Summary

  • Invitation is a procurement method, not evidence of favouritism. It can be proportionate for low-value purchases, urgent needs, sensitive security work or markets with a small number of qualified suppliers. The risk is that competition occurs only inside a shortlist whose formation is invisible, allowing incumbency, personal networks or narrow assumptions to determine the result before bids are compared.
  • APNIC's public 2024 Executive Council materials and annual report state that it conducted a closed market tender for management of its investment portfolio and appointed a new investment management firm. The disclosure demonstrates that a finite invited competition can replace an incumbent. It does not identify the invited field, selection rule, proposal count, evaluation weights, conflicts, fees or award rationale, so the public record cannot assess the quality of competition.
  • ARIN publishes a contrasting rule. Its External Contracting Process generally covers contracts of at least USD 50,000 a year, provides for public announcement, attempts to secure at least two competitive bids, specifies proposal content and publishes awards. The policy excludes categories including insurance, legal services, operations and maintenance, travel, benefits, venues and opportunities involving sensitive disclosure. The exclusions make an exception register as important as the open rule.
  • ARIN's award history shows that open publication can produce substantial fields: 30 proposals for a 2015 colocation competition, 20 for each of two 2015 transit competitions and ten for a 2024 strategic-planning request. Those examples do not prove that open tender is always superior, but they weaken the assumption that specialized registry needs are necessarily understood by only familiar suppliers.
  • A community institution should build an invited shortlist from documented market mapping, objective qualification, conflict screening and rotation, not staff memory. It should record the longlist, search channels, reasons for inclusion and exclusion, common information, bid time, recusals and independent approval. The Board should see the selection universe before it sees the preferred vendor.
  • Transparency should continue after award. Members need the supplier, purpose, value or band, duration, selection method, number invited and bidding, criteria, conflict treatment, material amendments, renewal history, performance result and exit status. Security, legal privilege and trade secrets justify tailored redaction; they do not justify erasing the existence, value, authority and retrospective performance of a contract.

The shortlist decides more than the scorecard

A tender appears competitive when three or five suppliers submit proposals and an evaluation panel scores them. Yet the decisive act may have occurred earlier, when someone selected those three or five from the wider market. A flawless scorecard cannot correct a shortlist designed around the incumbent, a familiar professional circle or a narrow idea of what the service must be.

Invitation has legitimate uses. Preparing a bid is costly. An institution should not solicit dozens of proposals when only a few firms meet a specialist requirement. Public advertising can expose sensitive architecture or legal strategy. Urgent replacement may not allow a long contest. Requiring every small purchase to pass through a global tender can waste member money and favour large suppliers with dedicated bid teams.

The danger is not small numbers by themselves. It is undisclosed selection of the universe. Staff may invite firms they already know because those firms can be reached quickly and understand the organization. Directors may recommend advisers used by their employers. A consultant may suggest implementation vendors whose methods resemble its own. A departing supplier may help write requirements that only close competitors can meet. A market scan may rely on a commercial ranking that excludes regional or smaller firms.

These mechanisms do not require bribery. They arise from convenience, risk aversion and professional networks. The same people who appear safest also receive the experience and references needed to appear safest next time. New entrants cannot demonstrate registry knowledge because they are never invited to acquire it.

For a member-funded institution, shortlist governance is therefore more important than bid arithmetic. The record should explain how potential suppliers were discovered, which minimum criteria were used, how conflicts were checked, why the number invited was sufficient and who approved exclusions. Competition should be tested from market mapping to contract exit, not only during the weeks when sealed proposals sit in an inbox.

Private incorporation does not erase a community duty

RIRs are not government purchasing departments. They are generally private, non-profit or membership institutions operating under their incorporation law, agreements and internal governance. Public procurement statutes may not apply to them in the same way they apply to a ministry. Importing every state rule would be both legally careless and operationally heavy.

Their accountability case is nevertheless strong. They collect fees tied to regional registry services, exercise durable institutional authority, hold substantial reserves and buy services that can influence policy, security, membership, communications and technical infrastructure. Members often cannot choose another RIR for the same regional relationship. Procurement is therefore not merely back-office spending; it determines who gains access, information, influence and recurring revenue around a community institution.

