supplier-award approval authorizes a selection based on the evaluated alternatives. Contract approval concerns the terms and obligations proposed, while execution requires the appropriate authority to commit the entity. Delivery acceptance and payment authorization address later evidence and conditions. The decisions are connected, but one should not silently substitute for another.
Table 1. proposes an allocation of decision purposes without prescribing job titles or approval levels. An organization should adapt the roles to its structure and applicable requirements. The matrix should state whether a person recommends, reviews, authorizes, signs or is informed. Combining those actions under a generic approval label obscures accountability. The workflow should preserve the meaning of each action and allow users to identify what remains outstanding before a commitment or transaction can proceed.
| Decision | Decision purpose | Boundary to preserve |
|---|---|---|
| Budget approval | Allocate or confirm available funds | Does not itself approve supplier or terms |
| Award approval | Authorize supplier selection | Depends on evaluated scope and conditions |
| Contract approval and execution | Accept terms and commit the entity | Internal review and valid signing powers differ |
| Delivery acceptance | Verify specified performance | Requires evidence against agreed requirements |
| Payment authorization | Authorize release against applicable conditions | Does not replace delivery or contract review |
Note: Author synthesis. Proposed controls and indicators require organizational validation.
4.2Designing delegation around exposure
A financial threshold is useful only when its measurement basis is understood. Policies should define the commitment considered for approval, including relevant options, extensions or connected obligations where appropriate. Different treatment of taxes, currencies or framework agreements can otherwise produce inconsistent routing. These are proposed policy-design questions, not universal accounting or legal rules. Their purpose is to ensure that equivalent commitments receive equivalent review and that employees can determine the applicable route without relying on informal interpretation.
Nonfinancial triggers should complement monetary limits. A low-value agreement can create difficult exit conditions, sensitive data access or dependency on a unique supplier. A higher-value routine purchase may involve established terms and verified alternatives. Proportionate design assigns additional review to the exposure requiring specialist judgment. It should also identify matters reserved for a particular governing body or authority. An internal delegation document cannot itself expand powers beyond the entity’s lawful governance arrangements.
4.3Assembling evidence before the decision
An approval package should connect the need, evaluated alternatives, commercial recommendation and residual risks. The reviewer should see the scope being authorized and the consequences of material exclusions. Unresolved issues should be identified explicitly rather than hidden in attachments. A concise decision summary can support informed review, provided that the underlying evidence remains accessible. Requiring every reviewer to reconstruct the same analysis from unstructured correspondence creates delay without necessarily adding an independent check.
The record should preserve which version and conditions were approved. A conditional approval needs a named responsibility for confirming that the condition has been satisfied. Material changes after approval should trigger reassessment according to defined rules. Otherwise, an approval can remain attached to a procurement record even after its commercial substance has changed. This version-specific approach connects authority with the actual decision rather than with a document title or an unchanged request number.
4.4Routing specialist review and final authorization
The second analytical finding concerns the distinction between advisory review and decision authority. Technical review assesses fitness for the intended use; finance examines budget and relevant financial assumptions; procurement evaluates the sourcing process and commercial comparison; contracts or legal personnel address matters within their competence. Final authorization integrates those contributions under the applicable authority arrangement. A reviewer’s specialist concurrence should not be interpreted as an unrestricted authorization to proceed unless that responsibility has been assigned explicitly.
Figure 1 proposes a workflow in which complete requests undergo exposure assessment before reaching the relevant decision route. Specialist reviews can occur in parallel where their information dependencies permit. Sequential review remains appropriate where one assessment depends on another’s conclusion. The design should avoid requesting identical judgments repeatedly while ensuring that important disagreements reach an accountable decision-maker. A disagreement record should identify the issue, alternatives and accepted residual exposure instead of merely collecting additional signatures.

4.5Preventing approval after commitment
Governance requires attention to when a commitment arises in practice. A purchase order issued before required review, an instruction to commence work or an acceptance of revised terms can create exposure before the formal approval record is complete. The internal-control question is whether the organization’s defined authorization sequence was followed; the external legal consequences depend on the transaction and applicable law. Retrospective approval should therefore not be described as automatically repairing every unauthorized action.
A useful control is to reconcile authorization timestamps with relevant commitment records. The review should distinguish genuine emergencies from avoidable late administration and incorrect system dates. Where advance authorization was absent, the organization should record the circumstances, assess consequences and determine corrective action through the appropriate route. Repeated retrospective approvals can indicate weak planning, inaccessible approval capacity or intentional bypass. Counting completed approvals without examining this sequence would overstate the effectiveness of the process.
