Procurement Contracts

The pre-request includes the following steps:

1. Conduct a basic outline of scope.
2. Review the many potential methods to purchase goods and/or services as these options may meet business needs without requiring the setup of a new supplier or independent contractor (IC).  
3. Review the policies and guidance on how suppliers or ICs are selected at Stanford. In some cases, a formal Request for Proposal (RFP) may be needed.
4. The supplier or IC (referred to as a non-SU payee) must have an active supplier or IC record in the university’s database. Check if the non-SU payee has an active record in the university’s database. If no record exists, the department must submit a request to set up a new record before a contract request can be made. For suppliers or ICs set up to receive only non-PO contracts, the record should be available in SmartMart Contracts within 24 hours after the request was submitted.
5. Communicate with the supplier or IC and document the scope and pricing in a statement of work or proposal. 

Departments and schools begin the procurement contract process when they submit the contract request and obtain subsequent financial approval (when the contract will be paid for by a purchase order).

1. Request the Contract in SmartMart Contracts

   • Submit new and amended procurement contract requests to Procurement Services using SmartMart Contracts. Certain Capital Equipment purchases are an exception, which may need to be initiated by iProcurement Services.
   • Select how the procurement contract will be paid, which can include payment through a purchase order (PO) or PCard for contracts whose total value is $4,999.00 or less (see non-PO contracts section below for more information).
   • Attach a Statement of Work, proposals and/or draft agreements within SmartMart Contracts. A Statement of Work is a legally binding document that outlines and defines the business requirements for a project or service; including scope of the work being provided, project deliverables, timelines, locations, acceptance criteria, and payment terms.  A Statement of Work may be issued as part of a Service Agreement, or under the terms of a Master Agreement.
   • If the department is working with an independent contractor, attach a signed Independent Contractor Checklist (IC Checklist) within SmartMart Contracts.
   • For procurement contracts involving the non-SU payee's use of Stanford data, departments should review additional considerations and attach required documentation, such as a Data Risk Assessment, which helps inform the contract review and negotiation process.
   • Pricing information should be complete and summarized in the contract request form so it can accurately populate the funding information in the iProcurement requisition (see number 2 below). An example of complete and summarized pricing information is: “Consulting fees, estimate of 10 hours at $125.00 per hour for expertise in website design, total Not-to-Exceed (NTE) price of $1,250.00."
   • Once the contract request form is submitted, Procurement Services will review the request form and return the request form with any questions or corrections if needed.
   • If the procurement contract will be paid for by a PO, the preparer will receive an email providing the requisition number, and instructions on how to continue in iProcurement. Non-PO contracts will proceed to Procurement Services review and approval. Once the contract is signed, the payment can be processed. Event venue or catering service deposits can be processed while the contract request is being reviewed.

If the preparer needs to modify the contract request after the preparer has clicked the “Submit Request” button, they must contact the Contracts team using the communications tools available within SmartMart.

Procurement Contract Request Processing Timeframes

Contract request processing times vary depending on the:

• Complexity of each contract
• Turnaround time for supplier to respond to questions, review, and sign the contract
• Volume of other contract requests that Procurement Services is processing at the time the request is submitted.
• When applicable, reviews needed by other departments (e.g., the Office of General Counsel, Global Business Services, or Office of Technology Licensing) for unique circumstances/risks
• Use of Stanford data (see contract considerations and documentation section on this page)
• Peak seasons (e.g., year-end, commencement)

The Contract Advisor assigned to your contract request will process it as quickly as possible based on the above factors. If a rush is needed for the contract request, refer to Step 5 in How To: Submit a Contract Request. 

2. Obtain Financial Approval in iProcurement

Please note: Non-PO contracts will not have financial review and approval in iProcurement.

For procurement contracts that are paid for through a purchase order:

• After receiving an email with the requisition number, the preparer must log into their “My Requisitions” page in iProcurement and add the PTAE(s )to the purchase requisition. A designated PTAE approver is auto-populated in the requisition based on the PTA and the dollar amount being requested.
• University policy requires that purchases be by competition to the extent possible based on considerations such as quality, price, and performance. To document competitive purchasing practices, schools and units can attach documentation such as multiple bids or quotes to the non catalog purchase requisition. Procurement Services is required to validate competitive supplier selection over a threshold that is dependent on the funding source.
• If pricing information (e.g., price per hour, total number of hours, price per deliverable, or lump sum pricing for the total amount of work) is fragmented across the Statement of Work (SOW), proposal, and/or draft agreement, also attach these multiple documents to the non-catalog purchase requisition that was generated from the contract request.
• Submit the purchase requisition for financial approval. If the contract request contains a monetary value, the funds must be fully approved before the contract signature can be completed. For more information, see Topic Overview: Financial Transaction Approval.

