Yes, they could have.
The roles and responsibilities with regard to procurement are quite well established, including the business owner, those who might need a contracted resource; the contracting authority, who is the interface; and PSPC for contracts over a certain amount of time.
What's in place now is the correct roles and responsibilities, where the people in IT would go through the CBSA's procurement function, whether that's then onward to PSPC or for a contract within CBSA's authorities. Those have been established.