4.6Managing contract variations and cumulative exposure
Changes require attention because several individually modest amendments can substantially alter the original decision. A proposed variation should identify its effect on scope, value, time and risk allocation. The approver should see both the incremental change and the revised overall commitment. A consistent record of related amendments helps determine whether escalation is needed. The original approval baseline should remain recoverable, allowing reviewers to distinguish changes in business requirements from errors or omissions in earlier analysis.
Controls against fragmented purchasing should likewise begin with the economic relationship between transactions. Orders close to a threshold can be legitimate, so proximity alone does not establish circumvention. Review should consider related scope, timing, supplier arrangements and the organization’s aggregation policy. Exceptions should be investigated proportionately and documented. The framework proposes using transaction patterns to identify questions for review rather than treating a numerical flag as proof of misconduct.
4.7Handling urgency and temporary delegation
An emergency route should define eligibility, permitted authority, minimum evidence and subsequent review. The intention is a controlled decision under constrained time, not an undefined exemption from governance. Urgency arising from foreseeable renewal dates should be distinguished from an unexpected interruption. Exception records can help identify whether the problem lies in business planning, supplier performance or workflow capacity. Without those distinctions, reporting may reward rapid exception handling while leaving the underlying causes unchanged.
Temporary delegation should identify scope, duration, monetary and nonmonetary limits, and any restrictions on further delegation. System permissions should follow the authorized arrangement and expire when it ends. A change of role or departure should trigger prompt review of access and approval assignments. Coverage arrangements need to preserve appropriate separation between request and approval. Otherwise, an absence-management solution may unintentionally allow one person to initiate, authorize and verify the same commitment without compensating oversight.
4.8Governing conflicts and preserving challenge
Conflict-management procedures should apply to the people influencing a recommendation as well as those giving final approval. A disclosed interest may require reassignment, independent evaluation or another authorized response. Recording disclosure without considering its consequences is an incomplete control. The decision package should also distinguish negotiation preferences from material risk concerns. This helps prevent either commercial urgency or specialist caution from becoming an unexplained veto over the procurement outcome.
Independent assurance should examine whether management’s controls operate as intended without becoming the routine approver of ordinary purchases. Its review can test authority records, selected transactions and exception patterns. Management remains responsible for decisions and remediation. Where organizational size restricts segregation, an appropriate oversight role can review a sample or a defined class of higher-risk transactions. The compensating arrangement should be explicit, feasible and evaluated for effectiveness rather than treated as equivalent to full separation by definition.
4.9Keeping digital rules aligned with policy
A workflow engine needs an authoritative source for roles, limits and effective dates. Policy changes should be translated into tested routing rules, including threshold boundaries and special conditions. Test scenarios should cover ordinary requests, unavailable approvers, nonstandard terms and requests that change after review. Access to configure the workflow is itself a sensitive responsibility. Changes should be documented and independently checked where appropriate before they affect live decisions.
Logs should record the actor, action, document version, timestamp and authority basis. Reassignment and override actions need identifiable reasons and review responsibility. However, system evidence can be incomplete when decisions occur through email or other channels. Periodic reconciliation between workflow records and actual commitments is necessary to assess coverage. The proposed benefit is improved traceability, conditional on reliable data and participation. It is not a claim that automation alone prevents bypass or makes a procurement process compliant.
| Risk | Control response | Review evidence |
|---|---|---|
| Approval after commitment | Reconcile approval and commitment sequence | Timestamps, instructions and explanations |
| Accumulated variations | Review incremental and total exposure | Original baseline and amendment history |
| Expired temporary delegation | Time-limited authority and access | Delegation record and permission expiry |
| Unclear specialist concurrence | Separate advice from final authorization | Defined action types and decision rationale |
| Uncontrolled system override | Restrict configuration and review overrides | Change record, test results and override reasons |
Note: Author synthesis. Proposed controls and indicators require organizational validation.
4.10Measuring control quality and decision timeliness
The third analytical finding is that workflow performance should combine timeliness with substantive control indicators. A short approval time can reflect a complete, well-prepared recommendation or an absence of meaningful review. Longer time can arise from justified scrutiny or unnecessary repetition. Table 3 proposes indicators that help distinguish those explanations. Definitions should specify the unit of analysis, time period and treatment of returned requests so that comparisons do not confuse workload changes with governance improvement.
