CPSD cheat sheet

Program mandate originates from one of three drivers: customer contract requirement, board/ESG commitment, or public-sector regulation; the driver determines whether goals are aspirational or contractual.

Governance charter should define scope (tiers covered, commodity exclusions, certification standards accepted), goal-setting method, approval authority, and escalation path for disputes.

Tiered governance model: executive sponsor sets policy annually, a cross-functional council (procurement, legal, ESG, business units) reviews quarterly, and category managers execute monthly.

Goals are set as percent of addressable spend, not total spend; addressable spend excludes sole-source, regulated utilities, taxes, and spend with no diverse market supply.

Maturity models typically progress through reactive (report only), structured (goals and certification checks), integrated (embedded in sourcing process), and outcome-driven (supplier development and Tier 2).

Policy must state whether certification is required at bid, at award, or within a cure period; the choice materially changes bid cycle time and dispute volume.

Delegate authority matrix should specify who can waive a diversity requirement and what documentation a waiver needs (market scan, documented outreach, business rationale).

Annual program review should reconcile goal vs. actual, certification lapse rates, Tier 2 reported vs. validated, and supplier attrition, then reset targets for the next cycle.

Commonly accepted US certifications: NMSDC (MBE), WBENC (WBE), US SBA (8(a), SDB, HUBZone, WOSB/EDWOSB), and state/local programs; each has its own eligibility tests and renewal cycle.

Certification is not self-identification: a supplier that merely checks a box in a portal is self-registered, not certified, and should be tagged differently in the supplier master.

MBE eligibility generally requires 51% ownership and control by US citizens or permanent residents of qualifying minority status; control means operational authority, not passive ownership.

WBE certification generally requires 51% ownership and control by women; many certifying bodies require an on-site or virtual site visit and review of governance documents.

SBA size standards are set by NAICS code; a firm can be small for one NAICS code and large for another, so size status must be checked per opportunity.

Verification workflow: collect certificate, confirm issuing body and expiration, match legal entity name to the certificate, and re-verify before each award and at renewal.

Supplier master data should store certification type, issuing body, certificate ID, expiration date, and verified-by/verified-on fields to support audit and reporting.

Qualification for capability is separate from diversity status; a diverse supplier must still pass financial health, insurance, quality, and cybersecurity screening to be awarded.

Bid list design rule: include at least two certified diverse suppliers where an available market exists, and document the market scan if fewer are identified.

Unbundling large scopes into smaller lots can expand diverse supplier participation, but increases transaction cost and interface risk; decide per category.

Payment terms are a lever: net-30 or accelerated payment for small diverse suppliers improves their working capital more than a marginal price concession.

Contract clauses to standardize: certification representation and warranty, notification duty on lapse, right to audit, Tier 2 reporting obligation, and termination for misrepresentation.

Joint ventures and mentor-protege arrangements can satisfy participation requirements, but the diverse partner must have real, documented control or defined work share.

Evaluate total cost of ownership, not unit price alone; diversity credit should not override quality, delivery, or compliance scoring in the award decision.

Sourcing playbook should specify when a diversity requirement is mandatory (contract flow-down), preferred (scored), or informational, and how scoring weights are disclosed.

Contract renewals and incumbency are the largest leakage points; re-screen incumbent suppliers for current certification before each renewal.

Development programs should be targeted by gap: financial readiness, quality systems, cybersecurity, capacity, or sales/marketing; a generic curriculum wastes resources.

Common formats: cohort-based business accelerators, one-on-one mentoring, technical assistance grants, working capital or invoice-factoring access, and buyer-supplier matchmaking.

Measure development outcomes with before/after metrics: revenue from the buying organization, new certifications, jobs added, capital raised, and contract win rate.

Mentoring pairs should have a defined scope and cadence (e.g., monthly sessions over 12 months) with written goals and a sponsor on both sides.

Capacity risk: a small supplier may win an award it cannot finance; assess working capital, bonding capacity, and insurance limits before scaling volume.

Internal champions matter: category managers who sponsor a diverse supplier through onboarding reduce failure rates more than external training alone.

Graduation criteria should be explicit so resources move to new suppliers rather than becoming permanent subsidies.

