How to pass a procurement audit
A Poland operations guide on how to pass a procurement audit on a corporate merch programme — what UZP, KAS, NIK and the internal audit directorate look at, how to structure KSeF invoices for clean VAT 23% recovery, how to run supplier due diligence under PZP, and how to keep sustainability and RODO/GDPR claims defensible.
What a procurement audit on a merch programme actually looks at in Poland
A procurement audit on a corporate merch programme in Poland is not a single event. It is a set of four overlapping reviews that fire at different moments and read the same set of documents through different lenses. In our experience the largest enterprise programmes in Warsaw, Kraków, Wrocław and Gdańsk — at companies like PKO BP, Pekao, ING Hubs Poland, mBank, ORLEN, PZU, CD Projekt, Asseco and Comarch — get reviewed at least once a year across this stack, and the review almost always catches something that the procurement team did not flag internally.
The four reviews are: an internal audit directorate review (typically annual, run by the company's own internal-audit team), a public-procurement-law review (only if the entity is in scope of PZP, but those reviews are sharp when they happen), a tax review (run by KAS at the company or by the company's external tax advisor quarterly), and a sustainability / ESG review (run by the company's own ESG function or by an external verifier). This piece walks each one and explains what survives each review.
The internal audit directorate review
The internal audit directorate (Dyrekcja Audytu Wewnętrznego) reviews the merch procurement under the company's own procurement policy. The review focuses on four things: single-source procurement, supplier concentration, the existence of an approved supplier list, and the existence of competitive tenders for any spend above the company's own internal threshold (typically zł20,000–zł50,000 net, depending on the policy).
What survives this review is straightforward: an approved supplier list maintained by the procurement team, at least three competitive quotes for any spend above the company's internal threshold (kept on file for the standard seven-year retention), a written statement of work for every order, and a signed confirmation of receipt at the receiving warehouse. The merch programme that fails this review is the one where the procurement team has been ordering from a single supplier for two years without a tender, where the supplier list is two years out of date, and where the receiving confirmations are missing for the most recent run.
The defensive discipline is to refresh the approved supplier list annually, run a mini-tender for any spend above zł50,000 net, and file the three-quote package in the procurement archive before the invoice is approved for payment. KSeF does not replace this file discipline — KSeF handles the invoice side of the chain, the internal audit directorate handles the procurement-policy side.
The PZP / UZP review — when public procurement law applies
If the buyer is in scope of the Polish Public Procurement Law (Prawo Zamówień Publicznych, PZP) — and this includes state-owned enterprises, listed companies with state involvement, and any entity receiving public funding above a defined threshold — the merch procurement above zł130,000 net (goods and services) or zł5,382,000 net (works) must be tendered via ezamowienia.gov.pl under the supervision of the President of the Public Procurement Office (Prezes Urzędu Zamówień Publicznych, UZP).
The review focuses on the correctness of the tender: the lot structure, the CPV code (39294100-0 for information and promotion products, 18143000-9 for hi-vis, 18110000-3 for workwear), the award criteria (price-only versus price-plus-quality), the evaluation timeline, and the documentation of the choice. The most common failure modes are: lotting the kit as one big lot when splitting by item family would have attracted more bidders; using a non-standard CPV code that excludes the right bidders; running the evaluation timeline shorter than the statutory minimum; and documenting the choice with a price-only criterion when a quality criterion would have been defensible.
What survives PZP review is straightforward: a tender published on ezamowienia.gov.pl with the right CPV codes, the right lot structure, the statutory evaluation timeline (typically 30 days for non-complicated goods tenders), and a written evaluation report signed by the evaluation committee. UZP can conduct a control review at any point within 18 months of contract award, and the standard outcome is administrative (corrective) rather than criminal, but the corrective outcomes are public.
The KAS tax review — KSeF, VAT 23% and the supplier's books
The Krajowa Administracja Skarbowa (KAS) tax review is the one that catches most merch programmes, and the reason is the KSeF invoice structure. Since 1 February 2026 every B2B invoice must be issued through Krajowy System e-Faktur, the national e-invoicing system operated by KAS. The invoice must carry the right structure, the right NIP for both buyer and seller, and the right VAT line. A standard merch invoice is 23% VAT flat — the 8% reduced rate applies to a narrow set of printed books and children's items, the 5% rate to basic foodstuffs, neither applies to typical corporate merch.
What survives KAS review is: a correctly structured KSeF invoice with the buyer's NIP, the seller's NIP, the 23% VAT line per item, and the date of issue inside the standard 30-day window for the transaction. The most common failure modes are: the supplier issuing the invoice under the wrong NIP (typically a group-company NIP rather than the contracting entity's NIP), the invoice being issued outside the 30-day window, the VAT line being shown as a mixture of 23% and a non-applicable reduced rate, and the invoice being issued under the old paper-invoice regime rather than KSeF.
The defensive discipline is to confirm the supplier's KSeF enrolment before the first order, to map the invoice-receiving NIP in the buyer's KSeF account, and to validate the invoice on receipt against the standard KSeF schema. The KAS administration's audit can request the invoice file at any point within the standard five-year retention, and a non-KSeF invoice is treated as non-existent for VAT recovery purposes.