Organizations should examine medians and the distribution of completion times rather than relying only on averages. Requests should be segmented by complexity, exposure and workflow type. Return reasons can identify missing information, unresolved commercial questions or routing errors. Control testing should separately examine whether the correct authority acted and whether the material decision evidence existed. No numerical targets are proposed here because suitable baselines and tolerances require organization-specific data and management judgment.
| Indicator | Operational definition | Interpretation condition |
|---|---|---|
| Authorization accuracy | Sampled decisions approved by valid authority / decisions tested | Use authority effective on the decision date |
| Evidence completeness | Decisions with required evidence / decisions tested | Assess substance as well as attachments |
| Decision cycle time | Complete submission to final authorization | Segment complexity, waiting and rework |
| Retrospective approval rate | Commitments preceding required approval / commitments reviewed | Verify dates and distinguish approved emergency routes |
| Exception recurrence | Repeated exceptions by reason and category | Consider workload and detection coverage |
Note: Author synthesis. Proposed controls and indicators require organizational validation.
4.11Proposed governance framework
Figure 2 links defined decision rights and usable evidence with proportionate challenge, authorized commitment and monitoring. Four propositions follow. First, decision-right clarity is expected to improve approval traceability when workflow actions have distinct meanings. Second, specialist review is expected to improve decision quality when information reaches the authorized approver before commitment. Third, the relationship between delegation and timeliness is expected to depend on reviewer capacity and local knowledge. Fourth, exception analysis is expected to support governance improvement when its findings lead to policy or process changes.
These propositions allow for adverse effects. Excessive concentration of decisions can overload senior approvers; excessive dispersion can weaken coordination or consistency. Additional reviews can improve challenge while creating delay or diffuse responsibility. Possible confounders include procurement capability, leadership quality, supplier complexity and information-system maturity. The framework does not establish a causal relationship between a particular matrix design and lower costs or fewer irregularities. Its contribution is to identify mechanisms and observations through which those relationships can be tested.

5Conclusion and recommendations
DOA and approval workflows can strengthen procurement governance when they connect a clearly defined decision with competent review, valid authority and evidence available before commitment. The central distinction is between recording an approval and establishing that the relevant decision was informed and properly authorized. A financial matrix, workflow software or additional signature cannot provide that assurance independently. The proposed framework instead connects decision purpose, exposure, information, authorization and oversight across the procurement lifecycle.
Implementation should begin with a map of actual decisions and commitments in one procurement category. The team should compare current working practice with the formal matrix, identify ambiguous actions and validate escalation rules. A pilot can then test specialist routing, temporary delegation and variation treatment using representative scenarios. Expansion should follow documented assessment of usability, traceability and control quality. The appropriate monetary limits remain an entity-specific decision within applicable governance and legal arrangements.
Oversight should review recurrent exceptions, approval congestion and changes in organizational structure. Training should use practical situations where budget confirmation, award approval and signing authority differ. Reviewers also need time and information to exercise judgment; a nominally complete workflow can remain weak when approval workload exceeds practical capacity. Periodic policy review should therefore address staffing and decision design together. No claim is made that the proposed practices guarantee compliance or eliminate procurement risk.
6Future directions
Future studies should examine Saudi corporations with different ownership structures, regulatory settings and procurement categories. Contract-file analysis could compare authority in force at the decision date with the action actually taken. Workflow logs could reveal waiting, rework and reassignment, while interviews explain how informal influence and specialist knowledge affect decisions. Researchers should use explicit coding rules and protect commercially sensitive information. Missing documentation should remain distinguishable from confirmed absence of the underlying review or authorization.
Longitudinal research could compare approval arrangements before and after a defined change, using a similar category as a comparison where feasible. Outcomes should include authorization accuracy, evidence completeness, exception recurrence and decision time. Changes in workload, contract complexity and procurement staffing require consideration before attributing effects to delegation policy. The present targeted review, uneven full-text access and limited direct Saudi procurement evidence constrain generalizability. Subsequent research should refine or reject the propositions rather than treating the framework as a validated corporate governance model.
