New Procurement Manager in 90 Days: what to do in the first quarter

Procurement can bring supplier risk into the site long before operations notices the exposure. This guide shows what a new procurement manager should do in the first quarter so buying decisions become part of the control chain instead of a source of surprise.

Across 25+ years of executive EHS work, Andreza Araujo has seen that the cheapest purchase often becomes the most expensive risk when no one owns the gate. In Safety Culture: From Theory to Practice, she argues that repeated decisions shape the operation, and in Make The Difference: Be a Leader in Health & Safety, she shows that leadership is visible in the routine, not the slogan.

This article is for the new procurement manager who needs a practical route through supplier screening, contract language, mobilization, and exceptions. The point is simple: if the role does not change what gets awarded, it does not change risk.

What should a new procurement manager understand before starting?

Procurement is not a back-office function when contractor risk is involved. It is an early control point, because the buyer decides which supplier enters the work, which conditions must be met before award, and which exceptions are already tolerated before the first person reaches the site.

ISO 45001:2018 requires control of outsourced processes, competence, change management, and documented information. ISO 31000 gives the same manager a useful lens on treatment, monitoring, and review, because a buying decision is only complete when the risk criteria are explicit and the owner of the exception is known.

In more than 250 cultural transformation projects, Andreza Araujo has seen that sites lose discipline when the contract says one thing and the field expects another. That is why the manager must read procurement as a risk control, not as administration. The article on risk acceptance authority is the right companion, because the buyer should know who can accept the exception and who cannot.

What does the first week need to map?

The first week should not be spent reorganizing folders. It should be spent mapping where risk enters through buying decisions. Review rush orders, preferred suppliers, scope changes, emergency purchases, local exceptions, and any category where operations regularly asks procurement to move before the risk review is complete.

The practical map needs four things for each exposure: the service or material, the worksite, the control that should have existed before award, and the person who can stop the transaction when the control is missing. That map turns supplier risk into a visible decision chain instead of a vague concern shared by everyone and owned by no one.

During the first week, the manager should also listen to operations, maintenance, EHS, and supervisors. They will tell you where vendor promises usually break down. The article on contractor safety scorecard helps here because supplier selection should test job-specific readiness, not just a polished profile. The article on owner, EPC, and contractor governance is useful too, because the interface often fails before the contract even starts.

What should the first 30 days rebuild?

The first 30 days should replace generic screening with control-based screening. Insurance, certificates, and a basic HSE policy can still appear in the file, but they should no longer be treated as proof that the contractor is ready. Readiness depends on competence in the exact job the site is buying, under the exact conditions the site will create.

A stronger screen asks whether the supplier can describe the work method, the critical controls, the supervision ratio, the language used on site, the stop-work trigger, the emergency route, and the interface with site leadership. If the supplier cannot explain those points clearly, the risk has already surfaced before mobilization. A document file is not proof of readiness. As Andreza Araujo writes in A Ilusão da Conformidade ("The Illusion of Compliance"), clean paperwork can hide fragile execution.

The article on risk register cleanup belongs with this step because the register should describe live controls, not just vendor names. The article on contractor safety scorecard also fits, because the scorecard only matters when it changes award decisions.

What changes in month 2 when the mobilization gate goes live?

Month 2 is the right time to install a mobilization gate. The gate should sit between award and site entry, because that is where the organization can still prevent weak handoffs, unclear scope, and rushed starts. A mobilization gate that appears after the contractor is already on site is not a gate. It is a reminder.

The gate should require a clear scope statement, a named site owner, emergency route, permit needs, control requirements, and confirmation that the contractor understands the stop conditions. If the gate is easy to bypass, it will be bypassed. Procurement should own the commercial side of the gate while operations and EHS own the field side.

During the PepsiCo South America period, where the accident ratio fell 50% in six months, the practical lesson was that leadership rhythm changed results because field verification replaced comfort with evidence. In more than 250 cultural transformation projects, the same pattern repeats: if the gate can be bypassed once, it will be bypassed again when the job gets urgent. The article on risk review cadence is a good fit here, because the gate only works when the review stays predictable.

What should month 3 do with exceptions and rush orders?

Month 3 should focus on the buying exceptions that quietly create the most risk. Change orders, rush orders, scope drift, subcontractor substitutions, and last-minute material swaps often look like commercial details. In practice, they are exposure changes, because they alter the people, sequence, supervision, and methods that the site expected.

The procurement manager should create a simple exception log with four questions attached to every deviation. What changed, who approved it, what risk did it create, and what control changed before the work continued? If the answer is unclear, the exception should not be treated as routine. It should be escalated, because delay lets the operation normalize the new condition and call it ordinary.

The article on risk acceptance authority helps because exceptions fail when nobody knows who can approve the change, who must be consulted, and who can stop the work. The article on risk review cadence also matters, because exceptions age badly when the meeting is late and the field has already moved on.

Buying for price or buying for risk?

The table is simple because the tradeoff is simple. Price buying hides risk in later stages, while risk buying forces the decision into the open before the contractor starts work. The difference is not semantic. It is the difference between a purchase and a control decision.

What mistakes repeat in the first quarter?

The first mistake is to treat low price as proof of smart buying. Cheap is only smart when the work is still controlled. If the site saves money by hiring a contractor that cannot supervise the task, the savings are fake because the exposure has simply moved downstream.

The second mistake is to treat certificates as competence. A folder full of documents does not prove that the crew can work safely in the actual environment, with the actual supervisor, under the actual time pressure the site will create.

The third mistake is to outsource risk ownership to EHS. EHS should challenge, verify, and support. Procurement still owns the buying decision, and that decision includes whether the contractor can meet the site standard without hidden exceptions.

The fourth mistake is to let exceptions become culture. A single rush order may be unavoidable. A recurring rush order means the organization has designed a process that rewards bypasses. As Andreza Araujo shows in Safety Culture: From Theory to Practice, culture lives in repeated decisions, and A Ilusão da Conformidade explains why paper discipline can hide repeated field shortcuts until an event exposes the gap.

Resources to deepen the role

Safety Culture: From Theory to Practice is the best starting point because it explains why repeated decisions create the real operating culture. Make The Difference: Be a Leader in Health & Safety helps the new procurement manager see leadership as a daily discipline, not a title. If the role needs more depth, Andreza Araujo's Safety School and ACS Global Ventures consulting work can turn the first quarter into a practical buying routine instead of a site surprise.

The article on risk register cleanup helps when the file is full but the controls are thin. The article on contractor safety scorecard helps when supplier review still relies on impressions. The article on owner, EPC, and contractor governance is useful when the site needs a clearer line of accountability across the contract chain.

Conclusion

A new procurement manager does not need to solve every supplier problem in 90 days. The role needs to prove that buying decisions can stop weak work from entering the site, reset exceptions before they become habit, and make field leaders confident that the gate means something.

If procurement still treats risk as someone else's problem, the site is buying surprises and calling them efficiency. If you want help turning the first quarter into a control chain, start with Andreza Araujo at andrezaaraujo.com.