The right standard is proportional rather than governmental. Small routine purchases need simple controls. Material, strategic or high-risk contracts need wider competition and stronger records. Sensitive work needs protected competition rather than automatic secrecy. Sole-source decisions need explicit reasons, time limits and independent approval. Renewals need evidence of performance and a fresh market test at defined intervals.

Public-sector guidance can inform this design without being treated as binding law. The OECD Recommendation on Public Procurement emphasizes transparency, integrity and precaution around exceptions to competitive tendering. The OECD's later implementation review notes that transparency can improve access and accountability, while poorly timed disclosure can expose trade secrets or facilitate collusion. The lesson is calibrated disclosure, not publication of every bid.

A community institution should be able to explain its own standard in one public policy. Members should know thresholds, methods, exceptions, conflicts, approval levels, publication, amendment, performance review and complaint routes. Without that baseline, every contract is judged by management's account after the fact.

APNIC's closed tender is a useful but incomplete exhibit

APNIC's public June 2024 Executive Council minutes report that the Secretariat had commenced a closed market tender for management of the organization's investment portfolio. The 2024 Annual Report later states that the closed tender was conducted and a new investment management firm appointed.

This is significant in two directions. First, the process did not simply preserve the existing provider: the annual report says a new firm was selected. Invitation can therefore produce genuine replacement. Second, the public description stops before members can evaluate the competition. It does not state how the market was mapped, how many firms were invited, how many responded, what minimum qualifications applied, which criteria and weights governed selection, whether fees were compared on a common basis or how conflicts were handled.

Investment management can justify prequalification. The institution may require licensing, custody arrangements, reporting capability, a particular mandate, regional service, risk controls and experience with non-profit reserves. Detailed proposals can contain proprietary strategies and pricing. Open publication of every submission would not necessarily improve value.

Those facts support a two-stage process. An open request for expressions of interest can publish the mandate at a safe level and allow qualified firms to identify themselves. Objective criteria can then produce a protected shortlist. The final competition can remain confidential while an award notice reports the field size, method, criteria, selected firm, fee structure or band, conflicts and decision reason.

The APNIC record does not establish that its closed tender lacked these internal steps. It establishes that the public cannot see them. That distinction is essential. Institutional analysis should not convert missing disclosure into an allegation. It should identify the additional evidence needed for members to assess whether the invitation stage was fair and sufficiently broad.

ARIN publishes a rule and its exceptions

ARIN's External Contracting Process has existed publicly since 2011. It states that professional services should be contracted fairly, consistently and for best value, which need not mean the lowest price. For contracts of USD 50,000 per year or more, except listed categories, the President reviews opportunities with the Board before public announcement. ARIN attempts to secure at least two competitive bids, publishes the opportunity and award, and asks for written proposals covering scope, references, pricing and delivery.

The rule supplies several governance virtues. A threshold is visible. Public announcement opens the initial field. The policy recognizes quality-price trade-offs. Proposal requirements are common. Board awareness precedes solicitation. Award publication creates a trace after the decision.

The exclusions are broad: hotels and meeting venues, operations and maintenance, insurance, employee benefits, travel, legal services and opportunities where publication could inappropriately disclose information. Each can have a practical rationale. Venue markets are date and location constrained. Legal strategy can be privileged. Security or operational detail can expose systems. Insurance placement follows specialist market practices. Benefits and travel involve recurring administrative arrangements.

But excluded categories can be large, repeated and influential. Operations contracts can control critical infrastructure. Insurance brokers shape risk presentation. Legal advisers influence institutional interpretation. Meeting venues affect access and cost. An exclusion from the standard public request should not be an exclusion from competition, conflict review, approval or retrospective disclosure.

ARIN's policy also says it creates no rights or expectations for members or third parties and may be modified. That reservation may protect organizational flexibility. Governance still requires a record when the institution departs from its published norm. Otherwise, the rule is strongest where it matters least and weakest where discretion is greatest.

Open publication can discover a market the buyer did not know

ARIN's External Contracting Results provide a rare public history. A 2015 west-coast colocation request received 30 proposals. Two east-coast Internet-transit requests received 20 bids each. Other 2015 transit competitions received ten and eleven bids. A 2024 request for strategic-planning support received ten proposals, with Finley and Associates selected for cost and capabilities.

These figures are not a controlled comparison of open and invited procurement. Contract types, years, market conditions and qualification differ. A large response can burden evaluators, and more bids do not guarantee better value. Some proposals may be non-responsive. The published results do not provide every score or contract value.