References
- [1]Aghion P, Tirole J (1997). Formal and real authority in organizations. Journal of Political Economy, 105(1), 1–29. https://doi.org/10.1086/262063
- [2]Baiman S (1990). Agency research in managerial accounting: A second look. Accounting, Organizations and Society, 15(4), 341–371. https://doi.org/10.1016/0361-3682(90)90023-N
- [3]Bloom N, Sadun R, Van Reenen J (2012). The organization of firms across countries. The Quarterly Journal of Economics, 127(4), 1663–1705. https://doi.org/10.1093/qje/qje029
- [4]Cao Z, Lumineau F (2015). Revisiting the interplay between contractual and relational governance: A qualitative and meta-analytic investigation. Journal of Operations Management, 33–34, 15–42. https://doi.org/10.1016/j.jom.2014.09.009
- [5]Capital Market Authority (CMA) (2023). Corporate governance regulations. Amended 18 January 2023. https://cma.gov.sa/en/RulesRegulations/Regulations/Documents/CorporateGovernanceRegulations1.pdf
- [6]Carr AS, Pearson JN (1999). Strategically managed buyer–supplier relationships and performance outcomes. Journal of Operations Management, 17(5), 497–519. https://doi.org/10.1016/S0272-6963(99)00007-8
- [7]Committee of Sponsoring Organizations of the Treadway Commission (COSO) (2013). Internal control—Integrated framework. https://www.coso.org/internal-control
- [8]Dessein W (2002). Authority and communication in organizations. The Review of Economic Studies, 69(4), 811–838. https://doi.org/10.1111/1467-937X.00227
- [9]Doyle J, Ge W, McVay S (2007). Determinants of weaknesses in internal control over financial reporting. Journal of Accounting and Economics, 44(1–2), 193–223. https://doi.org/10.1016/j.jacceco.2006.10.003
- [10]Eisenhardt KM (1989). Agency theory: An assessment and review. Academy of Management Review, 14(1), 57–74. https://doi.org/10.5465/amr.1989.4279003
- [11]Fama EF, Jensen MC (1983). Separation of ownership and control. The Journal of Law and Economics, 26(2), 301–325. https://doi.org/10.1086/467037
- [12]Hallikas J, Immonen M, Brax S (2021). Digitalizing procurement: The impact of data analytics on supply chain performance. Supply Chain Management: An International Journal, 26(5), 629–646. https://doi.org/10.1108/SCM-05-2020-0201
- [13]Institute of Internal Auditors (IIA) (2026). Three Lines Model: Assurance and advice in support of effective governance. Statement of position. https://www.theiia.org/globalassets/site/resources/statements-of-position/tlm_assurance_advice_support_effective_gov_en.pdf
- [14]Jensen MC, Meckling WH (1976). Theory of the firm: Managerial behavior, agency costs and ownership structure. Journal of Financial Economics, 3(4), 305–360. https://doi.org/10.1016/0304-405X(76)90026-X
- [15]Khatri V, Brown CV (2010). Designing data governance. Communications of the ACM, 53(1), 148–152. https://doi.org/10.1145/1629175.1629210
- [16]Lumineau F (2017). How contracts influence trust and distrust. Journal of Management, 43(5), 1553–1577. https://doi.org/10.1177/0149206314556656
- [17]Mendling J, Reijers HA, van der Aalst WMP (2010). Seven process modeling guidelines (7PMG). Information and Software Technology, 52(2), 127–136. https://doi.org/10.1016/j.infsof.2009.08.004
- [18]OECD (2023). G20/OECD principles of corporate governance 2023. OECD Publishing. https://doi.org/10.1787/ed750b30-en
- [19]Paulraj A, Chen IJ, Flynn J (2006). Levels of strategic purchasing: Impact on supply integration and performance. Journal of Purchasing and Supply Management, 12(3), 107–122. https://doi.org/10.1016/j.pursup.2006.08.002
- [20]Poppo L, Zenger T (2002). Do formal contracts and relational governance function as substitutes or complements? Strategic Management Journal, 23(8), 707–725. https://doi.org/10.1002/smj.249
- [21]Schepker DJ, Oh WY, Martynov A, Poppo L (2014). The many futures of contracts: Moving beyond structure and safeguarding to coordination and adaptation. Journal of Management, 40(1), 193–225. https://doi.org/10.1177/0149206313491289
- [22]Snyder H (2019). Literature review as a research methodology: An overview and guidelines. Journal of Business Research, 104, 333–339. https://doi.org/10.1016/j.jbusres.2019.07.039
- [23]Srai JS, Lorentz H (2019). Developing design principles for the digitalisation of purchasing and supply management. Journal of Purchasing and Supply Management, 25(1), 78–98. https://doi.org/10.1016/j.pursup.2018.07.001
- [24]Torraco RJ (2005). Writing integrative literature reviews: Guidelines and examples. Human Resource Development Review, 4(3), 356–367. https://doi.org/10.1177/1534484305278283
- [25]Williamson OE (1979). Transaction-cost economics: The governance of contractual relations. The Journal of Law and Economics, 22(2), 233–261. https://doi.org/10.1086/466942