Track cost per supplier developed and contract value generated per dollar of program spend to justify the budget.

Tier 2 spend is the diverse spend reported by a prime supplier's own subcontractors; it is indirect spend and must never be added to the buying organization's Tier 1 totals.

Flow-down clause should specify reporting frequency, template, certification evidence, and the consequence of non-reporting (e.g., cure period, scorecard impact).

Reported Tier 2 figures require validation: sample invoices or subcontract records, confirm subcontractor certification, and check for double counting across primes.

Set Tier 2 goals as a percent of subcontractable spend, not total prime contract value, so primes are not penalized for work performed in-house.

Advocacy activities: supplier matchmaking events, prime-to-subcontractor introductions, recognition programs, and publishing a diverse supplier directory.

Common reporting errors: counting self-registered suppliers as certified, counting Tier 1 spend as Tier 2, and reporting expired certificates.

Dashboard should show primes by reported Tier 2 dollars, percent of subcontractable spend, submission timeliness, and validation exception rate.

Where a prime cannot meet a Tier 2 goal, require a written explanation and a corrective plan rather than accepting a zero report.

US federal small business subcontracting plans (FAR 52.219-9) require goals by category and periodic ISR/SSR reporting through the government's subcontracting system; commercial practice often mirrors this.

Affirmative action concepts apply to federal contractors under OFCCP rules; documentation of outreach and good-faith effort is the compliance evidence.

Certification fraud (front companies, pass-through arrangements) carries civil and criminal exposure; due diligence should test for control, not just ownership paperwork.

Data privacy: supplier diversity records include ownership demographics; collect only what the program needs, restrict access, and state the purpose in the supplier portal.

Conflict of interest: staff who own supplier diversity goals must not also approve the certification of suppliers they are championing without independent review.

Anti-discrimination: programs must be structured to expand opportunity, not to exclude non-diverse bidders from competing; award decisions should remain capability-based.

Audit readiness: retain certificates, verification records, market scans, and waiver approvals for the period required by contract or regulation.

Record retention and reporting deadlines differ by jurisdiction; confirm whether local content or supplier diversity rules apply to each contract location.

Tier 1 diverse spend % = diverse supplier spend / total addressable spend; always disclose the denominator definition alongside the number.

Addressable spend = total spend minus excluded categories (taxes, regulated utilities, sole-source, intercompany, payroll-related); exclusions must be documented and stable period to period.

Data quality steps: normalize supplier names, map to a single parent legal entity, join certification records, and flag expired or unverified certificates.

Core metrics: diverse spend dollars and percent, certified vs. self-registered split, diverse supplier count, new supplier adds, retention rate, and average contract value.

Secondary metrics: bid participation rate, award rate from diverse bids, payment cycle time for diverse suppliers, Tier 2 reported dollars, and goal attainment by category.

Certification lapse inflates reported spend; run a monthly expiration report and restate prior-period figures when lapses are discovered.

Benchmarking should compare against similar industry and spend profile, not against a single headline percentage from another company.

Report structure: executive summary with goal vs. actual, category breakdown, Tier 2 status, development outcomes, and a data quality note.

Business case pillars: market access (customer requirements), innovation and competition, supply chain resilience, community/ESG commitments, and price benefit from expanded bid pools.

Audience segmentation: executives need goal and risk; category managers need supplier lists and process; external customers need contract compliance evidence; suppliers need opportunity access.

Customer contract flow-down is often the strongest internal lever; map which customers require supplier diversity reporting and prioritize those categories.

Internal communications cadence: quarterly scorecard to leadership, monthly category manager updates, and an annual supplier summit or matchmaking event.

Supplier-facing communications should publish how to get certified, what the buying organization buys, and the contact path for each category.

Avoid overstating results: distinguish certified from self-registered, Tier 1 from Tier 2, and reported from validated figures in all external messaging.

Stakeholder resistance is usually a process concern (cycle time, risk) rather than ideological; respond with data on bid pool size, quality outcomes, and cycle time.

Recognition programs (supplier of the year, executive sponsorship) reinforce behavior, but should be tied to measurable outcomes rather than participation alone.