They nonetheless demonstrate a discovery function. Even technical infrastructure and strategy work attracted fields much larger than the minimum two bids in the policy. If staff had invited only the firms already known to them, some capable bidders might never have appeared. Public notice lets the market challenge the buyer's assumption about who can perform.

Open competition can also improve specifications. Questions from unfamiliar suppliers reveal ambiguities, unnecessary credentials and incumbent-specific assumptions. A smaller firm may propose a different delivery model. A provider outside the usual regional circle may expose price or capability that changes the negotiation even if it does not win.

The response should not be to require open tender for every contract. It is to treat market discovery as a separate stage. A short, safe publication can invite capability statements without disclosing sensitive detail. Procurement staff can then prequalify and conduct a manageable competition. Invitation becomes the second stage of openness rather than an alternative to it.

Where even a capability notice would create harm, the exception record should state why. The Board can then test whether secrecy is necessary for the entire procurement or only for particular documents and times.

Familiarity compounds into an incumbent advantage

An incumbent begins with real advantages. It knows systems, staff, acronyms, approval patterns and historical problems. Transition risk is lower. Its past performance can be observed directly. Those advantages can represent genuine value and should not be ignored merely to produce turnover.

They can also become self-reinforcing. Requirements are written around the current service. The incumbent knows the budget and pain points. Staff rely on it to estimate switching cost. Data and documentation remain in its tools. A short bid period favours the firm already prepared. References demand experience that only previous RIR suppliers possess. The evaluation gives high weight to continuity without pricing the dependency continuity created.

An invitation list intensifies this effect. Procurement staff tend to include the incumbent and a few recognizable alternatives. A new firm must be known before it can be invited, but it cannot become known through the institution's contracts because it is not invited. Over time, a small supplier circle gains information and credibility unavailable to outsiders.

The remedy is not automatic rotation. Replacing a strong supplier for symbolic novelty can waste money and increase risk. The institution should instead price incumbency honestly. It should give all shortlisted bidders common data, sufficient time and equivalent access to questions. Requirements should describe outcomes rather than the current product. Transition support and data portability should be contractual before the tender begins.

Evaluation should separate past performance from familiarity. The incumbent's delivery record is evidence. Personal comfort with its staff is not. A challenger should receive credit for a credible transition plan and open standards. The panel should identify criteria that only the incumbent can satisfy and explain whether each is truly necessary.

At renewal, the Board should see cumulative tenure, amendments, price movement, unresolved dependency and the date of the last open market test. A succession of annual extensions can create a de facto long-term award without the scrutiny applied to the original contract.

Market mapping must precede invitation

A defensible shortlist begins with a longlist. Procurement staff should use multiple search channels: prior suppliers, public capability notices, professional registers, technical communities, peer institutions, independent advisers, market research and unsolicited expressions of interest. The record should show the channels and date, not merely say that the market was reviewed.

Minimum qualifications should be tied to the contract. Financial stability, security controls, licensing, professional indemnity, geographic coverage, language, response time, technical standards and relevant experience may all matter. Each should have a reason and proportionate threshold. Requiring a global office network for work delivered remotely, or several prior RIR clients in a market of five RIRs, can eliminate competition without improving performance.

The institution should distinguish qualification from scoring. A supplier either satisfies a mandatory legal licence or it does not. Among qualified suppliers, additional experience can be scored. Mixing the stages allows evaluators to exclude an unfamiliar bidder through subjective judgments before its price or approach is considered.

The longlist record should include exclusions. Some reasons can remain confidential, such as adverse due diligence or protected security information. Categories can still be reported: failed mandatory licence, unmanaged conflict, limited public evidence capacity, sanctions restriction, non-responsive capability statement or inability to meet a critical service requirement.

Rotation can improve discovery. A rule might require at least one qualified supplier not invited to the previous contest, where the market permits. Another option is periodic open prequalification, producing a panel from which smaller requests are competed. The panel itself must expire and reopen; otherwise, a one-time gateway becomes a permanent closed club.

The Board should approve the method and high-risk exclusions, not pick commercial winners. Its role is to ensure that the field was formed through a fair rule before management evaluates proposals.