The sustainability / ESG review
The sustainability / ESG review on a merch programme is the newest and the fastest-evolving. The review covers three things: the legitimacy of any sustainability claim on the kit (recycled content, organic cotton, GOTS-certified cotton, FSC-certified paper, post-consumer recycled PET, GRS-certified recycled material), the supply-chain due diligence behind the claim, and the end-of-life plan for the kit (recycling, donation, take-back).
What survives this review is: a written sustainability claim per item with the standard backing (GOTS certificate number, FSC chain-of-custody number, GRS transaction certificate, recycled content verified by an independent lab), the supplier's own sustainability certification where applicable (ISO 14001, B-Corp, SA 8000), and a documented end-of-life plan. The most common failure mode is the kit that says "recycled" without a GRS transaction certificate, the kit that says "organic" without a GOTS certificate, and the kit that says "carbon-neutral" without a verified scope-1/2/3 calculation.
The defensive discipline is to keep the sustainability claim short (one sentence per item), to have the certification document on file, and to refuse to print claims that the supplier cannot back with a current certificate. The EU's Empowering Consumers for the Green Transition directive (in force from March 2026 in Poland) tightens this further — vague environmental claims without independent verification are now treated as misleading commercial practices and can attract UOKiK enforcement.
RODO/GDPR and data on the kit
RODO (the Polish implementation of GDPR) bites the merch programme at two specific points: the personalised name on the bound notebook or the engraved pen, and the post-event distribution list for the curated drop. The first is a personal-data processing operation and requires a documented lawful basis (typically legitimate interest for the event participant, consent for the non-employee recipient); the second is a personal-data processing operation that requires the same lawful basis plus a data-processing agreement with the fulfilment partner.
What survives the UODO (Urząd Ochrony Danych Osobowych) review is: a written lawful-basis assessment for the personalisation data, a written data-processing agreement with the fulfilment partner (or a controller-to-controller agreement if the partner operates independently), a retention schedule for the personalisation data (typically 30 days post-event for the names that did not result in a complaint), and a documented process for deletion on request. The most common failure mode is the programme that personalises the kit with a name list sourced from the event registration system without a documented lawful basis for the secondary use.
The defensive discipline is to handle the personalisation list as a separate data-processing operation from the event registration, to keep the retention short, and to have a deletion-on-request process that the fulfilment partner can execute within 7 days.
A clean-audit merch programme in seven steps
Pulling it together, a clean-audit merch programme in Poland runs through seven steps.
1. Approved supplier list. Refreshed annually, with at least three Polish or EU-based suppliers per category, documented with company registration (KRS), tax registration (NIP), and a current certificate of non-debt with ZUS and KAS.
2. Internal threshold discipline. Three competitive quotes for any spend above the company's internal threshold (typically zł20,000–zł50,000 net), kept on file for seven years.
3. PZP tender for public-sector-scope spend. ezamowienia.gov.pl tender for any spend above zł130,000 net, with the right CPV codes, the right lot structure, the statutory evaluation timeline, and a written evaluation report.
4. KSeF invoice structure. KSeF-enrolled supplier, correctly structured invoices with 23% VAT, the right NIP mapping, and on-receipt validation against the KSeF schema.
5. Sustainability claim backing. One-sentence claims per item, current certificates on file (GOTS, FSC, GRS), no vague claims, end-of-life plan documented.
6. RODO/GDPR documentation. Lawful-basis assessment for personalisation data, data-processing agreement with the fulfilment partner, 30-day retention, deletion-on-request process.
7. Annual review. Once a year, the procurement team reviews the programme against the latest UZP, KAS, UODO and ESG guidance, and refreshes the documentation that needs refreshing.
FAQ
What is the PZP threshold for goods and services tenders in Poland?
zł130,000 net for goods and services; zł5,382,000 net for works. Above these thresholds the spend must be tendered via ezamowienia.gov.pl under UZP supervision.
How is the KSeF invoice structure validated?
On receipt, against the KSeF schema published by the Ministry of Finance. The buyer's KSeF account maps the receiving NIP and the standard 30-day issuance window. The VAT line is 23% flat for typical merch; 8% and 5% reduced rates apply to a narrow set of printed books, children's items and basic foodstuffs.
What sustainability claims survive the ESG review?
One-sentence claims per item with current certifications on file (GOTS for organic cotton, FSC for paper and wood, GRS for recycled material). Vague claims ("eco", "green", "sustainable") without independent verification are treated as misleading under the EU Empowering Consumers directive from March 2026 onwards.
What RODO/GDPR documents does a personalised merch programme need?
A written lawful-basis assessment for the personalisation data, a data-processing agreement with the fulfilment partner, a 30-day retention schedule, and a documented deletion-on-request process that the fulfilment partner can execute within 7 days.
How often does the internal audit directorate review a merch programme?
At least once a year in our experience. The review focuses on single-source procurement, supplier concentration, the approved supplier list freshness, and the existence of competitive quotes for any spend above the company's internal threshold (typically zł20,000–zł50,000 net).
What is the retention period for procurement documentation?
The standard seven-year retention applies to procurement files (tender documents, evaluation reports, contracts, invoices). Sustainability certificates should be kept current and archived on the audit folder for the same seven years.