There are a number of shortcuts that can be taken when drafting the specification. These include the following:
- The use of brand names
- The use of recognised standards
- The use of samples
- Information and knowledge from users/other buyers: Drafting a specification should naturally include those already used within the organisation itself, but also variants used by other companies in the same sector and other companies in different sectors
- Information from suppliers: suppliers will always be willing to assist in specification development, as this this one way in which they can seek to influence the design to favour their own products.
Reference: CIPS study guide page 81-85
LO 2, AC 2.1

An insurance policy transfers a specific set of risks such as the fire and flood risk for a particular asset.
The legal liability does not transfer to the insurance company (known as insurer).
Reference: CIPS study guide page 150
LO 3, AC 3.2

KPIs track and control supplier performance, helping to identify and mitigate supply risks such as late delivery or poor quality.
They are a proactive management tool, not a price or sourcing mechanism.
Reference: CIPS L4M3 Commercial Contracting - "Purpose and use of KPIs in contract management."

Information Assurance (IA)
Information Assurance (IA) is the practice of managing information-related risks and the steps involved to protect information systems such as computer and network systems. The IA transformation is a partnership that stretches across the Department of Defense (DoD), Office of National Intelligence, Committee on National Security Systems, National Institute of Science and Technology (NIST), and the Office of Management and Budget.
The US Government's definition of information assurance is:
"measures that protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. These measures include providing for restoration of information systems by incorporating protection, detection, and reaction capabilities." Information Assurance (IA) is essentially protecting information systems, and is often associatedwith the following five pillars:
- Integrity
- Availability
- Authentication
- Confidentiality
- Nonrepudiation
The following pillars can be applied in a variety of ways, depending on the sensitivity of the information, or information systems within your organization. Currently, these five pillars are used at the heart of the US Governments ability to conduct safe and secure operations in a global environment.
1. Integrity
Integrity involves assurance that all information systems are protected and not tampered with. IA aims to maintain integrity through means such as anti-virus software on all computer system, andensuring all staff with access to know how to appropriately use their systems to minimize malware, or viruses entering information systems.
2. Availability
Availability simply means those who need access to information, are allowed to access it. Information should be available to only those who are aware of the risks associated with information systems.
3. Authentication
Authentication involves ensuring those who have access to information, are who they say they are. Ways of improving authentication involve methods such as two-factor authentication, strong passwords, bio-metrics and other devices. Authentication may also be used to not only identify users, but also other devices.
4. Confidentiality
IA involves the confidentiality of information, meaning only those with authorization may view certain data.
This step is closely mirrored by the six data processing principles of the General Data Protection Regulation (GDPR), where by personal data must be processed in a secure manner "using appropriate technical and organizational measures" ("integrity and confidentiality").
5. Nonrepudiation
The final pillar simply means someone with access to your organizations information system cannot deny having completed an action within the system, as there should be methods in place to prove that they did make said action.
Reference:
- What is Information Assurance (IA)?
- CIPS study guide page 99-100
LO 2, AC 2.1

SLAs define service levels and performance detail such as:
* Frequency of service (1)
* Staff qualifications (3)
* Stockholding requirements (4)Dispute procedures (2) belong in the contract, not the SLA.
Reference: CIPS L4M3 Commercial Contracting - "Service Level Agreements and performance control."