Procurement discipline sounds like a department. For most Australian small businesses it is a habit, and the habit takes ten minutes per vendor. Here is a short version any buyer can run.
Minute one to three: ABN Lookup. The free federal register confirms the entity exists, is active, and matches the name on the quote. Check the GST registration line; a vendor quoting GST without registration is a small red flag that predicts bigger ones.
Minute four to six: the certificates. ISO 9001:2015 for quality systems, ISO/IEC 27001 where data is involved. Do not accept the logo on the website; ask for the certificate PDF, then check the certification body on the JAS-ANZ register. A certificate from an unaccredited body is decoration.
Minute seven to nine: insurance. A current certificate of currency for public liability and, for service providers, professional indemnity. The certificate names the insurer and the expiry. If anything looks wrong, call the insurer named on the certificate and ask whether the policy is current.
Minute ten: the complaint line. Ask how complaints are handled and write the answer down. Providers with a real process answer in one sentence. Providers without one describe their low complaint rate, which is not the same thing.
The limit of this check: a file shows that systems exist, not that they are followed day to day.