Market mapping should also separate the legal supplier from the people who will perform the work. A global firm may qualify through its brand while proposing a newly assembled team with little relevant experience. A small specialist may rely on named experts whose departure would remove the reason for selection. Capability statements should therefore identify the contracting entity, delivery team, subcontractors, locations, financial backing and substitution rules. Evaluation should not credit experience that will not be available to the contract.

Due diligence needs the same proportionality as competition. Corporate registration, beneficial ownership, sanctions, financial stability, litigation, security, privacy, professional discipline and insurance can matter. The institution should decide which checks apply to which risk class and offer suppliers a chance to correct factual error. A vague adverse-media search can reproduce bias against firms from heavily reported jurisdictions, while missing quiet conflicts in familiar markets.

Geography requires judgment. ARIN's published policy generally anticipates contractors doing business in its region. Regional presence can support legal enforcement, time-zone response and community understanding. It can also exclude capable firms and raise price. Each geographic restriction should connect to a delivery need rather than an assumption that local incorporation proves local competence. For a registry serving many economies, a single headquarters country should not define the entire competitive field by default.

Language can operate similarly. A supplier may need to work in several member languages, but requiring every capability in one prime contractor can favour large intermediaries. Dividing work into lots or allowing consortia may widen competition. The tender should state who remains accountable when subcontractors deliver language, regional or specialist components.

Market engagement before tender can improve specifications if access is equal. The institution can publish a request for information, hold recorded supplier briefings or consult a varied sample. It should disclose who participated and prevent one prospective bidder from privately designing the final terms. Where an incumbent supplies essential technical facts, those facts should be verified and shared with competitors in a safe form.

Finally, the longlist itself should be retained for audit beyond the award. Staff turnover otherwise removes the evidence showing why firms were or were not invited. The next contest can then compare the previous map, identify new entrants and test whether old qualifications remain necessary. Procurement memory should belong to the institution, not to the employee or adviser who knows the market personally.

Community networks create both expertise and conflicts

The Internet technical community is small. Directors, staff, consultants and suppliers meet through RIR events, operator groups, standards bodies, research projects and previous employment. This density produces valuable expertise and trust. It also makes arm's-length procurement harder.

A conflict is not limited to owning shares in a bidder. A director's employer may be a client or partner. A staff member may have worked for the firm. A consultant designing the tender may hope to join the implementation team. A supplier may sponsor events, provide free services, fund research or employ community volunteers. A panel member may have publicly endorsed a product. A bidder may rely on a subcontractor connected to an evaluator.

The procurement record should identify financial, employment, professional and material community relationships for everyone who shapes scope, shortlist, evaluation, negotiation and acceptance. Disclosure should be refreshed, because a relationship can arise after the contest begins. Recusal should remove access to proposals and informal influence, not merely the final vote.

Donated or discounted service deserves special care. ARIN's historical award notices include providers selected partly because services were offered without charge in support of the mission. Such contributions can be valuable. Zero price is not zero dependency. The institution should assess service levels, data rights, exit, branding, future pricing and whether the contribution gives the provider influence or an advantage in later paid work.

Community reputation should be evidence, not currency. A respected individual may be highly qualified, but institutional procurement should assess the firm, team, capacity, conflicts and deliverables. Conversely, an unfamiliar regional supplier should not be excluded because evaluators have not met it at community events.

An independent observer can strengthen strategic or high-conflict contests. The observer need not rescore proposals. It can verify equal information, recusals, criteria application and decision records, then report whether the stated method was followed.

Security and confidentiality justify redaction, not a blank record

Some registry contracts cannot be tendered with full public detail. A penetration test request can expose targets and assumptions. A managed detection competition can reveal logging gaps. Legal work can identify disputes and strategy. Physical security, fraud investigation and incident response can be similarly sensitive.

The first governance mistake is to equate sensitive scope with a single source. Qualified suppliers can sign confidentiality agreements. A safe capability notice can avoid architecture. A prequalified security panel can compete protected statements of work. An independent specialist can review technical quality without publishing vulnerabilities. Urgency can justify an interim contract followed by a later competition.

The second mistake is permanent secrecy. Information changes sensitivity over time. Before award, bidder identities and prices may need protection. After award, the institution can usually disclose the service category, supplier, term, value band, method, number invited, number responding and approving authority. After remediation, more detail about a security assignment may become safe.

Every redaction should have a reason and review date. Legal privilege, trade secret, personal data, active security risk and negotiation position are different grounds. They should not be collapsed into confidential. The record should disclose the non-sensitive remainder.

