Lesson 5 of 5
Preparing and getting P2P sign-off
12 min
Sign-off is a decision, not a ceremony. The procurement process owner and Dan, for the finance steps, are being asked: based on the evidence, are you willing to run your business on this process? The sign-off package exists so they can answer that question in an hour, not by redoing the testing.
What goes in the package
| Section | Content | Contoso example |
|---|---|---|
| Scope and coverage | Coverage map against scope items and variants; what is out of scope and why | J45, 18J, 22Z, BMK, J60 covered; consignment out of scope (not used) |
| Results summary | Tests planned, run, passed, failed, blocked, by scope item and risk | 64 planned, 64 run, 61 passed, 3 failed and retested |
| Evidence index | Where the evidence for each test lives | Test management records with document chains |
| Open defects | Every open defect with severity, workaround, owner, fix date | 2 medium, 3 low; no critical or high |
| Accepted risks | Risks the owner accepts, with mitigation, owner and expiry | Service approval notification workaround until release 2 |
| Reconciliations | GR/IR per PO item, supplier balances to G/L, stock value to G/L at cycle end | All zero differences or explained |
| Roles and controls | Approval, tolerance, duplicate check and segregation of duties tests | All passed, including negative tests |
| Dependencies | What sign-off assumes from other streams | Supplier business partners and open POs reconciled after mock conversion 2 |
Contents of Contoso's P2P sign-off package.
- Week -3Exit criteria checkPriya checks coverage, pass rates, defect status against agreed exit criteria
- Week -3Package assembledResults, evidence index, defects, risks, reconciliations
- Week -2Review meetingProcess owner, Dan, Priya, Grace walk through the package; questions answered with evidence
- Week -2DecisionSign, sign with conditions, or refuse with reasons
- Week -1Go/no-go inputSigned P2P sign-off feeds Luis's cutover go/no-go
Exit criteria
Agree exit criteria at the start of the test phase, not the week before sign-off. Contoso's P2P exit criteria: all planned tests executed; all high-risk tests passed; no open critical or high defects; every control test passed including negative tests; GR/IR, supplier and stock reconciliations clean or explained; open medium and low defects have workarounds and owners. If the criteria are met, sign-off is a confirmation. If not, the package says exactly which criterion is missed.
Recording accepted risks
An accepted risk is a known gap the business chooses to live with for a while. Write it so that someone reading it in six months understands it: what can go wrong, how likely and how costly, what compensating step is in place, who owns it, and when it expires. "Accepted: notification issue" is not a risk record. "Service entry sheet approval notifications go to the purchasing group instead of the cost center manager; purchasing forwards them manually within one day; owner: procurement process owner; expires with the fix in release 2, planned for November" is.
What would you do?
The day before the review, a high-severity defect is still open: payment advices to suppliers show the wrong invoice reference. A manual workaround exists (AP emails corrected advices). The process owner wants to sign anyway. What should happen?
Running the review meeting
Send the package two days before the meeting so the signatories can read it. In the meeting, Priya presents coverage first, then results, then open defects and risks, and the reconciliations last, because they are the summary proof that the process works financially. Questions are answered by opening the evidence, not from memory. The meeting ends with one of three outcomes recorded in the minutes: signed, signed with named conditions, or not signed with the missing criteria listed and a date for the next review.
Keep the signed package with the test evidence. Auditors, the next release's test team and the hypercare team will all use it. And plan to revisit accepted risks at their expiry dates: a risk accepted "until release 2" that nobody follows up becomes a permanent gap.
- The sign-off package lets the owner decide on evidence: coverage, results, defects, risks, reconciliations, controls, dependencies.
- Agree exit criteria early; sign-off then confirms them or names what is missing.
- Record accepted risks with impact, mitigation, owner and expiry.
- Use conditional sign-off for known, time-bound gaps; never hide or downgrade defects.
Check your understanding · not graded
Lesson check
1. Who should sign off the procure-to-pay process?
2. When should exit criteria be agreed?
3. Which is a complete accepted risk record?
4. Which reconciliation belongs in the P2P sign-off package?