Today, information technology (IT) procurement covers everything from software licenses and cloud services to hardware, cybersecurity tools, managed services, and long‑term support contracts. These arrangements are frequently highly technical, structured in ways that are difficult for non‑specialists to challenge, and renewed year after year with limited review. This combination makes it easier for issues to go unnoticed and allows problematic practices to become embedded over time.
As technology spend becomes more central to business strategy, the risks of misconduct around these decisions have also become more subtle and complex. For risk officers, audit committees, internal audit leaders, and compliance teams, IT procurement often does not get the scrutiny it deserves. What appears to be a straightforward technology purchase can involve inflated costs, biased vendor choices, weak approval processes, or improper benefits masked as normal commercial terms.