The exception authority should sit above the requester. A manager who wants a preferred security vendor should not alone decide that publication is dangerous. Security and legal staff can advise; procurement or a Board committee should approve material restriction. The decision should state whether confidentiality changes advertising, bidder count, publication or all three.

Protected procurement is compatible with accountability. Members need evidence that competition and conflicts were controlled, not the exploit details the supplier was hired to find.

Thresholds create cliffs, splitting and invisible renewals

A public threshold makes administration proportionate. ARIN's USD 50,000 annual line tells staff and suppliers when the published process generally applies. Without a threshold, every purchase can become an exception or every coffee order a tender.

Thresholds also create incentives. A requirement can be divided into contracts below the line. A pilot can become recurring work. An initial low price can rise through change orders. Several departments can buy related services separately. A one-year contract can be renewed repeatedly without counting cumulative value.

The rule should therefore aggregate reasonably related needs over the expected term. It should include options, likely extensions and connected statements of work. Splitting may still be legitimate when lots widen access or separate distinct risks, but the reason should be documented. Deliberate division to avoid approval should be prohibited.

Renewal is where invitation often becomes permanence. The original competition may be sound, yet five years of extensions produce a contract far larger and different from what bidders saw. Each material renewal should report cumulative spend, performance, amendments, dependency, market change and the cost of competition. Automatic renewal clauses should not displace an institutional decision.

Emergency exceptions need a clock. The registry may have to restore a failed service or obtain counsel immediately. The approving officer should record the event, supplier choice, value ceiling and duration. Once the emergency passes, continuing work should return to ordinary competition. A crisis contract should not become the unexamined architecture for the next decade.

Below-threshold purchasing still needs rotation and conflict controls. A pattern report should identify repeated awards to one supplier, connected vendors and requester concentration. Small invoices can together fund substantial influence.

Evaluation must distinguish fit from a familiar answer

Good tender documents state criteria and weights before proposals arrive. Price, technical quality, security, resilience, transition, accessibility, regional coverage, environmental factors and community understanding can all be legitimate. Hidden criteria allow evaluators to rationalize preference after seeing names.

Best value does not mean lowest price. ARIN's policy says so directly, and registry services often justify it. A cheap provider that cannot meet incident obligations, protect data or support exit can create far greater cost. The discipline lies in defining quality and testing it consistently.

Demonstrations and interviews can reveal capability, but they also increase subjectivity. The institution should use common scenarios and questions, record scores independently before panel discussion and explain large divergences. References should be sought on equivalent dimensions. Negotiation should not give the preferred bidder a chance to repair weaknesses unavailable to others unless the same clarification opportunity exists.

Names can be masked for parts of evaluation where practical, such as written method or case analysis. This will not remove all identity clues and is unsuitable for past-performance assessment. It can reduce the first impression created by a famous firm or known individual.

Evaluation should include the cost of dependency. Proprietary formats, supplier-controlled keys, weak documentation, restrictive licensing and scarce implementation skills should reduce value. A slightly higher bid with credible portability can be cheaper over the contract life. The incumbent's transition advantage should be balanced against the exit risk accumulated under another term.

The award minute should connect evidence to criteria. Saying that a supplier offered the best fit or strongest capabilities is too broad. A concise public account can identify decisive factors without revealing competitors' trade secrets: for example, tested response coverage, lower total cost, stronger transition, specified regulatory licence or demonstrable technical performance.

Bidders need a route to challenge the process

A procurement policy written only for the buyer is incomplete. Suppliers need a contact for clarification, equal answers to material questions, notice of outcome and a way to report conflict or procedural departure without approaching the evaluator whose conduct is challenged.

Debriefing improves future competition. An unsuccessful bidder can learn which criterion it failed and whether its price or method was uncompetitive. The institution can discover ambiguous requirements and scoring inconsistency. A debrief need not reveal another firm's confidential proposal or enable endless negotiation.

A challenge route should be time-bound and focused on process. It can examine undisclosed conflict, unequal information, changed criteria, arithmetic error, improper exclusion or failure to follow the stated method. It should not substitute a reviewer's commercial preference for the panel's reasoned judgment.

For material contracts, someone outside the evaluation team should hear the challenge. Depending on scale, that may be a procurement officer, executive, audit committee or independent reviewer. Award signature can pause briefly, while urgent contracts use a later remedy. The record should state challenges and outcomes in aggregate.