For more details on submitting a purchase requisition with appropriate documentation, refer to Purchase Orders.

Please note: If the preparer needs to cancel a purchase requisition associated with a procurement contract, they must contact the Contracts team using the Communications Center to request cancellation of both the contract file and the purchase requisition.

After the purchase requisition or the non-PO contract request has been approved, the Procurement Services Contracts team will:

1. Review the contract file
2. Draft the agreement
3. Negotiate any changes to legal terms requested by the supplier to ensure alignment with university policy
4. Request signature from the supplier
5. Sign the contract on behalf of Stanford

Occasionally, the Contracts Team may need additional review of specific terms or clauses by other departments (e.g., the Office of General Counsel, Global Business Services, or Office of Technology Licensing) that pose unique circumstances/risks, which may affect processing time. If the procurement contract will involve the use of Stanford data by others, please refer to the Use of Stanford Data section on this page. Fiscal year end generally sees a significant increase in the volume of contract requests and can impact processing time.

Execution

If the procurement contract will be paid for by a PO, the PO number is included in the contract prior to signature. The preparer of the contract request will receive a SmartMart Contracts system-generated email letting them know when the contract has been fully signed.

Because the contract governs the transaction, Oracle Financials does not send an automated email to the supplier or preparer with a copy of the PO. A PO file may remain in Oracle Financials for invoice purposes only. After the contract has been signed, the preparer and named contract stakeholders can download a copy of the signed agreement within SmartMart Contracts, if needed.

The table below outlines the description and process for possible actions a preparer can take on a contract that has been fully executed/signed:

Contracts Submitted Through a Non-Catalog Requisition in iProcurement

For questions on contracts that originated in iProcurement prior to the launch of the new SmartMart Contracts system, please submit a support request.  

A non-Purchase Order Contract (non-PO contract) is a contract that does not require funding approval in Oracle. Non-PO contracts include:

• Zero dollar ($0) contracts: This type of procurement contract is typically used when a supplier or independent contractor will provide Stanford with goods or services (including access to data) but at zero dollars ($0) paid by Stanford.
• Contract with a total dollar value of $4,999 or less that will be paid by a Stanford Purchasing Card (PCard):  Procurement contracts paid with a PCard generally include event and catering services or certain professional services. They must comply with PCard policy. 

Stanford’s Vendor Services team has established a 24-hour process for setting up a supplier or independent contractor who is limited to non-PO contracts, when tax and payment information is not required. Once such a request is submitted through the Supplier Query and Request tool, the supplier or independent contractor will be available in SmartMart Contracts within approximately 24 hours. Such suppliers or independent contractors are solely available for non-PO contracts and not available for payments through a PO or the Expense Requests system (ERS). Departments can request an update to the payee record to make it available for PO payment.

Financial changes to non-PO contracts

If there are financial changes to non-PO contracts that increase the total value of the procurement contract to $5,000 or greater, the supplier or independent contractor record must be updated, and the supplier or independent contractor fully onboarded to allow the submission of PO transactions. A  new contract request in SmartMart Contracts must also be submitted, which will generate a purchase order in Oracle to accommodate funding approval outside of the PCard limits. 

At Stanford, procurement contracts are generally project-specific. Even if a supplier or independent contractor has an existing procurement contract, it cannot be repurposed for a different department or project.

What is a University-Wide Service Agreement

A University-Wide Service Agreement, formerly called a Master Service Agreement (“MSA”) is like an "umbrella agreement." It covers the broad legal terms that apply to future collaborations with the supplier. It sets the overarching rules for legal terms like data security and confidentiality, trademark and other IP rights, and how disputes will be handled.  However, it doesn't define the actual work to be performed, the budget, or any other project specific business details.

Instead, for each distinct project, a separate Statement of Work (SOW) document is created. This is the detailed "project plan." It outlines all the specific business terms for the project, like exact services, deliverables, schedule, and pricing. The SOW then operates under the legal framework established by the MSA. When the department is ready to start a new project with a supplier who has an MSA, a new contract request is submitted in the SmartMart Contract system to formalize the project-specific SOW.

