How to Implement a Streamlined Procurement Workflow: PR, RFQ, PO, and GRN

In many hospitals, clinics, and distribution companies, procurement still runs through WhatsApp, Excel, and verbal approval. PRs are created without stock reference, RFQs are sent to one favorite vendor, POs are issued without budget checks, and GRNs are recorded later. As a result, dead stock, emergency purchases, mismatched invoices, and audit findings appear. In Yogyakarta and Magelang, the operational teams I meet often already have an ERP, but the procurement module is not used consistently because the workflow and master data are not yet organized. The solution is not to immediately buy a new application, but to design a clear PR, RFQ, PO, and GRN workflow, then implement it gradually with approval controls, audit trails, and integration into existing SIMRS/SIM Klinik/ERP/POS.

1. The first key: state machine and clean master data

Start with a state machine, not a form. Define document statuses: PR DRAFT, SUBMITTED, APPROVED, REJECTED, CONVERTED; RFQ DRAFT, SENT, CLOSED, AWARDED; PO DRAFT, ISSUED, PARTIAL_RECEIVED, CLOSED; GRN DRAFT, QC, ACCEPTED, REJECTED. Every transition must store the actor, timestamp, and reason. In PostgreSQL 16, store the header in procurement_document and the trail in document_history; never update status without history. This way, audits do not need to guess who changed what and when.

Master data must be clean before go-live. Vendors must at least have NPWP, bank account, payment terms, and active status. Items must have SKU, UOM, conversion, min-max, tax, and category. In hospitals, drugs/medical devices need batch and expiry; in Poultry/Layer ERP, feed and DOC need sack/kg conversion and warehouse. If the master is dirty, RFQ comparison and GRN matching will fail. Create unique constraints for vendor and SKU codes, then validate unit conversion when PRs are created.

Transition rules can be made simple in TypeScript 5.4/Node.js 20 LTS:

const allowed = {
  PR: ['SUBMITTED','APPROVED','REJECTED'],
  RFQ: ['SENT','CLOSED','AWARDED'],
  PO: ['ISSUED','PARTIAL_RECEIVED','CLOSED'],
  GRN: ['DRAFT','QC','ACCEPTED']
};
function canMove(type, to) {
  return allowed[type]?.includes(to) ?? false;
}
console.log(canMove('PR', 'APPROVED')); // true

The code above rejects status jumps, for example PR directly to CLOSED. For branching workflows, use XState 5 or Temporal, but a transition table is enough for an MVP. Ensure that only authorized roles can call certain transitions; do not let the UI be the only control.

2. PR, RFQ, PO, GRN flow with approval matrix and 3-way matching

PRs are created manually or automatically from the reorder point. Validate budget, stock, and duplication before submission. Example approval matrix: PR < Rp5 million auto-approve by department head after validation; Rp5–25 million by Operations Manager; > Rp25 million by Finance/Director. Approval SLA is 1 working day; rejection must have a reason. Approved PRs are converted to RFQ or directly to PO according to threshold.

For purchases > Rp10 million, RFQ requires at least 3 vendors. RFQ contains items, qty, UOM, delivery date, and terms. Vendors fill in price, lead time, and validity period. Compare landed cost, not just unit price. Use scores: price 60%, lead time 20%, quality 15%, compliance 5%. PO is created from the awarded RFQ so that prices and terms are automatically filled.

PO is issued with a unique number, vendor, tax, terms, and delivery address. Send PDF via email or WhatsApp gateway. GRN must reference PO lines: received qty, rejected qty, batch/expiry, and QC status. Support partial receipt; PO changes to PARTIAL_RECEIVED until total accepted qty equals ordered. Accepted GRN updates stock in SIMRS/ERP and creates a draft payable.

Perform 3-way matching between PO, accepted GRN, and invoice. Tolerance is 2% or Rp50,000 per line; above that goes into the exception queue. Separate the duties of requester, approver, and receiver. In hospitals, drug GRN must record batch, expiry, and storage temperature; in Poultry/Layer ERP, record warehouse and unit conversion. All exceptions must have an owner and a resolution deadline.

3. Integration, automation, and metrics that must be monitored

Integration via REST/JSON API and webhooks. Node.js 20 LTS with BullMQ 5 and Redis 7 is suitable for async jobs: generate PO PDF, send RFQ, sync stock, and post journal entries. For SIMRS, use internal API or read-only view; BPJS/SatuSehat/FHIR integration remains separate from procurement data. All requests use an idempotency key so retries do not duplicate PO or GRN.

Automation with quick impact: auto-create PR from min-max every day at 06:00, group by vendor/category, RFQ reminder after 3 days, and approval escalation if SLA is exceeded. For teams in Yogyakarta/DIY and Magelang, IT consulting & application development for SIMRS/SIM Klinik/ERP/POS/website can help map integrations without replacing systems all at once.

Monitor metrics: PR approval cycle < 1 day, RFQ response 3 days, PO on-time > 95%, GRN discrepancy < 2%, stockout < 1%, and maverick buying < 5%. Display dashboards per department and vendor. These numbers are more useful than long reports that are not acted upon.

Security: RBAC per role, MFA for approvers, immutable audit log, and vendor data encryption. Apply segregation of duties; the requester must not approve their own PO. Daily backups and monthly restore tests are mandatory before the system is used in production.

Best Practices

1. Validate budget and stock at the PR stage, not after PO issuance.
2. Require at least 3 vendors for purchases above Rp10 million and save the selection reason.
3. Apply an approval matrix based on value, category, and cost center.
4. Run 3-way matching with tolerance agreed by Finance.
5. Enable immutable audit log and separate the roles of requester, approver, receiver.

FAQ

Do you have to buy an expensive ERP to start?

No. Many teams simply build a procurement module incrementally on top of the existing database, then integrate it into SIMRS/ERP/POS. Start with PR, approval, PO, and GRN first.

How do you handle partial GRN?

Store the received qty per PO line, change the PO status to PARTIAL_RECEIVED, and calculate invoice matching proportionally. Close the PO only when the total accepted qty equals the ordered qty or the difference is approved.

How long is a realistic implementation?

An MVP for PR–RFQ–PO–GRN usually takes 4–8 weeks for one location. Stock, journal, and multi-warehouse integration can take 3–4 months depending on master data quality and the legacy system API.

How do you secure vendor data and approval?

Use RBAC, MFA for approvers, encryption of sensitive data, and audit logs. Ensure that no single person can create a PR, approve it, and receive goods at the same time.

Well-organized procurement is not about the most expensive application, but about clear states, measurable approval, and consistent data from PR to GRN. If you are designing or improving a procurement workflow for a hospital, clinic, retail, Poultry/Layer ERP, or a business in Yogyakarta/DIY and Magelang, Nugroho Setiawan can help through IT consulting and SIMRS/SIM Klinik/ERP/POS/website application development. From workflow audits and state machine design to integration and go-live assistance.

This article is part of the knowledge base of Nugroho Setiawan, an IT consultant in Jogja (Yogyakarta). Related solutions: PilarPOS SIMRS (Hospital Information System) Clinic Management System. Need a free consultation?