Suppliers may fear exclusion from future invitations. The policy should prohibit retaliation for good-faith questions or complaints. An invited market in which firms depend on personal relationships is especially vulnerable to silence. Anonymous reporting can help, though the institution must protect against strategic accusations.

Members do not need standing to relitigate every score. They do need assurance that a vendor affected by unequal treatment had a credible route to raise it. A process that cannot tolerate challenge is unlikely to learn from its own shortlist.

The contract can defeat the competition after award

Competition is often declared complete at award, but value can change through negotiation and execution. The winning bid may promise named staff, open standards, service levels, reporting and transition. The signed contract can soften those promises. Later amendments can increase price, extend term, expand scope or replace key people.

The final contract should preserve the evaluated offer. Material departures should return to the approving authority with an explanation of whether other bidders would have been treated differently had the revised term been known. An institution should not select on a strong promise and negotiate it away in private.

Performance needs an owner independent of the day-to-day supplier relationship. Acceptance criteria should be measurable. Deliverables should be recorded as accepted, rejected or delayed. Security incidents, conflicts, service credits, audit rights and subcontractor changes should be tracked. Relationship comfort should not replace evidence.

Amendments deserve cumulative review. A series of small changes can transform the commercial bargain. The public contract register should show material value and term changes, with sensitive detail protected. The Board should receive concentration across suppliers and related contracts, not isolated approvals.

Exit should be tested before renewal. Can data, configuration, records and institutional knowledge move? Are deletion and access termination verifiable? Can another supplier operate from the documentation? Does the registry retain rights to custom work? A failed exit test is both a performance finding and an incumbency risk.

Completion reporting closes the accountability loop. It should compare cost, time, deliverables, service quality, incidents, member effect and lessons against the award case. Without it, procurement policy governs promises while vendors are paid for outcomes no one publicly evaluates.

Payment design deserves its own control. Large advances move performance risk to the registry; payment only at the end can exclude smaller firms that cannot finance months of work. Milestones should correspond to verifiable outputs and retain enough value to secure correction. Time-and-materials work needs ceilings, rate cards, approval for category changes and evidence that hours produced the intended result. Fixed price needs a controlled route for genuinely unforeseen scope rather than informal renegotiation.

Intellectual-property terms shape future competition. If a supplier owns custom code, research instruments, configuration or documentation, later bidders may have to rebuild work the members already funded. The registry should define rights before award and price exceptions explicitly. Open-source release is not always appropriate, but the institution needs durable rights to operate, secure, modify, audit and transfer critical deliverables.

Data access should follow least privilege and end with verified removal. The contract should list information categories, permitted purposes, storage locations, subcontractors, retention, incident notice and return or deletion. A consultancy that receives member records or strategic material can create exposure long after the final presentation. Procurement acceptance should not close until access is removed and required records are transferred.

Knowledge transfer is also a deliverable. A supplier can meet immediate service levels while making the institution less capable of operating or competing the requirement later. Documentation, paired work, training, reproducible configuration and handover exercises should be scored and tested. If only the incumbent can write the next specification, the current contract has already impaired the next competition.

Performance sanctions should be credible but proportionate. Service credits may be too small to alter behaviour, while immediate termination can be unusable for a critical dependency. Step-in rights, corrective plans, increased reporting, replacement of key staff and staged transition provide intermediate remedies. The Board should know when management waived a material remedy and why.

Supplier success should be recognized as well. A completion record that only catalogs failures discourages honest reporting and gives future evaluators a distorted picture. The institution should state which outcomes exceeded expectations, whether innovation reduced cost and whether a strong provider deserves renewal credit. Accountability is not a presumption that every contract is suspect; it is a demand that praise and criticism rest on evidence.

A contract register can expose patterns without exposing secrets

The minimum public record should identify supplier, service category, responsible executive, selection method, approval date, value or band, start, end, options and status. For invited procurement, it should state the number considered, invited and responding. For sole source, it should state the reason and expiry of the exception.

The register should add conflicts and competition history: whether a recusal occurred, whether the incumbent bid, when the requirement was last openly advertised and cumulative supplier tenure. It should show material amendments and final outcome. Security-sensitive contracts can use a delayed or generalized description while retaining value, authority and review date.