Types of MSAs

The university primarily uses two types of MSAs:

• Construction: The supplier is a licensed construction contractor who has generally provided services to a number of different departments on a number of different projects for Stanford.
• Technical: The supplier has subject matter expertise and has generally provided technical and/or consulting services to a number of different departments on a number of different projects for Stanford.
• Hotel/Venue: Stanford currently has MSAs in place with the Sheraton Palo Alto and the Westin Palo Alto hotels for services. The quote for these two hotels does not require routing through SmartMart Contracts. Instead, the preparer can attach the quote for the services to the purchase requisition and the hotels will accept Stanford’s PO in lieu of a signature on their quote.

When schools or units engage an individual to perform services, Stanford must ensure the person and the work being performed meet the legal requirements for status as an independent contractor (sometimes also called an independent consultant). Refer to Resource: Independent Contractors for more information on requirements for an IC classification and the procurement process for ICs.

Special care must be taken when Stanford data is used or accessible by others. Whether it be consultants who may use the data or services that host it, data risk classification must be considered. See the Data Risk Assessment (DRA) FAQs and Third Party Security Requirements for more information. Procurement contracts with consultants or hosting services will require a DRA review of data risk by the Information Security Office (ISO) and University Privacy Office (UPO). The DRA process could take from four to six weeks, so it is important to start the process early. Complete the Data Risk Assessment (DRA) with the university’s ISO office and attach a copy of the final DRA Report to the SmartMart contract request.

Additional contract terms may need to be incorporated into procurement contracts when the supplier performs a service function or activity that may involve the use, access, transfer, or storage of moderate or high risk data. Please consult Procurement Services through an FSC support request as soon as the purchase has been identified as involving moderate or high risk data, such as data protected by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), or other similar Federal or State security requirements.

HIPAA is a federal law that requires the protection of sensitive patient health information from being disclosed without the patient's consent or knowledge. HIPAA regulates the disclosure of Protected Health Information (PHI) between Stanford and any supplier who performs services that involve access, use, or disclosure of PHI. Generally, PHI is health information, including demographic data that identifies, or could be used to identify, a specific individual related to their past, present, or future physical or mental health, including provision of health care, or the payment of health care.  Identifiers may include name, address, birth date, and Social Security number.

A Business Associate Addendum (BAA) needs to be attached to the procurement contract in the following circumstances. 

• The school or unit is working with a supplier who will receive, maintain, transmit, or create Stanford PHI for non-treatment purposes, and
• The supplier does not qualify for an exemption from the HIPAA requirements. If one of the following exemptions is met, a BAA is not required, but other terms may be appropriate for data protection (e.g., Data Use and Data Security provisions). Exemptions include:
  • All data is de-identified
  • Data is part of a payment to a health provider
  • Data is being transferred to a health oversight agency as part of a federal or state program
  • Data is part of a claim sent to a health plan.
  • Data is part of a fund transfer to a financial institution
  • Data is being sent in response to a request from law enforcement or subpoena

The school or unit can obtain additional BAA information from the Purchase Order Terms and Conditions page on Fingate in the Business Associate Addendum (BAA) section. 

When a supplier facilitates credit and/or debit card payment processing on behalf of Stanford, it means that community members (e.g., students or members of the public) give their card information to suppliers to purchase items from:

• The university, such as tickets to a Stanford-sponsored concert or sporting event, or 
• A supplier at a Stanford campus location, such as a campus cafe, vending machine, or web site operated and owned by the supplier, but, where the purchaser might reasonably believe they are making a payment directly to Stanford.

When working with suppliers that will facilitate credit and/or debit card payment processing on behalf of Stanford, contract preparers must ensure compliance with Stanford’s associated policies and align supplier engagements with any additional requirements requested by Merchant Services and the Information Security Office (ISO). This includes:

• Consult with the Merchant Services team by submitting a support request. After receiving this consultation, attach a copy of the email confirmation from Merchant Services to the SmartMart contract request.
• Complete the Data Risk Assessment (DRA) with the university’s ISO office and attach a copy of the final DRA Report to the SmartMart contract request.

The university’s standard Contract and Purchase Order language also addresses Payment Card Industry Data Security Standards (PCI-DSS) with suppliers who process credit and/or debit cards on behalf of Stanford.