When employees make purchases outside approved procurement channels, organizations often respond with stricter rules, card blocking, or mandatory compliance training. However, treating off-portal buying purely as a compliance violation misses the real root cause: it is almost always a process speed and routing failure. Requesters do not buy off-portal to break rules; they do it because the official path is too slow to meet their business deadlines. In this guide, we break down why traditional policy campaigns fail, which off-portal buying controls actually change requester behavior, and how to track maverick spend effectively using directional sampling.
TL;DR
- Off-portal buying is a routing failure before it is a compliance failure. The process lost a trade-off against a deadline.
- Reduce time to first response, put the front door where people already work, and make the catalog findable in their language.
- Card blocking, mandatory training, and lower approval thresholds all raise the cost of the compliant path.
- Measure by sampling rather than attempting full capture. The trend matters more than the level.
- See how Merlin Intake handles procurement requests. Request a demo.
Off-portal buying is a routing failure before it is a compliance failure. People buy outside the process because the process was slower than their deadline, not because they wanted to break a rule.
Treating it as non-compliance produces policy reminders, which change nothing, because the requester was not confused about the policy. They made a trade-off and the process lost. Every durable control works by changing that trade-off rather than by restating the rule.
This is written for procurement leaders who have run the awareness campaign and watched off-contract spend stay where it was.
The order of these matters for where effort goes. If most of your off-portal buying is the first cause, communications will achieve nothing and process speed will achieve a great deal. Establishing the mix before choosing a control is the step most programs skip.
Why do people buy off-portal?
Four reasons, set out in Figure 1, and only one responds to policy.
The process was slower than the need. Someone had a deadline and the request would not have cleared it. This is the largest cause and the most legitimate.
They could not find the item. They searched the catalog, found nothing, and concluded procurement did not cover it. Frequently the item was there under a different name.
They did not know a process applied. Common for services, subscriptions, and anything that does not feel like a purchase. A tool bought on a corporate card rarely registers as procurement’s business.
They preferred a specific supplier. A relationship exists and the process would have introduced alternatives.
Policy reminders address the third and do nothing for the other three. That is why campaigns produce a brief dip and a return to baseline.
The framing matters because it changes who owns the fix. If off-portal buying is non-compliance, it belongs to policy and communications. If it is a routing failure, it belongs to whoever owns the request process, and that is where the levers actually are.
It also changes the tone of the conversation with the business. A requester told they broke a rule becomes defensive. One asked why the process did not work for them will usually explain in detail, and the explanation is the design input.
Figure 1: Four causes, and the one that policy reaches.
Hackett studied the procurement agenda rather than off-portal buying. It matters here because a team absorbing more work with fewer people has less capacity to respond quickly, and response speed is the variable that determines whether requesters wait.
Which controls actually work?
The ones that make the compliant path faster than the alternative, and there are three.
- Reduce time to first response. The trade-off that produces off-portal buying is between certainty and speed. A requester who knows within an hour that their request is moving will usually wait. One who has heard nothing for two days will act.
- Put the front door where people already are. A separate portal requiring a separate login is a decision point, and decision points leak. Merlin Intake works inside Microsoft Teams and Slack, which removes the choice rather than winning it.
- Make the catalog findable in the requester’s language. Most catalog bypass is a search failure rather than a coverage gap, and search terms are cheap to fix.
Each of these changes the trade-off. None of them relies on the requester valuing compliance more than their deadline, which is a bet that keeps losing.
Deloitte surveyed procurement risk broadly rather than off-portal buying. The connection is that spend arriving outside the process is spend with no reliable record, which is one of the mechanisms by which the data quality risk CPOs rank first actually materializes.
Which controls only appear to work?
Three, and they are the ones most often implemented first.
- Blocking corporate cards by merchant category. It stops a transaction without addressing the need, so the purchase reappears through expenses, a colleague’s card, or a supplier invoice. Spend moves rather than reducing, and it moves somewhere with less visibility.
- Mandatory training. Attendance is not adoption. Training addresses the reason that accounts for the smallest share of the problem.