Publication by itself is not enough. Data should be consistent enough to reveal concentration by supplier, category, requester and method. Members should be able to see how much material spend was openly competed, invited, sole-sourced or exempt; average bidder counts; repeated exceptions; amendment rates; renewal tenure and completion results.

The institution should publish the policy and annual exception report beside the register. If a category such as legal or insurance is excluded from open procedure, the report should show aggregate spend, competition method, provider concentration and review frequency. This prevents exclusions from becoming an invisible parallel purchasing system.

The register should cover in-kind and donated service where it creates access, dependency or future advantage. A zero-value entry can still identify term, service, data rights and approving authority. Gifts of expertise should not purchase opacity.

A registry does not need the elaborate portal of a national government. A maintained table and linked award records would materially improve accountability. The difficult step is not software. It is accepting that supplier relationships form part of the community's institutional record.

The invited tender needs a public theory of exception

Invitation should be one method inside a policy, not a label that ends inquiry. The policy should say when it is suitable: a demonstrably limited market, protected information, proportionate low value, prequalified panel, urgent interim need or failed open contest. It should state the normal minimum number of independent suppliers and what happens when fewer respond.

The institution should publish how the shortlist is formed, how often panels reopen, how conflicts are handled, who approves restriction and what is disclosed after award. Every exception should expire. Repeat use should trigger a market test and Board review.

Method choice should be written before supplier names are discussed. The requester should state the need, estimated whole-term value, risk, market structure, timing and sensitivity. Procurement should recommend open tender, two-stage prequalification, invited competition, panel call-off, negotiated procedure or sole source. A senior approver should decide material exceptions. This ordering reduces the chance that a preferred supplier determines the method designed to select it.

An invited tender should normally include at least three genuinely independent qualified bidders where the market permits. Two bids can establish some competition, but one withdrawal then leaves a bilateral negotiation. Numerical rules are not enough: three affiliated firms, three resellers of the same service or three bidders dependent on one subcontractor do not create three independent options. The record should identify common ownership and critical shared dependencies.

When only one supplier can perform, the institution should test the cause. Exclusive intellectual property, compatibility, emergency continuity or a uniquely qualified individual may support sole source. Buyer-created lock-in does not become a neutral market fact merely because it is now expensive to escape. The approval should distinguish external uniqueness from dependency produced by earlier contracts and fund an exit where feasible.

Failed competition should generate learning. If no qualified bids arrive, the institution should examine timing, scope, liability terms, qualification, budget and publicity before inviting a known provider. If the requirement was unrealistic, repeating it privately does not cure the defect. If the market is genuinely absent, the record can support negotiation and a later capability-building plan.

The policy should also address collective purchasing. RIRs may share suppliers, research or infrastructure, and peer experience can reduce diligence cost. Joint purchasing can aggregate demand and improve terms, but it can also concentrate several registries on one provider and transplant another institution's shortlist without local scrutiny. Each participating Board should assess dependency, conflicts, data boundaries and exit.

The annual report should explain the portfolio, not only exceptional contracts. Members should see total addressable spend, method shares, bidder distribution, supplier concentration, average term, overdue competitions and realized savings or quality gains. A single well-documented award can coexist with a procurement system dominated by renewals; portfolio evidence prevents anecdote from substituting for oversight.

APNIC's closed investment-management tender shows that limited competition can yield a new provider. ARIN's contracting history shows that open requests can reveal larger markets, including for technical infrastructure and strategic advice. Neither exhibit supplies a universal rule. Together they show why method and evidence should be matched to the purchase rather than to institutional habit.

For RIPE NCC and its peers, the greatest exposure may sit in categories where suppliers shape more than price: security architecture, public policy, legal interpretation, community engagement, software and long-term operations. These contracts can define what the institution believes, who it hears and which choices remain feasible. Invitation in those areas deserves stronger challenge even when the monetary value is modest.

The final test is counterfactual. Could a qualified firm outside the known circle have learned about the opportunity, demonstrated eligibility and received equal consideration? If not, the institution should be able to show why restricting that possibility protected members better than open discovery would have.

Procurement legitimacy does not require the lowest bid, the largest field or publication of protected details. It requires a trace from need to market, shortlist, criteria, conflict, decision, contract, performance and exit. An invitation can begin that trace. It cannot be allowed to erase everyone who was never asked.

Sources