In higher education, everything feels urgent. A new tool promises to streamline a workflow, support a project, or solve a problem, and the instinct is simple: let’s get it now.
If you attended the last University Technology Coordinating Committee (UTCC) meeting, read Jeff Hollingsworth’s January 5 email, or heard colleagues mention SRM reviews, you know that urgency now comes with structure. While Software Risk Management (SRM) reviews are not new, they weren’t widely known. However, recent data breaches across higher education, growing regulatory requirements, and the increasing complexity of our software ecosystem have changed that.
The goal of formalizing this process is simple: improve transparency, reduce late-stage surprises in purchasing, and better protect university data and resources. In short, we want to avoid seeing our institution in a headline for the wrong reasons.
That’s where the SRM review process comes in. This process reviews software for security, privacy, accessibility, and compliance risks before purchase or use. It brings together security, privacy, legal, accessibility, and procurement teams so that software decisions are safer, more consistent, and easier to navigate.
However, not every tool presents the same level of risk, so for certain lower-risk purchases, departments may be eligible to use the Expedited Procurement process. This process allows departments to acquire lower-risk software licenses more quickly, bypassing the full Software Risk Management review, only when specific criteria are met. A tool may qualify if it costs less than $25,000, including open source, free, or trial versions; does not store or process restricted or sensitive data; will not be used for instruction, coursework, or required academic activities; and is not mandatory for employees.
It is very important to pause on the last two points: if a tool is required for someone’s job or used in instruction, accessibility regulations apply. Under current requirements, tools essential to job performance or academic participation must undergo accessibility review, and that step cannot be bypassed. Think of it this way: if the tool is low cost, limited in scope, and will essentially make your life easier, then the expedited way may work. If it affects a broader audience or becomes required, a full review is likely necessary. When in doubt, don’t hesitate to ask.
Expedited does not mean automatic approval, but it is faster. When everything aligns, the process typically takes about 48 hours (from the moment it’s assigned). After a request form is submitted and assigned, it is reviewed to confirm eligibility, and if clarification is needed, the requestor may be contacted via email or an IT Support ticket. If the request qualifies, the Terms and Conditions are reviewed to make sure there are no hidden clauses that puts at risk the privacy of the community at UMD.
We then notify the vendor that the university is subject to Maryland law, which prohibits certain contract terms and provisions. Most vendors accept this without issue, but they are given 48 hours to raise questions or objections. If we do not hear back, we notify the requestor that we have no objections to proceeding.
But it is important to note that this does not mean the university purchases the tool on your behalf. It means the review is complete and you may move forward with the purchase.
Occasionally, on the other hand, a vendor will not accept the required terms, and when that happens, the request must transition to the full SRM process so the Department of Procurement and Business Services can formally negotiate. Sometimes this is related to sales strategy or the possibility of an institutional contract rather than strictly legal concerns. Regardless of the reason, the objection is enough to require a full review. Our goal is always to keep things moving efficiently, and we try to communicate effectively with the vendor, but compliance and risk protection cannot be compromised.
So don’t let the word “expedited” suggest this is a shortcut around responsibility. This is not about skipping steps, but about matching the level of review to the level of risk. When in doubt, ask away! The sooner we know about a planned purchase, the easier it is to guide you to the right path.
Now let’s review some common expedited procurement questions to summarize this article:
- Does expedited mean automatic approval?
No, each request is reviewed to confirm eligibility and assess terms. - If my tool is free, does it qualify?
Not automatically. Cost is only one factor, but data use, scope, and purpose also determine eligibility. - Can I use expedited procurement for classroom tools?
No, tools used for instruction or required academic activities must undergo accessibility review and full SRM review. - What if the vendor refuses our terms?
The request moves to the full SRM process, where the Department of Procurement and Business Services can negotiate formally. - How long does expedited procurement take?
If the request meets criteria and the vendor does not object, the process typically takes about 48 hours.