- Approval thresholds set low. Lowering the threshold at which approval is required increases the cost of compliance, which strengthens the incentive to avoid it. This is the control most likely to make the problem worse while appearing rigorous.
The common property is that all three raise the cost of the compliant path rather than lowering it.
Whatever method you choose, run it consistently rather than accurately. A rough measure taken the same way every quarter tells you whether the direction is right. A precise measure taken once tells you very little and will not be repeated.
How do you measure something that bypassed your system?
Not directly, which is why most organizations stop measuring it once a platform is live.
Three practical approaches, shown in Figure 2. Sample corporate card transactions monthly against merchant categories that should have gone through procurement. Audit a sample of supplier invoices for whether an upstream request record exists. Ask a defined group to log requests that reached them outside the platform for a fixed period each quarter.
None is complete and all three are directional, which is enough. The number that matters is the trend rather than the level, and a directional measure moving in the right direction is more useful than an exact measure nobody produces.
The failure mode is measuring only what entered the system, which produces a spend under management figure that improves while the underlying behavior does not.
It is worth being honest internally about what a realistic target looks like. Off-portal buying does not go to zero in any organization, and a program promising that will be judged against an impossible standard. A meaningful reduction in the categories where it concentrates is both achievable and more valuable than a marginal improvement spread across everything.
Figure 2: Three partial measures, all directional.
Where should you start?
With the categories where off-portal buying concentrates, which is rarely where spend concentrates.
Software subscriptions, professional services, and small equipment purchases account for most off-portal volume in most organizations, because each is easy to buy directly and none feels like procurement’s territory. Fixing the front door for these three usually moves the number more than any control applied across the whole estate.
Then check time to first response for those categories specifically. If it is measured in days, no control will hold, because the trade-off still favors the alternative.
APQC measured transaction processing cost rather than off-portal buying. Its bearing here is that the administrative cost of a compliant purchase is real and visible to the requester, which is part of what they are weighing when they choose another route.
Frequently asked questions
Q1. What is off-portal or maverick spend?
Off-portal spend is purchasing that occurs outside the defined procurement process, whether through corporate cards, direct supplier contact, or expense reimbursement. It is usually a response to process friction rather than deliberate circumvention, which matters because the two require entirely different remedies.
Q2. Why does maverick spend happen?
Most often because the process was slower than the requester’s deadline. Other common causes are catalog search failures, categories that do not feel like procurement’s territory such as subscriptions and services, and existing supplier relationships. Only the third of these responds to communication.
Q3. Do policy reminders reduce off-portal buying?
Briefly. Requesters are rarely confused about the policy, so reminders address a cause that accounts for a small share of the behavior. Campaigns typically produce a short dip followed by a return to baseline, because the underlying trade-off between speed and compliance has not changed.
Q4. Does blocking corporate cards work?
It stops the transaction without addressing the need, so the purchase reappears through expenses, another cardholder, or a direct supplier invoice. Spend moves rather than reducing, and it usually moves somewhere with less visibility than the card program it left.
Q5. What is the most effective control for off-portal buying?
Reducing time to first response, because the trade-off producing the behavior is between certainty and speed. A requester who knows within an hour that their request is progressing will usually wait. Nothing else changes the calculation as directly.
Q6. How do you measure off-portal spend?
Sample rather than attempt full capture, since complete measurement of what bypassed your system is impossible by definition. Audit corporate card transactions against merchant categories, sample supplier invoices for upstream request records, or ask a defined group to log requests reaching them outside the platform.
Q7. Which categories have the most off-portal buying?
Software subscriptions, professional services, and small equipment purchases in most organizations. Each is easy to buy directly and none registers as procurement’s territory to the person buying it. These categories rarely match the ones with the largest spend.
Q8. Should approval thresholds be lowered to catch more spend?
Usually not. Lowering thresholds raises the cost of compliance, which strengthens the incentive to avoid the process. It is the control most likely to increase the behavior it targets while appearing rigorous in a governance review.
